Function at 0x69071260
Capabilities:
Extract resource via kernel32 functions
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x43c
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x690715f0
mov esi, eax
test byte [0x690760c0], 8
jne 0x69071420
cmp dword [ebx], 0x54
jne 0x69071400
mov eax, dword [ebx + 0x10]
test eax, 0x40000
je 0x690712a4
mov edx, dword [ebx + 0x48]
test edx, edx
je 0x69071620
test al, 0xc
je 0x69071568
mov eax, dword [ebx + 8]
test eax, eax
je 0x69071370
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x69071370
mov eax, dword [ebx + 0x10]
test ah, 4
jne 0x690713e6
test eax, 0x20000
jne 0x690715c0
test ah, 0x80
je 0x69071690
mov ecx, dword [esi]
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x3c]
mov dword [esp + 8], 5
test ecx, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
je 0x69071610
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x3c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edx, eax
mov eax, dword [esi + 4]
sub esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x69072980
mov ecx, dword [eax + 4]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x3c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxIndirectParamW]
sub esp, 0x14
test eax, eax
setg al
lea esp, [ebp - 0xc]
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x400]
mov dword [esp], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x400], 0
call sub.winspool.drv_GetDefaultPrinterW
mov eax, dword [ebp - 0x400]
sub esp, 8
test eax, eax
je 0x690715d0
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 4], edi
mov dword [esp], eax
mov ebx, eax
call sub.winspool.drv_GetDefaultPrinterW
sub esp, 8
test ebx, ebx
je 0x690715d0
mov eax, ebx
mov edx, esi
call fcn.6906b4f0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov ebx, dword [esi + 4]
mov eax, dword [ebx + 0x10]
test ah, 4
je 0x690712ce
mov eax, esi
call fcn.69070eb0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
call fcn.69041890
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x690760c0
call fcn.690753c0
test al, 8
je 0x6907155b
mov ebx, dword [esi + 4]
xor eax, eax
lea edi, [ebp - 0x3fc]
mov ecx, 0xf9
mov edx, str.PSD_MARGINS
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x400], 0
mov esi, ebx
mov ebx, edx
rep stosd dword es:[edi], eax
mov eax, 1
mov ecx, str.PSD_MINMARGINS
mov edi, 0x6907e2e0
jmp 0x6907147e
add edi, 8
test ebx, ebx
je 0x690714b8
mov ecx, ebx
mov eax, dword [edi]
mov ebx, dword [edi + 0xc]
and eax, dword [esi + 0x10]
je 0x69071470
lea eax, [ebp - 0x400]
mov dword [esp + 4], ecx
add edi, 8
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcat]
lea eax, [ebp - 0x400]
mov dword [esp], eax
call sub.ucrtbase.dll_strlen
mov edx, 0x7c
mov word [ebp + eax - 0x400], dx
test ebx, ebx
jne 0x69071477
mov ebx, esi
mov esi, dword [ebp - 0x40c]
test byte [0x690760c0], 8
je 0x69071286
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x410], edi
mov edi, dword [esi]
mov dword [ebp - 0x414], eax
mov eax, str.ansi
test edi, edi
mov dword [esp + 0x24], edx
mov edi, str.unicode
mov edx, dword [ebp - 0x40c]
cmovne eax, edi
lea edi, [ebp - 0x400]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], edi
mov edi, dword [ebp - 0x410]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x414]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s:___p_:_hwndOwner___p__hDevMode___p__hDevNames___p_nhinst__p__flags__08lx___s__n
mov dword [esp + 8], str.pagesetup_dump_dlg_struct
mov dword [esp + 4], 0x690760c0
mov dword [esp], 3
mov dword [esp + 0x28], ecx
call fcn.6906acc0
mov ebx, dword [esi + 4]
jmp 0x69071286
lea eax, [ebp - 0x400]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2000000d
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov edx, dword [esi + 4]
sub esp, 0x10
cmp dword [ebp - 0x400], 1
sbb eax, eax
and eax, 4
add eax, 4
or dword [edx + 0x10], eax
mov ebx, dword [esi + 4]
mov eax, dword [ebx + 8]
test eax, eax
jne 0x690712b7
jmp 0x69071370
mov eax, dword [ebx + 0x50]
jmp 0x69071320
mov eax, dword [esi + 4]
test byte [eax + 0x10], 0x80
je 0x69071638
mov dword [esp], 0x1008
call fcn.69041890
xor eax, eax
jmp 0x6907140e
mov dword [esp], 2
call fcn.69041890
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_FindResourceA]
sub esp, 0xc
jmp 0x6907130a
mov dword [esp], 0xb
call fcn.69041890
xor eax, eax
jmp 0x6907140e
mov eax, dword [0x6908d004]
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], edi
mov dword [esp + 4], 0x457
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
sub esp, 0x10
jmp 0x690715d9
mov eax, dword [0x6908d004]
mov dword [esp + 8], 5
mov dword [esp + 4], 0x60a
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [0x6908d004]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
jmp 0x69071320