joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad060
Capabilities:
Get common file path
Read .ini file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638dce
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], ecx
push 0x68231c
mov ecx, dword [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x64
lea ecx, [ebp - 0x134]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp - 0x154]
add edx, 8
push edx
lea ecx, [ebp - 0x28]
call fcn.00401580
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x24]
call fcn.005d6892
mov byte [ebp - 4], 1
push 0
push 0x682324
lea ecx, [ebp - 0x24]
call fcn.005d691e
test eax, eax
je 0x5ad22e
lea ecx, [ebp - 0x24]
call fcn.005d6696
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x24]
call fcn.005d6b4d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x154]
add edx, 8
push edx
lea eax, [ebp - 0x148]
push eax
call fcn.0040ed60
add esp, 0xc
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
call fcn.00587e90
push eax
push 0x64
push 0x68232c
push 0x682338
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0x148]
call fcn.00401620
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0x13c]
jne 0x5ad20a
push 0
push 0x682340
lea ecx, [ebp - 0x140]
call fcn.00414400
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
push edx
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x140]
call fcn.004571b0
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x160], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x160]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040bb70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14c]
call fcn.00401620
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
call fcn.00401620
jmp 0x5ad226
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
call fcn.00401620
cmp dword [ebp - 0x138], 0
je 0x5ad104
lea ecx, [ebp - 0x24]
call fcn.005d65c6
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.005d68b6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401620
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5ad290
Capabilities:
Get common file path
Read .ini file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638e24
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], 0
push 0x682348
mov ecx, dword [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x64
lea ecx, [ebp - 0x134]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp - 0x154]
add edx, 8
push edx
lea ecx, [ebp - 0x28]
call fcn.00401580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x24]
call fcn.005d6892
mov byte [ebp - 4], 2
push 0
push 0x682350
lea ecx, [ebp - 0x24]
call fcn.005d691e
test eax, eax
je 0x5ad465
lea ecx, [ebp - 0x24]
call fcn.005d6696
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x24]
call fcn.005d6b4d
mov byte [ebp - 4], 3
push 0
push 0x682358
lea ecx, [ebp - 0x140]
call fcn.00414400
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x144]
push edx
lea ecx, [ebp - 0x140]
call fcn.004571b0
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x15c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040bb70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x144]
call fcn.00401620
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00414580
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x5ad441
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x154]
add eax, 8
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.0040ed60
add esp, 0xc
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
call fcn.00587e90
push eax
push 0x64
push str.LanguageID
push str.Info
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
lea ecx, [ebp - 0x148]
call fcn.00401620
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
call fcn.00401620
jmp 0x5ad45d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
call fcn.00401620
cmp dword [ebp - 0x138], 0
je 0x5ad338
lea ecx, [ebp - 0x24]
call fcn.005d65c6
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x5ad4b5
mov dword [ebp - 0x14c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.005d68b6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401620
mov eax, dword [ebp - 0x14c]
jmp 0x5ad515
mov dword [ebp - 0x150], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.005d68b6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401620
mov eax, dword [ebp - 0x150]
jmp 0x5ad515
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5adbf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638f3b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00404aa0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x154]
add ecx, 0x14
call fcn.00401c10
test eax, eax
je 0x5adcf4
push 0x12c
push 0
lea eax, [ebp - 0x14c]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x154]
add ecx, 0x14
call fcn.00587e90
push eax
push 0x12c
lea ecx, [ebp - 0x14c]
push ecx
push 0x6822db
lea ecx, [ebp + 0xc]
call fcn.00587e90
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401640
lea ecx, [ebp - 0x14]
call fcn.00401c10
test eax, eax
jle 0x5adcf4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401580
mov ecx, dword [ebp - 0x150]
or ecx, 1
mov dword [ebp - 0x150], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401620
mov eax, dword [ebp + 8]
jmp 0x5add69
push 0x682410
lea ecx, [ebp + 0xc]
call fcn.00587e90
push eax
call fcn.00575260
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5add24
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x14]
call fcn.00401640
jmp 0x5add30
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040bb70
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401580
mov edx, dword [ebp - 0x150]
or edx, 1
mov dword [ebp - 0x150], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401620
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 8
Function at 0x5aec30
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x6d8c40
call fcn.005af030
add esp, 0xc
push 0x40
push 0x682480
push 0x6d8c40
push 0x6d8c40
call fcn.005aef40
add esp, 0x10
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
jne 0x5aece1
mov dword [ebp - 4], 0
jmp 0x5aec7c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x10
jge 0x5aecdf
push 0x20
mov eax, dword [0x6d47a8]
push eax
push 0x6d8c20
call fcn.005e5550
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x30
add ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x6d47a8]
push edx
call fcn.005aee40
add esp, 8
push 0x20
mov eax, dword [0x6d47a4]
push eax
mov ecx, dword [0x6d47a8]
push ecx
call fcn.005aefa0
add esp, 0xc
push 0x20
push 0x6d8c20
mov edx, dword [0x6d47a4]
push edx
call fcn.005e5550
add esp, 0xc
jmp 0x5aec73
jmp 0x5aed56
mov dword [ebp - 8], 0xf
jmp 0x5aecf3
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x5aed56
push 0x20
mov ecx, dword [0x6d47a4]
push ecx
push 0x6d8c20
call fcn.005e5550
add esp, 0xc
mov edx, dword [ebp - 8]
imul edx, edx, 0x30
add edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x6d47a4]
push eax
call fcn.005aee40
add esp, 8
push 0x20
mov ecx, dword [0x6d47a8]
push ecx
mov edx, dword [0x6d47a4]
push edx
call fcn.005aefa0
add esp, 0xc
push 0x20
push 0x6d8c20
mov eax, dword [0x6d47a8]
push eax
call fcn.005e5550
add esp, 0xc
jmp 0x5aecea
push 0x40
push 0x6824c0
push 0x6d8c40
push 0x6d8c40
call fcn.005aef40
add esp, 0x10
push 0x40
push 0x6d8c40
mov ecx, dword [ebp + 8]
push ecx
call fcn.005af080
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x5aed90
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x6d8c80
call fcn.005af030
add esp, 0xc
push 0x38
push str.91__
push 0x6d8c80
push 0x6d8c80
call fcn.005aef40
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x5aedd2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x5aee30
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x6825b8]
push eax
push 0x1c
mov ecx, dword [0x6d47b0]
push ecx
call fcn.005aefe0
add esp, 0xc
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x6825b8]
push eax
push 0x1c
mov ecx, dword [0x6d47ac]
push ecx
call fcn.005aefe0
add esp, 0xc
push 0x30
push 0x682588
push 0x6d8c80
mov edx, dword [ebp - 4]
imul edx, edx, 0x30
add edx, dword [ebp + 8]
push edx
call fcn.005aef40
add esp, 0x10
jmp 0x5aedc9
mov esp, ebp
pop ebp
ret

Function at 0x5aee40
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push 0x30
push 0x682500
mov eax, dword [ebp + 8]
push eax
push 0x6d8cc0
call fcn.005aef40
add esp, 0x10
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
push 0x6d8cc0
call fcn.005aefa0
add esp, 0xc
push 0x6d8cc0
mov edx, dword [ebp + 8]
push edx
call fcn.005aeea0
add esp, 8
push 0x20
push 0x682530
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005aef40
add esp, 0x10
pop ebp
ret
Function at 0x5af0f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x5b2de0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6392ca
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x24]
call fcn.005d6892
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str._s.
lea edx, [ebp - 0xac]
push edx
call fcn.005e5a78
add esp, 0xc
push 0
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x24]
call fcn.005d691e
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x5b2f47
lea ecx, [ebp - 0x24]
call fcn.005d6696
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0x24]
call fcn.005d6859
test eax, eax
jne 0x5b2f42
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.005d6b4d
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc8]
push eax
push 0x683980
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xbc]
push edx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.0040ed60
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbc]
call fcn.00401620
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb8]
call fcn.00401620
lea ecx, [ebp - 0x24]
call fcn.0052bb80
test eax, eax
je 0x5b2f21
lea eax, [ebp - 0xb4]
push eax
call fcn.005b2de0
add esp, 4
jmp 0x5b2f33
lea ecx, [ebp - 0xb4]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.00401620
jmp 0x5b2e4b
lea ecx, [ebp - 0x24]
call fcn.005d65c6
mov ecx, dword [ebp + 8]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0xc0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.005d68b6
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x5b3e50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63953b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.00404aa0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
push str.rn__d
lea ecx, [ebp - 0x84]
push ecx
call fcn.00405010
add esp, 0xc
push 0x64
push 0
lea edx, [ebp - 0x7c]
push edx
call fcn.005e5330
add esp, 0xc
lea ecx, [ebp + 0xc]
call fcn.00587e90
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push 0x683972
lea ecx, [ebp - 0x84]
call fcn.00587e90
push eax
push 0x683b44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004015a0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401580
mov eax, dword [ebp - 0x88]
or eax, 1
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call fcn.00401620
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401620
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x5b3f60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639570
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00404aa0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
push str.rn__d_single
lea ecx, [ebp - 0x10]
push ecx
call fcn.00405010
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00587e90
push eax
push 0
lea ecx, [ebp - 0x10]
call fcn.00587e90
push eax
push str.RightInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401620
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5b4580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.005b75a0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5b45be
or eax, 0xffffffff
jmp 0x5b4752
mov dword [ebp - 0xc], 0x800000
push 0x800000
call fcn.005c4770
add esp, 4
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.005b7140
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5b472b
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.005b7b90
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5b4717
push 0x80
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xa0]
push edx
call fcn.005e5460
add esp, 8
push 0x683be0
lea eax, [ebp - 0xa0]
push eax
call fcn.005e5460
add esp, 8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.005e5460
add esp, 8
push 0x800000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005e5330
add esp, 0xc
push 0x800000
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005b8350
add esp, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov edx, dword [ebp - 8]
push edx
call fcn.005b7aa0
add esp, 4
push 0x683be4
lea eax, [ebp - 0xa0]
push eax
call fcn.005e918f
add esp, 8
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x5b4717
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.005e96c4
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x5b4708
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xa4]
push ecx
call fcn.005e904f
add esp, 4
jmp 0x5b472b
mov edx, dword [ebp - 0xa4]
push edx
call fcn.005e904f
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
call fcn.005b7140
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x5b45f0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005b7a00
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0xac]
push eax
call fcn.005c4775
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x5c4f21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x639644
call fcn.005ef684
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.005d2d97
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x5c4f6c
call fcn.005d2d97
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x5c4f7d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x5c4f8a
or eax, 0xffffffff
jmp 0x5c50e6
mov ecx, esi
call fcn.005c4a73
mov dword [ebp - 0x14], eax
call fcn.005c7a30
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x5c5008
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x5c5008
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x5c5008
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.005c4902
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x5c5008
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x5c5008
mov ecx, ebx
call fcn.005cb0dd
test eax, eax
je 0x5c5008
push 0
mov ecx, ebx
call fcn.005cb0f8
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.005c95b6
push dword [ebp - 0x14]
call fcn.005c7988
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.005c4d29
xor edi, edi
cmp eax, edi
je 0x5c5065
test byte [esi + 0x3c], 0x10
je 0x5c504f
push 4
pop edi
mov ecx, esi
call fcn.005caf9a
test ax, 0x100
je 0x5c5045
push 5
pop edi
push edi
mov ecx, esi
call fcn.005c7550
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x5c5065
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.005cb2e5
or dword [ebp - 4], 0xffffffff
jmp 0x5c5090
cmp dword [ebp - 0x28], edi
je 0x5c509e
push 1
mov ecx, ebx
call fcn.005cb0f8
cmp dword [ebp - 0x2c], edi
je 0x5c50ae
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x5c50c7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x5c50c7
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.005c4aad
cmp dword [esi + 0x58], edi
je 0x5c50e3
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.005ef729
ret