joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ce00
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
call fcn.00420750
call fcn.00420a70
test al, al
jne 0x52ce47
lea eax, [esp + 8]
push eax
call fcn.00420a60
add esp, 4
cmp dword [esp + 8], 0x39303056
je 0x52ce47
push 0x10
push str.ERROR
push str.Eeprom_content_is_not_acceptable___r_n_Please_delete_all_.Bin_files_and_try_again.
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.0055ffd7
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 1
mov dword [esi + 0x1c], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push 0x52cdf0
push edi
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi], eax
pop esi
add esp, 8
ret

Function at 0x52d8c0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x96
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52d925
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x13
push 0x67edd0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52d9b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52d9e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x97
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52da45
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x11
push 0x67ee04
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52dad9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52db00
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x98
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52db65
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0xf
push 0x67ee18
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52dbf9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52dc20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579d80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x52dc85
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x11
push 0x67ee3c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push edi
push 1
push ebx
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52dd19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x12
push str.ISMBoard2_Dll.dll
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 1
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push edi
push 1
push ebx
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x52dd92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52ddb0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9b
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52de15
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x11
push 0x67ee50
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52dea9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52ded0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9c
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52df35
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0xf
push 0x67ee64
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52dfc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52dff0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9f
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52e055
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x10
push 0x67ee74
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52e0e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52e110
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52e175
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x12
push str.RelayBoardApp.dll
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52e209
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x52e230
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579958
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b38a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x9e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52e295
push eax
push eax
push str.Failed_to_load_dll_libraries.
call fcn.00541d2e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041d9a0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x16
push 0x67ee9c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0052d580
mov ebp, dword [esp + 0x14]
push 0x67edcc
push ebp
call fcn.0055f06e
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00560312
push esi
call fcn.0055ee22
lea eax, [ebp - 0x10]
add esp, 0x1c
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x52e329
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x5425d6
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x57a72f
call fcn.00560d9b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x5425fb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x542641
lea ecx, [ebp - 0x10]
call fcn.0041da10
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0054117d
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0041ca20
mov eax, esi
call fcn.00560e73
ret 8
Function at 0x542f98
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x6b38a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x543036
push 0x681b0c
push 4
push eax
call fcn.005615d0
push eax
call fcn.0054109b
add esp, 0x10
push ebx
push edi
call fcn.0056123e
mov edi, dword [eax]
call fcn.0056123e
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0055e316
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.0056123e
cmp dword [eax], ebx
je 0x54304d
call fcn.0056123e
push dword [eax]
call fcn.00541378
pop ecx
jmp 0x543054
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x542fde
jmp 0x5430db
call fcn.0056123e
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x5430d7
cmp dword [ebp - 0x11c], esi
jae 0x5430d7
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.0055ddd0
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x5430c6
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x5430c6
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x5430c6
push ebx
push ebx
push esi
jmp 0x5430cf
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x5430d9
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055de4a
leave
ret

Function at 0x545500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x545524
cmp dword [edi + 0x54], 0
jne 0x545524
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00546f3c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.005454c1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x545c3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x545c86
call fcn.00546f3c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x545c86
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x545cc9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x545cb2
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x545cb2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x545cc6
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x54d1a7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x54d1ee
call fcn.00546f3c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x54d1ee
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x54d20a
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0054cd21
mov esi, eax
test edi, edi
je 0x54d208
test ebx, ebx
je 0x54d208
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x55de4a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6b38a0]
jne 0x55de54
repz ret
jmp fcn.00564be6
Function at 0x574d43
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056822b
and dword [ebp - 4], 0
cmp dword [0x70de28], 0
mov ebx, eax
jne 0x574df4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x574ea5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x68b224
push edi
call esi
test eax, eax
je 0x574ea5
push eax
call fcn.005681b9
mov dword [esp], 0x68b214
push edi
mov dword [0x70de28], eax
call esi
push eax
call fcn.005681b9
mov dword [esp], 0x68b200
push edi
mov dword [0x70de2c], eax
call esi
push eax
call fcn.005681b9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x70de30], eax
call esi
push eax
call fcn.005681b9
pop ecx
mov dword [0x70de38], eax
test eax, eax
je 0x574df4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005681b9
pop ecx
mov dword [0x70de34], eax
mov eax, dword [0x70de34]
cmp eax, ebx
je 0x574e4c
cmp dword [0x70de38], ebx
je 0x574e4c
push eax
call fcn.00568234
push dword [0x70de38]
mov esi, eax
call fcn.00568234
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x574e4c
test edi, edi
je 0x574e4c
call esi
test eax, eax
je 0x574e43
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x574e43
test byte [ebp - 0xc], 1
jne 0x574e4c
or dword [ebp + 0x10], 0x200000
jmp 0x574e85
mov eax, dword [0x70de2c]
cmp eax, ebx
je 0x574e85
push eax
call fcn.00568234
pop ecx
test eax, eax
je 0x574e85
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x574e85
mov eax, dword [0x70de30]
cmp eax, ebx
je 0x574e85
push eax
call fcn.00568234
pop ecx
test eax, eax
je 0x574e85
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x70de28]
call fcn.00568234
pop ecx
test eax, eax
je 0x574ea5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x574ea7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret