joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585ec0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x614040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov eax, dword [ebx]
mov edi, dword [eax - 0xc]
test edi, edi
jne 0x585ef2
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test edi, edi
jle 0x585f27
lea esp, [esp]
test esi, esi
js 0x585fd3
mov eax, dword [ebx]
cmp esi, dword [eax - 0xc]
jg 0x585fd3
movzx eax, word [eax + esi*2]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetCharTypeW]
test al, 3
je 0x585f96
inc esi
cmp esi, edi
jl 0x585f00
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebx]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052a6ce
push str._99991332_0001.su
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052a6ce
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x585fa9
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x586980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b00f6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push 0x5e7af0
mov dword [ebp - 0x10], 0
call fcn.00402f60
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x5869f3
push 0x104
mov ecx, esi
call fcn.00402c20
push 0x104
push dword [esi]
push 0x20
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [esi]
test eax, eax
jne 0x586a11
xor ecx, ecx
jmp 0x586a23
push dword [eax - 8]
push eax
call fcn.00528e42
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x586a47
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x586a47
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3

Function at 0x586a60
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0119
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x586aa3
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.00589660
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x586b26
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x586b28
xor bl, bl
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x586b49
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x586bb0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b013c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x586bf3
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.00589660
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x586c76
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x586c78
xor bl, bl
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x586c99
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x587320
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0192
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x587418
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x587415
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00403660
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x5873ab
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402c20
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x587448
cmp eax, dword [esi - 8]
jg 0x587448
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], cx
mov edi, esp
add esi, 0xfffffff0
push esi
call fcn.00403660
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.00587320
add esp, 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x587415
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x587436
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x587460
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b01bd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], esi
mov ebx, ecx
call fcn.00414eab
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x5874ab
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonMy_Image_Garden
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x587500
test ebx, ebx
je 0x587607
push ecx
push 0x5e7af0
mov ecx, ebx
call fcn.004035a0
jmp 0x587607
lea eax, [ebp - 0x14]
mov edx, str.AppPath
push eax
call fcn.00589660
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x587540
push eax
push 0x5e7af0
lea ecx, [ebp - 0x14]
call fcn.004035a0
mov edi, dword [ebp - 0x14]
test ebx, ebx
je 0x587565
push ecx
lea eax, [edi - 0x10]
mov esi, esp
push eax
call fcn.00403660
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00586140
mov esi, dword [ebp - 0x10]
add esp, 4
test esi, esi
je 0x587574
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.004032d0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x587607
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0x20004
call fcn.0058d5b0
add esp, 4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x5875d7
mov eax, dword [ebp + 0x10]
cmp eax, 4
ja case.0x5875a7.0
jmp dword [eax*4 + 0x58763c]
push str.SU_CalenderView
jmp 0x5875cf
push str.SU_WorkShop
jmp 0x5875cf
push str.SU_Scan
jmp 0x5875cf
push str.SU_OCR
jmp 0x5875cf
push str.SU_FolderView
lea ecx, [ebp - 0x10]
call fcn.00403020
mov esi, dword [ebp - 0x10]
push esi
push str._f__s_
push ebx
call fcn.00402d50
add esi, 0xfffffff0
mov byte [ebp - 4], 0
add esp, 0xc
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x587607
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x587628
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x587650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x614040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x214], eax
mov edx, ecx
or esi, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov bl, 1
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x21c], ecx
test edi, edi
je 0x587709
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00402f60
push dword [ebp - 0x218]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x218]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5876f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x210]
test bh, bh
setne al
dec al
and bl, al
mov eax, dword [ebp - 0x214]
jmp 0x58770f
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x587786
test bl, bl
je 0x587786
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402f60
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x214]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58777d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
setne al
dec al
and bl, al
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x58781e
test bl, bl
je 0x58781e
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529409
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00402f60
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x210]
test eax, eax
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x587804
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
pop edi
setne al
dec al
pop esi
and al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
Function at 0x589460
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.00409880
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0052a743
add esp, 4
test eax, eax
je 0x5894ce
cmp eax, 1
je 0x5894ce
cmp eax, 2
je 0x5894ce
cmp eax, 0x37
je 0x5894bc
cmp eax, 0x32
jl 0x5894bc
cmp eax, 0x3c
jl 0x5894ce
cmp eax, 0x1f4
jl 0x5894ca
cmp eax, 0x258
jl 0x5894ce
xor esi, esi
jmp 0x5894d3
mov esi, 1
test ebx, ebx
je 0x5894e0
push ebx
call fcn.0040d50c
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x589660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x614040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
mov ebx, edx
mov dword [ebp - 0x14], 0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x589763
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x589776
cmp eax, 2
jbe 0x589713
cmp eax, 0xb
jne 0x589776
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
movzx ecx, byte [ebp - 5]
mov edi, eax
movzx eax, byte [ebp - 0xa]
push ecx
movzx ecx, byte [ebp - 6]
push ecx
movzx ecx, byte [ebp - 7]
push ecx
movzx ecx, byte [ebp - 8]
push ecx
movzx ecx, byte [ebp - 9]
push ecx
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
push esi
call fcn.00402d50
add esp, 0x28
jmp 0x58975f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push dword [ebp - 0x10]
call fcn.00402b80
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
mov edi, eax
mov eax, dword [esi]
test eax, eax
jne 0x58973b
xor ecx, ecx
jmp 0x58974d
push dword [eax - 8]
push eax
call fcn.00528e42
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x58978c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x58978c
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
test edi, edi
je 0x589776
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x589dc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b042c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00414eab
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x589e06
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x589e3c
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402c20
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x589f2c
cmp eax, dword [esi - 8]
jg 0x589f2c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test ebx, ebx
je 0x589eb5
cmp dword [esi - 4], 1
jle 0x589e88
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x589f2c
cmp eax, dword [esi - 8]
jg 0x589f2c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x589ec9
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [esi - 8]
push esi
call fcn.00528e42
add esp, 8
test eax, eax
js 0x589f2c
cmp eax, dword [esi - 8]
jg 0x589f2c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.004032d0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x589f1a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x58a330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], 1
push eax
mov esi, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
call fcn.00416b46
push 0x5eb198
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xd0]
movzx eax, si
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x58a39e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x58a395
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x58a395
push dword [ebp - 4]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x58a395
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x58a41a
push dword [ebp - 4]
push ebx
push eax
call fcn.0052efc0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push esi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 4]
call fcn.0040ba30
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x58a413
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x58a395
push 0
push dword [ebp - 0xc]
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x58a43e
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push dword [ebp - 8]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58c1f0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x614040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x5eb108
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x58c22c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x58c21c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
Function at 0x58d510
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [esp + 0x1c], ecx
fild qword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
fild qword [esp + 0x18]
fchs
faddp st(1)
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
fld qword [0x5ec7c0]
fmul st(1), st(0)
fmulp st(1)
fcomp qword [ebp + 8]
fnstsw ax
test ah, 5
jp 0x58d59e
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x58d710
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.00409880
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0052a743
add esp, 4
lea esi, [eax - 1]
neg esi
sbb esi, esi
neg esi
test ebx, ebx
je 0x58d765
push ebx
call fcn.0040d50c
add esp, 4
lea eax, [esi + 0x1235]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x592d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0e90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
call fcn.00417535
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x592e4b
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x592de4
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x592e4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x592e75
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x592e75
cmp dword [0x62002c], 0
je 0x592e75
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419c67
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8