joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b9d3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jle 0x58ba03
push esi
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x6e6150]
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x58b9e1
pop esi
not eax
pop ebp
ret 8

Function at 0x58dabb
Capabilities:
Get disk information

Disassembly:
push 0x220
mov eax, 0x6b93f9
call fcn.0066d88e
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0056ab15
push 5
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 1
call fcn.00520cd3
mov ecx, eax
call fcn.005765be
mov ecx, edi
call fcn.00520cd3
mov ecx, eax
call fcn.0057605c
push eax
mov ecx, edi
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
jmp 0x58db88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
mov dword [ebp - 0x10], eax
je 0x58db3e
cmp eax, 0x18
jne 0x58db99
mov ecx, edi
call fcn.00520cd3
mov ecx, eax
call fcn.0057605c
add eax, eax
push eax
mov ecx, edi
call fcn.00520cd3
mov ecx, eax
call fcn.005765be
mov ecx, edi
call fcn.00520cd3
mov ecx, eax
call fcn.0057605c
push eax
mov ecx, edi
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call ebx
test eax, eax
je 0x58db29
mov eax, edi
call fcn.0066d966
ret 8
mov ecx, dword [ebp + 0xc]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x4272b4
push dword [ebp - 0x10]
lea eax, [ebp - 0x22c]
push eax
call fcn.005287fb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x120]
lea edi, [ebp - 0x120]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
int3
Function at 0x58e87c
Capabilities:
Get disk information

Disassembly:
push 0x1c
mov eax, 0x6b9610
call fcn.0066d88e
mov esi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.0058e488
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00520cd3
mov ecx, eax
call fcn.00576275
test al, al
je 0x58e8bc
lea ecx, [ebp - 0x28]
call fcn.0056fed3
push eax
push esi
call fcn.0057e95f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x58e91c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00577e6f
test al, al
je 0x58e906
push edi
mov ecx, esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x4280b0
push 1
call fcn.00578284
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00520932
mov al, bl
call fcn.0066d966
ret 4
call fcn.00577e6f
test al, al
je 0x58e93c
mov ecx, esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x428040
push 2
call fcn.00578284
add esp, 0xc
mov bl, 1
jmp 0x58e906
Function at 0x58e9fb
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x6b9656
call fcn.0066d88e
push dword [ebp + 8]
call fcn.0058e649
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
mov esi, edx
call fcn.0058e5a0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x58ea6f
call fcn.00577e6f
test al, al
je 0x58eb35
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x428398
push 2
call fcn.00578284
add esp, 0xc
jmp 0x58eb35
lea ecx, [ebp - 0x30]
call fcn.0056fed3
push eax
call fcn.0057da17
mov edi, edx
cmp edi, esi
mov ebx, eax
jb 0x58eaf8
ja 0x58ea8c
cmp ebx, dword [ebp - 0x14]
jb 0x58eaf8
call fcn.00577e6f
test al, al
je 0x58eac9
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [ebp - 0x14]
shrd eax, esi, 0x14
shr esi, 0x14
push esi
push eax
push 0x4282f8
push 2
call fcn.00578284
add esp, 0x1c
call fcn.00577e6f
test al, al
je 0x58eae0
push 0x428290
push 2
call fcn.00578284
pop ecx
pop ecx
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00520932
mov al, bl
call fcn.0066d966
ret 4
call fcn.00577e6f
test al, al
je 0x58eb35
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [ebp - 0x14]
shrd eax, esi, 0x14
shr esi, 0x14
push esi
push eax
push 0x4282f8
push 2
call fcn.00578284
add esp, 0x1c
call fcn.00577e6f
test al, al
je 0x58eb4c
push 0x428228
push 1
call fcn.00578284
pop ecx
pop ecx
xor bl, bl
jmp 0x58eae2
Function at 0x58eb50
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x6b9679
call fcn.0066d88e
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0058e73c
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
mov esi, edx
call fcn.0058e5a0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x58ebc7
call fcn.00577e6f
test al, al
je 0x58ec8d
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x428398
push 2
call fcn.00578284
add esp, 0xc
jmp 0x58ec8d
lea ecx, [ebp - 0x30]
call fcn.0056fed3
push eax
call fcn.0057da17
mov edi, edx
cmp edi, esi
mov ebx, eax
jb 0x58ec50
ja 0x58ebe4
cmp ebx, dword [ebp - 0x14]
jb 0x58ec50
call fcn.00577e6f
test al, al
je 0x58ec21
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [ebp - 0x14]
shrd eax, esi, 0x14
shr esi, 0x14
push esi
push eax
push 0x4284e8
push 2
call fcn.00578284
add esp, 0x1c
call fcn.00577e6f
test al, al
je 0x58ec38
push 0x428468
push 2
call fcn.00578284
pop ecx
pop ecx
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00520932
mov al, bl
call fcn.0066d966
ret 8
call fcn.00577e6f
test al, al
je 0x58ec8d
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.0056fed3
mov ecx, eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [ebp - 0x14]
shrd eax, esi, 0x14
shr esi, 0x14
push esi
push eax
push 0x4284e8
push 2
call fcn.00578284
add esp, 0x1c
call fcn.00577e6f
test al, al
je 0x58eca4
push 0x4283e8
push 1
call fcn.00578284
pop ecx
pop ecx
xor bl, bl
jmp 0x58ec3a
Function at 0x590810
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 0xc], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x590837
mov dword [ebp - 4], 0x57
jmp 0x590979
mov ecx, dword [ebp + 8]
cmp ecx, edi
push esi
mov dword [ebx], edi
je 0x59093b
cmp word [ecx], di
je 0x59093b
cmp dword [ebp + 0x10], edi
je 0x59093b
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x59093b
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push ecx
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x59088d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x59095f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5908aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x590950
mov eax, dword [0x4298b0]
shr eax, 3
inc eax
cmp esi, eax
jae 0x5908c3
mov dword [ebp - 4], 0x6f
jmp 0x590950
push esi
call fcn.0066e24a
cmp eax, edi
pop ecx
mov dword [ebp - 8], eax
je 0x59091b
push edi
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5908f8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp - 8]
call fcn.005907d8
test eax, eax
jne 0x590903
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x590942
lea eax, [esi - 0x90]
mov esi, dword [ebp + 0x10]
push eax
mov dword [esi], eax
call fcn.0066e24a
cmp eax, edi
pop ecx
mov dword [ebx], eax
jne 0x590924
mov dword [ebp - 4], 8
jmp 0x590942
push dword [esi]
mov ecx, dword [ebp - 8]
add ecx, 0x80
push ecx
push eax
call fcn.0066e76e
add esp, 0xc
jmp 0x590942
mov dword [ebp - 4], 0x57
cmp dword [ebp - 8], edi
je 0x590950
push dword [ebp - 8]
call fcn.0066e313
pop ecx
cmp dword [ebp - 0xc], 0xffffffff
je 0x59095f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], edi
pop esi
je 0x590986
mov eax, dword [ebx]
cmp eax, edi
je 0x590979
push eax
call fcn.0066e313
mov eax, dword [ebp + 0x10]
mov dword [ebx], edi
pop ecx
mov dword [eax], edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x590989
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 0x14

Function at 0x5913a2
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x592dac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
or esi, 0xffffffff
cmp dword [ebp + 0x1c], edi
mov dword [ebp - 4], edi
setne al
inc eax
mov dword [ebp + 0x1c], eax
test esi, esi
je 0x592e42
movzx eax, word [ebp + 0x1c]
push 0x429980
push eax
push dword [0x72d9c0]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x592e3c
push eax
push dword [0x72d9c0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x592e3c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x592e35
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x18]
lea eax, [esi + 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00592a10
mov edi, eax
test edi, edi
jne 0x592e35
mov eax, dword [esi]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
add dword [ebp + 0x1c], 2
jmp 0x592dc9
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x5935e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x72acfc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x80c]
push eax
push 1
xor edi, edi
push edi
push 0x4299f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x593670
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push esi
push dword [ebp - 0x80c]
mov dword [ebp - 0x808], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x593664
cmp dword [ebp - 0x808], edi
jbe 0x593664
movzx ecx, byte [ebp + eax - 0x804]
add edi, ecx
inc eax
cmp eax, dword [ebp - 0x808]
jb 0x593651
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0066d880
leave
ret 4

Function at 0x593680
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x72acfc]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
mov esi, ecx
push 0x429a28
push eax
mov byte [esi + 9], 0x3f
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push eax
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x5936f4
mov ecx, dword [ebp - 0x10c]
push edi
push 9
xor edx, edx
pop edi
mov eax, ecx
div edi
mov dword [esi + 0x3c], ecx
pop edi
add dl, 0x30
mov byte [esi + 9], dl
mov ecx, dword [ebp - 4]
pop esi
call fcn.0066d880
leave
ret
Function at 0x5936ff
Capabilities:
Get memory capacity

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
mov byte [esi + 0xa], 0x3f
mov dword [ebp - 0x20], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x18]
shr ecx, 0x14
inc ecx
push 9
pop edi
xor edx, edx
mov eax, ecx
div edi
pop edi
mov dword [esi + 0x40], ecx
add dl, 0x30
mov byte [esi + 0xa], dl
pop esi
leave
ret

Function at 0x59373d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x72acfc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
add ebx, 0x40
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push 0x429a4c
xor edi, edi
push eax
mov dword [ebp - 0x418], edi
call esi
add esp, 0xc
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, edi
mov dword [ebp - 0x41c], eax
je 0x59386c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
cmp word [eax], 0x5c
jne 0x5937b6
mov word [eax], di
cmp word [eax], di
jne 0x5937a6
push 0x429a3c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x59386c
push ebx
lea eax, [ebp - 0x20c]
push 0x429a2c
push eax
call esi
add esp, 0xc
push edi
push edi
push 3
push edi
push 3
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x59386c
push edi
lea eax, [ebp - 0x41c]
push eax
push 0xf0
lea eax, [ebp - 0x50c]
push eax
push edi
push edi
push 0x70c00
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, 1
jne 0x593865
mov eax, dword [ebp - 0x41c]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, edi
jle 0x593865
lea ecx, [ebp - 0x4fc]
mov edx, eax
mov eax, dword [ecx - 0x10]
imul eax, dword [ecx - 4]
imul eax, dword [ecx + 4]
imul eax, dword [ecx]
cmp eax, dword [ebp - 0x418]
jbe 0x59385f
mov dword [ebp - 0x418], eax
add ecx, 0x18
dec edx
jne 0x593843
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x418]
xor edx, edx
mov ecx, 0x19000
pop edi
div ecx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0066d880
leave
ret 4
Function at 0x5939d3
Capabilities:
Get memory capacity

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, 0xf4240
xor edx, edx
mov ecx, edi
div ecx
mov ecx, 0x10e
mov esi, eax
cmp esi, ecx
mov dword [ebp - 4], edx
je 0x593a2e
cmp esi, 0x14f
je 0x593a2e
cmp esi, 0x3d4
je 0x593a2e
cmp esi, 0x3d5
je 0x593a2e
cmp esi, 0x3d6
je 0x593a2e
cmp esi, 0x3d7
je 0x593a2e
cmp dword [ebp + 8], 0x1b6b0b00
jne 0x593b1f
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x48]
and eax, 0x7fffffff
xor edx, edx
div edi
cmp esi, ecx
mov dword [ebp - 4], edx
jne 0x593a51
mov dword [ebx + 0x50], 3
jmp 0x593b1e
cmp esi, 0x14f
jne 0x593a65
mov dword [ebx + 0x50], 6
jmp 0x593b1e
cmp esi, 0x3d4
jne 0x593b1e
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x593a84
mov eax, dword [ebp - 0xc]
jmp 0x593ab4
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x2c], 0x20
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x28]
xor ecx, ecx
xor edx, edx
xor edi, edi
mov di, word [edx + 0x6e65f2]
sub di, word [edx + 0x6e65f0]
add edx, 6
cmp edx, 0x8a
lea ecx, [ecx + edi + 1]
mov word [edx + 0x6e65ee], cx
jb 0x593ab8
test cx, cx
jle 0x593b1e
movsx ecx, cx
xor edx, edx
div ecx
xor edi, edi
xor eax, eax
cmp word [0x6e65f4], dx
jg 0x593b0c
mov ecx, 0x6e65f4
mov esi, ecx
mov di, word [esi]
add ecx, 6
inc eax
cmp word [ecx], dx
mov esi, ecx
jle 0x593afe
lea eax, [eax + eax*2]
movsx esi, word [eax*2 + 0x6e65f0]
movsx eax, di
sub esi, eax
add esi, edx
pop ebx
mov eax, esi
imul eax, eax, 0xf4240
add eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x59473a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x5947c5
mov eax, dword [ebp + 8]
test eax, 3
je 0x594778
cmp byte [eax], 0
je 0x5947bc
lea eax, [eax + 1]
test eax, 3
je 0x594778
cmp byte [eax], 0
je 0x5947bc
lea eax, [eax + 1]
test eax, 3
je 0x594778
cmp byte [eax], 0
je 0x5947bc
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x594778
test cl, cl
lea eax, [eax - 4]
je 0x5947bc
test ecx, 0xff00
lea eax, [eax + 1]
je 0x5947bc
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x5947bc
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x5947bc
lea eax, [eax + 1]
jmp 0x594778
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x5947cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x59483d
mov eax, dword [ebp + 8]
test eax, 3
je 0x5947fc
cmp word [eax], 0
je 0x5947f5
lea eax, [eax + 2]
test eax, 3
je 0x5947fc
jmp 0x5947e3
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x594837
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x5947fc
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x594837
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x594837
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x5947fc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x59c1db
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push 0x72db00
mov dword [ebp - 4], 0x80004005
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [0x72db18], ebx
je 0x59c209
mov dword [ebp - 4], 0x100001
jmp 0x59c29e
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x59c21c
mov dword [ebp - 4], 0x8ff00003
jmp 0x59c29e
mov eax, dword [ecx]
mov dword [0x72d9fc], eax
mov eax, dword [ecx]
cmp eax, ebx
push esi
push edi
jne 0x59c2b8
cmp dword [ecx + 4], ebx
je 0x59c297
mov eax, dword [ecx + 0x10]
mov dword [0x72dafc], eax
mov eax, dword [ecx + 8]
mov dword [0x716bbc], eax
mov eax, dword [ecx + 0xc]
push 2
push ebx
mov dword [fcn.006438cd], eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, ebx
mov dword [0x72da00], eax
jne 0x59c2b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x59c297
cmp eax, 3
jbe 0x59c290
cmp eax, 0x1f
je 0x59c290
cmp eax, 0x7e
je 0x59c290
cmp eax, 0xc1
je 0x59c290
cmp eax, 0x3ee
je 0x59c290
cmp eax, 0x485
jne 0x59c297
mov dword [ebp - 4], 0x8ff00004
call fcn.0059c041
pop edi
pop esi
push 0x72db00
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
mov ecx, 0x315
jmp 0x59c2e1
cmp eax, 1
jne 0x59c29c
mov eax, dword [ecx + 0x14]
mov dword [0x72dafc], eax
mov eax, dword [ecx + 0xc]
mov dword [0x716bbc], eax
mov eax, dword [ecx + 0x10]
mov dword [fcn.006438cd], eax
mov eax, dword [ecx + 4]
mov dword [0x72da00], eax
movzx ecx, word [ecx + 8]
cmp dword [0x716bbc], ebx
je 0x59c297
cmp dword [fcn.006438cd], ebx
je 0x59c297
movzx ecx, cx
push 0xa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x59c297
push edi
push dword [0x72da00]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, 6
jb 0x59c297
push edi
push dword [0x72da00]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x59c297
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esi + eax]
mov dword [0x72dac8], ecx
mov cx, word [0x43b9f0]
mov dword [0x72dac4], eax
cmp cx, word [eax]
jne 0x59c297
add eax, 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0059b430
cmp esi, dword [ebp - 8]
jne 0x59c297
lea eax, [ebp + 8]
push eax
call fcn.0059c0f3
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x59c297
call fcn.0059b8c5
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x59c297
push 7
pop ecx
xor eax, eax
mov edi, 0x72da10
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
mov dword [0x72db18], 1
jmp 0x59c29c
Function at 0x59e442
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x72db18], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x59e46b
mov edi, 0x8ff000ff
jmp 0x59e4b0
test ebx, ebx
je 0x59e4ab
call fcn.0059dc34
mov edi, eax
test edi, edi
jl 0x59e4b0
push esi
call fcn.0059c9ec
mov esi, eax
test esi, esi
je 0x59e4ab
test byte [esi + 0x1f], 4
jne 0x59e4a2
push esi
call fcn.0059d5f3
mov edi, eax
test edi, edi
jge 0x59e4a2
cmp edi, 0x8007000e
je 0x59e4b0
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x59e4c3
dec eax
je 0x59e4db
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066d880
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x59e4db
cmp byte [esi + 0x1e], 0
jbe 0x59e4db
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x59e4b0
cmp dword [esi + 8], 0x1000
jne 0x59e502
call fcn.005a079c
test al, al
je 0x59e502
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.005a073e
jmp 0x59e516
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x59e4ab
lea eax, [ebp - 0xc]
push eax
call fcn.0059c9d5
push ebx
push eax
call fcn.0059db80
mov edi, eax
jmp 0x59e4b0