joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5873d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x5875ab
mov ecx, esi
call fcn.00403500
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x58740d
push str.SHGetKnownFolderPath
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], 0
test eax, eax
je 0x58743a
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push edi
call eax
test eax, eax
js 0x58759d
push dword [ebp - 4]
mov ecx, esi
call fcn.00403560
jmp 0x58759d
push ebx
mov ecx, edi
mov edx, 0x5e7498
mov ebx, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x587487
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x587447
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x58747a
push 0x104
mov ecx, esi
call fcn.00402c20
push dword [esi]
push 0
push 0
push 5
jmp 0x587562
mov ecx, edi
mov edx, 0x5e74c8
mov ebx, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x5874d3
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x587493
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x5874c6
push 0x104
mov ecx, esi
call fcn.00402c20
push dword [esi]
push 0
push 0
push 0x27
jmp 0x587562
mov ecx, edi
mov edx, 0x5e74b8
mov ebx, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x58751d
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x5874e0
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x587513
push 0x104
mov ecx, esi
call fcn.00402c20
push dword [esi]
push 0
push 0
push 0x25
jmp 0x587562
mov ecx, 0x5e74d8
mov edx, 0xc
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x58756e
add edi, 4
add ecx, 4
sub edx, 4
jae 0x587527
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x58755a
push 0x104
mov ecx, esi
call fcn.00402c20
push dword [esi]
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x58759c
mov eax, dword [esi]
test eax, eax
jne 0x587578
xor ecx, ecx
jmp 0x58758a
push dword [eax - 8]
push eax
call fcn.00528e42
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x5875b1
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x5875b1
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
pop ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x5875ab
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x587880
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2306
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
mov bh, 1
call fcn.005856e0
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or esi, 0xffffffff
test eax, eax
je 0x58792b
push 0x5e9af0
lea ecx, [ebp - 0x10]
call fcn.00402f60
push 0xc
push str._f_SU_Exec_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bh
call fcn.004035a0
push 5
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov ecx, esi
setl bl
add edx, 0xfffffff0
dec bl
and bl, bh
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58792d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x58792d
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x14]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x58794e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x587970
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov eax, dword [ebx]
mov edi, dword [eax - 0xc]
test edi, edi
jne 0x5879a2
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test edi, edi
jle 0x5879d7
lea esp, [esp]
test esi, esi
js 0x587a83
mov eax, dword [ebx]
cmp esi, dword [eax - 0xc]
jg 0x587a83
movzx eax, word [eax + esi*2]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetCharTypeW]
test al, 3
je 0x587a46
inc esi
cmp esi, edi
jl 0x5879b0
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebx]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052a6ce
push str._99991332_0001.su
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052a6ce
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x587a59
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x5885f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2417
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push 0x5e9af0
mov dword [ebp - 0x10], 0
call fcn.00402f60
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x588663
push 0x104
mov ecx, esi
call fcn.00402c20
push 0x104
push dword [esi]
push 0x20
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [esi]
test eax, eax
jne 0x588681
xor ecx, ecx
jmp 0x588693
push dword [eax - 8]
push eax
call fcn.00528e42
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x5886b7
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x5886b7
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3

Function at 0x5886d0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b243a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x588713
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.0058b690
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x588796
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x588798
xor bl, bl
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5887b9
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588820
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b245d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x588863
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.0058b690
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5888e6
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x5888e8
xor bl, bl
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x588909
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588f90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b24b3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x589088
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x589085
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00403660
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x58901b
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402c20
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x5890b8
cmp eax, dword [esi - 8]
jg 0x5890b8
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], cx
mov edi, esp
add esi, 0xfffffff0
push esi
call fcn.00403660
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.00588f90
add esp, 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x589085
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x5890a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x589280
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2509
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], esi
mov ebx, ecx
call fcn.00414e1f
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x5892cb
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonMy_Image_Garden
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x589320
test ebx, ebx
je 0x589427
push ecx
push 0x5e9af0
mov ecx, ebx
call fcn.004035a0
jmp 0x589427
lea eax, [ebp - 0x14]
mov edx, str.AppPath
push eax
call fcn.0058b690
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x589360
push eax
push 0x5e9af0
lea ecx, [ebp - 0x14]
call fcn.004035a0
mov edi, dword [ebp - 0x14]
test ebx, ebx
je 0x589385
push ecx
lea eax, [edi - 0x10]
mov esi, esp
push eax
call fcn.00403660
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00587db0
mov esi, dword [ebp - 0x10]
add esp, 4
test esi, esi
je 0x589394
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.004032d0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x589427
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0x20004
call fcn.0058f590
add esp, 4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x5893f7
mov eax, dword [ebp + 0x10]
cmp eax, 4
ja case.0x5893c7.0
jmp dword [eax*4 + 0x58945c]
push str.SU_CalenderView
jmp 0x5893ef
push str.SU_WorkShop
jmp 0x5893ef
push str.SU_Scan
jmp 0x5893ef
push str.SU_OCR
jmp 0x5893ef
push str.SU_FolderView
lea ecx, [ebp - 0x10]
call fcn.00403020
mov esi, dword [ebp - 0x10]
push esi
push str._f__s_
push ebx
call fcn.00402d50
add esi, 0xfffffff0
mov byte [ebp - 4], 0
add esp, 0xc
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x589427
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x589448
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x589470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x214], eax
mov edx, ecx
or esi, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov bl, 1
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x21c], ecx
test edi, edi
je 0x589529
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00402f60
push dword [ebp - 0x218]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x218]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x589512
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x210]
test bh, bh
setne al
dec al
and bl, al
mov eax, dword [ebp - 0x214]
jmp 0x58952f
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x5895a6
test bl, bl
je 0x5895a6
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402f60
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x214]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58959d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
setne al
dec al
and bl, al
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x58963e
test bl, bl
je 0x58963e
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00402f60
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x210]
test eax, eax
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x589624
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
pop edi
setne al
dec al
pop esi
and al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
Function at 0x58b490
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.00409880
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0052a743
add esp, 4
test eax, eax
je 0x58b4fe
cmp eax, 1
je 0x58b4fe
cmp eax, 2
je 0x58b4fe
cmp eax, 0x37
je 0x58b4ec
cmp eax, 0x32
jl 0x58b4ec
cmp eax, 0x3c
jl 0x58b4fe
cmp eax, 0x1f4
jl 0x58b4fa
cmp eax, 0x258
jl 0x58b4fe
xor esi, esi
jmp 0x58b503
mov esi, 1
test ebx, ebx
je 0x58b510
push ebx
call fcn.0040d50c
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58b690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
mov ebx, edx
mov dword [ebp - 0x14], 0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x58b793
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x58b7a6
cmp eax, 2
jbe 0x58b743
cmp eax, 0xb
jne 0x58b7a6
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
movzx ecx, byte [ebp - 5]
mov edi, eax
movzx eax, byte [ebp - 0xa]
push ecx
movzx ecx, byte [ebp - 6]
push ecx
movzx ecx, byte [ebp - 7]
push ecx
movzx ecx, byte [ebp - 8]
push ecx
movzx ecx, byte [ebp - 9]
push ecx
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
push esi
call fcn.00402d50
add esp, 0x28
jmp 0x58b78f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push dword [ebp - 0x10]
call fcn.00402b80
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
mov edi, eax
mov eax, dword [esi]
test eax, eax
jne 0x58b76b
xor ecx, ecx
jmp 0x58b77d
push dword [eax - 8]
push eax
call fcn.00528e42
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x58b7bc
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x58b7bc
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
test edi, edi
je 0x58b7a6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x58be00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b27ce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00414e1f
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x58be46
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x58be7c
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402c20
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x58bf6c
cmp eax, dword [esi - 8]
jg 0x58bf6c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test ebx, ebx
je 0x58bef5
cmp dword [esi - 4], 1
jle 0x58bec8
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x58bf6c
cmp eax, dword [esi - 8]
jg 0x58bf6c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x58bf09
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x58bf6c
cmp eax, dword [esi - 8]
jg 0x58bf6c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.004032d0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58bf5a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x58c380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], 1
push eax
mov esi, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
call fcn.00416adc
push 0x5ed21c
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xd0]
movzx eax, si
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x58c3ee
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x58c3e5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x58c3e5
push dword [ebp - 4]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x58c3e5
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x58c46a
push dword [ebp - 4]
push ebx
push eax
call fcn.0052efb0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push esi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 4]
call fcn.0040ba30
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x58c463
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x58c3e5
push 0
push dword [ebp - 0xc]
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x58c48e
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push dword [ebp - 8]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret