joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522e10
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x584a6b
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x138]
push esi
mov esi, dword [esp + 0x138]
push edi
push ebp
push esi
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x522f83
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x522f76
cmp dword [esp + 0x14], ebx
jbe 0x522f76
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
push 0x400
push ebx
push edi
mov byte [esp + 0x1f], bl
call esi
test eax, eax
je 0x522e9e
push 0x400
push ebx
push edi
call esi
test eax, eax
jne 0x522e91
mov eax, dword [esp + 0x14]
xor esi, esi
cmp eax, ebx
jbe 0x522f66
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x1c]
push edx
push esi
mov ecx, dword [eax]
push eax
mov dword [esp + 0x28], ebx
call dword [ecx + 0x10]
test eax, eax
jl 0x522f4c
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x522f4c
lea ecx, [esp + 0x24]
push 0x104
push ecx
push 2
push eax
mov byte [esp + 0x34], bl
call ebp
lea edx, [esp + 0x24]
lea ecx, [esp + 0x18]
push edx
call sub.MFC42.DLL_CString::CString_2
push 0x5e1560
push 0x5dff40
lea ecx, [esp + 0x20]
mov dword [esp + 0x138], ebx
call sub.MFC42.DLL_CString::Replace
mov eax, dword [esp + 0x18]
xor edx, edx
push eax
mov eax, dword [esp + 0x24]
cmp esi, eax
lea ecx, [esi + 0x17d4]
setne dl
dec edx
push ecx
and edx, 8
push edx
push edi
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x13], 1
mov dword [esp + 0x130], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x522eb2
cmp byte [esp + 0x13], bl
jne 0x522f83
mov ebp, dword [esp + 0x140]
mov eax, dword [esp + 0x13c]
push 0x403
push ebp
push eax
jmp 0x522f7d
push 0x403
push ebp
push esi
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x522fa0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x584a8b
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov esi, dword [esp + 0x138]
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
test edi, edi
je 0x52313d
mov eax, dword [esp + 0x134]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x20]
mov ecx, dword [eax]
push edx
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x523130
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x523130
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
push 0x400
push 2
push edi
call esi
test eax, eax
je 0x523030
push 0x400
push 2
push edi
call esi
test eax, eax
jne 0x523022
mov eax, dword [esp + 0x18]
test eax, eax
mov eax, 0x5e1624
jne 0x523042
mov eax, 0x5e1618
push eax
push 0x47e
push 0x400
push 0
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jbe 0x523119
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x18]
push edx
push esi
mov ecx, dword [eax]
push eax
mov dword [esp + 0x24], 0
call dword [ecx + 0x18]
test eax, eax
jl 0x52310b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x52310b
lea ecx, [esp + 0x24]
push 0x104
push ecx
push 2
push eax
mov byte [esp + 0x34], 0
call ebp
lea edx, [esp + 0x24]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::CString_2
push 0x5e1560
push 0x5dff40
lea ecx, [esp + 0x18]
mov dword [esp + 0x138], 0
call sub.MFC42.DLL_CString::Replace
mov eax, dword [esp + 0x10]
xor edx, edx
push eax
mov eax, dword [esp + 0x24]
cmp esi, eax
lea ecx, [esi + 0x17dd]
setne dl
dec edx
push ecx
and edx, 8
push edx
push edi
call ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x130], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x523071
pop ebp
mov esi, dword [esp + 0x18]
xor eax, eax
test esi, esi
sete al
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x52313d
push 0x403
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x526260
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x584fb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x54]
mov dword [esp + 0xb4], ebx
call fcn.00564e4e
mov dword [esi], vtable.CMenuEx.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], vtable.CMenu.0
lea ecx, [esp + 0xc]
mov byte [esp + 0xb4], 2
call sub.MFC42.DLL_CMenu::DestroyMenu
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov edx, dword [esp + 0x1c]
cmp edx, 6
mov edx, dword [esp + 0xbc]
setae cl
mov byte [esi + 8], cl
mov dword [esi + 0x50], edx
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp al, 5
jb 0x526306
push 0x1e
jmp 0x526308
push 0xf
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
call edi
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x2c], 0xac6c1e
mov dword [esi + 0x10], 0xebe8e6
mov dword [esi + 0x14], 0xd7d0cc
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xffffff
mov dword [esi + 0x20], 0x797979
mov dword [esi + 0x24], 0xc8bfba
call edi
mov dword [esi + 0x28], eax
mov eax, 0x11
mov ecx, eax
mov dword [esi + 0x38], eax
mov eax, 3
mov dword [esi + 0x3c], ecx
mov ecx, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0xac]
mov dword [esi + 0x30], 0xffffff
mov dword [esi + 0x34], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret 4

Function at 0x5271b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x5e17d8]
sub esp, 8
cmp eax, 0xffffffff
jne 0x5271d6
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x5e17d8], eax
jne 0x5271d6
mov eax, 0x80004005
add esp, 8
ret
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
jne 0x52728d
mov dword [esp], eax
push esi
lea eax, [esp + 4]
push edi
push eax
push 0x59c514
push 0x597de8
call fcn.00527450
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ole32.dll_CoRegisterClassObject]
lea ecx, [esp + 0xc]
push ecx
push 1
push 1
push edx
push 0x597de8
call esi
mov edi, dword [sym.imp.ole32.dll_CoRegisterPSClsid]
push 0x597de8
push 0x597de8
call edi
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 1
push 1
push ecx
push 0x597df8
call esi
push 0x597df8
push 0x597df8
call edi
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 1
push 1
push eax
push 0x597e08
call esi
push 0x597e08
push 0x597e08
call edi
mov ecx, dword [0x5e17d8]
push 1
push ecx
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [esp + 8]
pop edi
test eax, eax
pop esi
je 0x52728d
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
add esp, 8
ret
Function at 0x5272a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
call fcn.005271b0
test eax, eax
jl 0x5272e8
push str.STORMBOX_C6688147_58EF_4FDF_A15A_CD51D8CDC4C5
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
test eax, eax
je 0x5272ef
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x108]
push eax
push 0x597de8
push 4
push 0
push 0x597e28
call dword [sym.imp.ole32.dll_CoCreateInstance]
add esp, 0x104
ret
push esi
lea eax, [esp + 4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push 0x104
lea eax, [esp + 8]
push str.boxStline.exe
push eax
call esi
push 0x104
lea ecx, [esp + 8]
push str.__Embedding
push ecx
call esi
lea edx, [esp + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
cmp eax, 0x1f
pop esi
ja 0x5272cc
mov eax, 0x80004005
add esp, 0x104
ret

Function at 0x528320
Capabilities:
Hide graphical window

Disassembly:
push esi
call fcn.00527810
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_SetParent]
pop esi
ret
Function at 0x528620
Capabilities:
Hide graphical window

Disassembly:
call fcn.00527810
test eax, eax
je 0x528646
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x52863d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x529a90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x529b10
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
push edx
push eax
push esi
mov dword [ecx], esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x529b10
test esi, esi
je 0x529b10
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x529b10
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x529afe
mov edx, esi
cmp edi, ebx
jb 0x529b08
add edx, ebx
cmp edi, edx
jbe 0x529b1a
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x529af0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x529b40
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov edx, dword [0x5eb554]
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret
Function at 0x529b90
Capabilities:
Delete file

Disassembly:
sub esp, 0x224
lea eax, [esp + 0xc]
push esi
push edi
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1e]
push eax
mov eax, dword [esp + 0x20]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push str...Crash__02d__02d__02d__02d__02d__02d.dmp
lea ecx, [esp + 0x144]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x24
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea edx, [esp + 0x24]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x128]
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push edi
push edi
push 1
push edi
push edi
lea eax, [esp + 0x38]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x529cdb
push ebp
push str.DbgHelp.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebp, eax
cmp ebp, edi
je 0x529cc8
push ebx
push str.MiniDumpWriteDump
push ebp
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x529cc0
xor ecx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edx, dword [esp + 0x238]
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x14]
push edi
push eax
push 2
push esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call ebx
mov edi, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop ebp
pop edi
pop esi
add esp, 0x224
ret
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
Function at 0x531830
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
test eax, eax
je 0x531847
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [edi + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov ebx, dword [eax + 4]
push 0x12c
push 0x190
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
call ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x5318af
mov eax, dword [edi + 0x50]
lea ecx, [esp + 0x38]
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_FillRect]
push 1
push esi
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], 0x32
mov dword [esp + 0x38], 0x12c
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xffff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [edi + 0x54]
push edx
push esi
call ebp
mov ecx, dword [edi + 0x48]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push 0
push eax
push 0xffffffffffffffff
push ecx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
push 0xcc0020
push 0
push 0
push esi
push 0x12c
push 0x190
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea edx, [esp + 0x38]
push eax
push edx
push ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
call fcn.0042d290
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x20]
push edx
mov dword [edi + 0x58], ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x14]
push eax
push esi
call ebp
mov ecx, dword [esp + 0x18]
push ecx
push esi
call ebp
mov eax, dword [edi + 0x20]
mov edx, dword [esp + 0x10]
push ebx
push eax
mov dword [edi + 0x44], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [edi + 0x44]
lea ecx, [esp + 0x1c]
call fcn.0042d2e0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
Function at 0x53a000
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, dword [esp + 0x110]
lea ecx, [esp + 4]
push str.storm_skinMat
push ecx
push 0x5cf4a4
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
pop edi
add esp, 0x108
ret

Function at 0x53a060
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, dword [esp + 0x110]
lea ecx, [esp + 4]
push str.storm_temp
push ecx
push str._s_s_
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
pop edi
add esp, 0x108
ret

Function at 0x53a0c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x587158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x14]
mov byte [esp + 0x2c], 2
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
and ecx, 0xffff
push ecx
push 0x5ce744
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x22]
add esp, 0xc
and eax, 0xffff
lea ecx, [esp + 4]
push eax
push 0x5ce744
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x26]
add esp, 0xc
and edx, 0xffff
lea eax, [esp]
push edx
push 0x5ce744
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 4]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push ecx
push edx
push eax
call sub.MFC42.DLL_operator_3
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_operator_3
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x53b110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x30c
push ebx
push ebp
mov ebp, dword [esp + 0x318]
push esi
test ebp, ebp
push edi
je 0x53b185
push 0x104
lea eax, [esp + 0x14]
push ebp
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
push 6
lea ecx, [esp + 0x20]
push str.res:__
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0x18
test eax, eax
jne 0x53b185
mov ebx, dword [sym.imp.MSVCRT.dll__mbstok]
lea edx, [esp + 0x16]
push 0x5ce588
push edx
mov esi, 1
call ebx
add esp, 8
test eax, eax
je 0x53b185
mov ecx, esi
inc esi
cmp ecx, 1
je 0x53b192
push 0x5ce588
push 0
call ebx
add esp, 8
test eax, eax
jne 0x53b16d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30c
ret
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
push 6
lea edx, [esp + 0x20]
push str.res:__
push edx
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0x18
test eax, eax
jne 0x53b185
lea eax, [esp + 0x16]
push 0x5ce588
push eax
mov esi, 1
call ebx
add esp, 8
test eax, eax
je 0x53b185
mov ecx, esi
inc esi
cmp ecx, 2
je 0x53b21d
push 0x5ce588
push 0
call ebx
add esp, 8
test eax, eax
jne 0x53b1fa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
and eax, 0xffff
push eax
call fcn.0053af20
mov ecx, eax
call fcn.0053afe0
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x53b185
push esi
call fcn.0053af20
mov ecx, eax
call fcn.0053afe0
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x53b185
push esi
call fcn.0053af20
mov ecx, eax
call fcn.0053afe0
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x324]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
Function at 0x53be50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58731f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 1
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x53be93
mov eax, dword [esi]
jmp 0x53be95
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [ecx + 0x6c]
test eax, eax
jge 0x53beb1
push 0x5d8b68
push edi
push eax
call fcn.00565aa0
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
mov word [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
test esi, esi
mov byte [esp + 0x24], 0
je 0x53bf1e
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jne 0x53bf1e
mov eax, dword [esi]
test eax, eax
je 0x53bf05
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x53bf15
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x53c620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5873ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 1
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x53c663
mov eax, dword [esi]
jmp 0x53c665
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x53c686
push 0x5d8b68
push edi
push eax
call fcn.00565aa0
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
mov word [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
test esi, esi
mov byte [esp + 0x24], 0
je 0x53c6f3
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jne 0x53c6f3
mov eax, dword [esi]
test eax, eax
je 0x53c6da
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x53c6ea
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc