joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57485b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x34], esi
call fcn.004a5dc0
mov dword [ebp - 4], 0
mov dword [esi], 0x59b8b8
mov ebx, 1
mov byte [ebp - 4], bl
mov al, byte [ebp + 8]
mov byte [esi + 0x2c], al
mov ecx, dword [0x615e2c]
push ecx
mov edx, dword [0x615e28]
push edx
mov ecx, esi
call fcn.004aea00
push 0x68
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x47d880
push 0
push 0x1d
mov ecx, eax
call fcn.00461800
jmp 0x47d882
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], bl
mov dword [esi + 0x30], eax
push 0x4c
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x47d8e1
mov ecx, dword [str.Please_enter_a_character_name:]
push ecx
sub esp, 0x14
mov edx, esp
mov ecx, dword [0x615a58]
mov dword [edx], ecx
mov ecx, dword [0x615a5c]
mov dword [edx + 4], ecx
mov ecx, dword [0x615a60]
mov dword [edx + 8], ecx
mov ecx, dword [0x615a64]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x615a68]
mov dword [edx + 0x10], ecx
mov ecx, eax
call fcn.0046de70
jmp 0x47d8e3
xor eax, eax
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], bl
mov dword [ebp - 0x20], edi
mov edx, dword [esi + 0x30]
push edx
mov ecx, esi
call fcn.004aec80
push edi
mov ecx, esi
call fcn.004aec80
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x615e30]
mov dword [eax], ecx
mov edx, dword [0x615e34]
mov dword [eax + 4], edx
mov ecx, dword [0x615e38]
mov dword [eax + 8], ecx
mov edx, dword [0x615e3c]
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call fcn.004b2130
sub esp, 0x10
mov ecx, esp
mov edx, dword [0x615e40]
mov dword [ecx], edx
mov eax, dword [0x615e44]
mov dword [ecx + 4], eax
mov edx, dword [0x615e48]
mov dword [ecx + 8], edx
mov eax, dword [0x615e4c]
mov dword [ecx + 0xc], eax
push edi
mov ecx, esi
call fcn.004b2130
push ebx
mov ecx, dword [esi + 0x30]
call fcn.004630c0
mov ecx, esi
call fcn.004b07d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x480c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57538b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x38], esi
call fcn.004a5dc0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], 0x59bb00
mov byte [ebp - 4], 1
mov eax, dword [0x615fb4]
push eax
mov ecx, dword [0x615fb0]
push ecx
mov ecx, esi
call fcn.004aea00
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x38], edx
call fcn.00528eb0
mov dword [esi + 0x34], eax
mov byte [esi + 0x40], bl
mov dword [esi + 0x3c], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
cmp eax, 5
ja case.default.0x480cb0
jmp dword [eax*4 + 0x480f7c]
mov edi, dword [str.Downloading_new_program_version]
jmp 0x480d0e
mov edi, dword [str.Downloading_new_patcher]
jmp 0x480d0e
mov edi, dword [str.Downloading_new_error_dialog]
jmp 0x480d0e
mov edi, dword [str.Downloading_new_object_data]
jmp 0x480d0e
mov edi, dword [str.Downloading_new_object_graphics]
jmp 0x480d0e
mov edi, dword [str.Downloading_new_pictures]
jmp 0x480d0e
push ebx
push eax
call fcn.004f2cc0
push eax
push str.Downloading__s
push 0xfa
lea eax, [ebp - 0x2ac]
push eax
call fcn.00537c50
add esp, 0x18
lea edi, [ebp - 0x2ac]
mov dword [ebp - 0x14], edi
push 0x4c
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x480d61
push edi
sub esp, 0x14
mov ecx, esp
mov edx, dword [0x615a44]
mov dword [ecx], edx
mov edx, dword [0x615a48]
mov dword [ecx + 4], edx
mov edx, dword [0x615a4c]
mov dword [ecx + 8], edx
mov edx, dword [0x615a50]
mov dword [ecx + 0xc], edx
mov edx, dword [0x615a54]
mov dword [ecx + 0x10], edx
mov ecx, eax
call fcn.0046de70
jmp 0x480d63
xor eax, eax
mov edi, eax
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], edi
push edi
mov ecx, esi
call fcn.004aec80
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x615fb8]
mov dword [eax], ecx
mov edx, dword [0x615fbc]
mov dword [eax + 4], edx
mov ecx, dword [0x615fc0]
mov dword [eax + 8], ecx
mov edx, dword [0x615fc4]
mov dword [eax + 0xc], edx
push edi
mov ecx, esi
call fcn.004b2130
push 0x2c
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x480dc5
mov ecx, eax
call fcn.00458580
jmp 0x480dc7
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x30], eax
push eax
mov ecx, esi
call fcn.004aec80
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x615fd8]
mov dword [eax], ecx
mov edx, dword [0x615fdc]
mov dword [eax + 4], edx
mov ecx, dword [0x615fe0]
mov dword [eax + 8], ecx
mov edx, dword [0x615fe4]
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call fcn.004b2130
mov ecx, esi
call fcn.004b07d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48b130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x19c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x24], esi
call fcn.004a5dc0
mov dword [ebp - 4], 0
mov dword [esi], 0x59af18
push 0
push 0x19
push 0x18
push 0
lea ecx, [esi + 0x34]
call fcn.00458840
mov byte [ebp - 4], 1
mov bl, 2
mov byte [ebp - 4], bl
mov eax, dword [ebp + 8]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x615f64]
push ecx
mov edx, dword [0x615f60]
push edx
mov ecx, esi
call fcn.004aea00
push 0x7c
call fcn.005512e8
add esp, 4
mov edi, eax
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x48b1df
push 0xb
push esi
lea ecx, [ebp - 0x34]
call fcn.004a5f30
mov ecx, dword [0x6148fc]
push ecx
mov edx, dword [0x6148f8]
push edx
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
mov ecx, edi
call fcn.00472780
jmp 0x48b1e1
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], bl
mov dword [esi + 0x30], eax
push eax
mov ecx, esi
call fcn.004aec80
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x615f68]
mov dword [eax], ecx
mov edx, dword [0x615f6c]
mov dword [eax + 4], edx
mov ecx, dword [0x615f70]
mov dword [eax + 8], ecx
mov edx, dword [0x615f74]
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call fcn.004b2130
mov ecx, esi
call fcn.0047f4c0
mov ecx, esi
call fcn.004b07d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4934c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5786d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004a5dc0
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x59cb30
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
xor eax, eax
mov dword [esi + 0x2c], eax
xor ecx, ecx
xor edx, edx
mov dword [esi + 0x30], ecx
xor edi, edi
mov dword [esi + 0x34], edx
push 0xfc
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], edi
mov byte [esi + 0x40], bl
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], 1
mov dword [esi + 8], 9
call fcn.00551313
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 1
cmp eax, ebx
je 0x493564
lea ecx, [eax + 8]
mov edx, 9
mov dword [ecx - 8], ebx
mov dword [ecx - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
add ecx, 0x1c
dec edx
jne 0x493548
jmp 0x493566
xor eax, eax
mov byte [esp + 0x1c], bl
mov dword [esi + 4], eax
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4f39c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.004e65c0
mov dword [ebp - 4], 0xffffffff
call fcn.004f6dc0
cmp eax, 1
je 0x4f3a0d
mov dword [ebp - 4], 2
push 1
call fcn.004bba80
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 4
push 0
call fcn.004f38d0
mov ecx, eax
call fcn.00554716
mov dword [ebp - 4], 0xffffffff
push 0x10
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00540e59
mov eax, 0x4f39eb
ret
Function at 0x521bd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cdb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], bl
mov eax, dword [ebp + 8]
mov dword [0x767b14], eax
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x3c], 0x28
mov word [ebp - 0x3a], 1
mov dword [ebp - 0x38], 0x20000025
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.GDI32.dll_ChoosePixelFormat]
mov dword [ebp - 0x44], eax
cmp eax, ebx
je 0x521cc5
lea edx, [ebp - 0x3c]
push edx
push eax
mov eax, dword [0x767b14]
push eax
call dword [sym.imp.GDI32.dll_SetPixelFormat]
test eax, eax
je 0x521cc5
mov ecx, dword [0x767b14]
push ecx
call dword [sym.imp.OPENGL32.dll_wglCreateContext]
mov dword [0x767b10], eax
push eax
mov edx, dword [0x767b14]
push edx
mov esi, dword [sym.imp.OPENGL32.dll_wglMakeCurrent]
call esi
push str.WGL_ARB_pbuffer_WGL_ARB_pixel_format
call fcn.00521100
add esp, 4
test eax, eax
jne 0x521cdf
push str.Necessary_OpenGL_extensions_were_not_supported
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 1
call fcn.00521920
test al, al
je 0x521cf5
call fcn.005216c0
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], ebx
push ebx
push ebx
call esi
mov eax, dword [0x767b10]
push eax
call dword [sym.imp.OPENGL32.dll_wglDeleteContext]
mov dword [0x767b14], ebx
call fcn.005213b0
mov al, byte [ebp - 0x11]
jmp 0x521cc7
Function at 0x5291c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58e1f1
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x5291fc
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
add esp, 0xd4
ret
push ebx
push ebp
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebp, eax
push ebp
call fcn.00529020
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x529294
mov eax, dword [0x768434]
mov byte [eax], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x768434]
xor esi, esi
test ebp, ebp
jbe 0x52927c
nop
mov dl, byte [eax + esi]
cmp dl, 0xd
lea ecx, [eax + esi]
jne 0x529262
mov eax, ebp
sub eax, esi
push eax
lea edx, [ecx + 1]
push edx
push ecx
call fcn.0053f5c0
mov eax, dword [0x768434]
add esp, 0xc
cmp byte [eax + esi], 0xa
jne 0x529271
mov byte [eax + esi], 0x20
mov eax, dword [0x768434]
cmp byte [eax + esi], 0
je 0x52927c
inc esi
cmp esi, ebp
jb 0x529240
mov ecx, dword [esp + 0xd4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd4
ret
push edi
mov edi, dword [0x768434]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
pop edi
jne 0x52922e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x52922e
push str.result_0__GetLastError__NO_ERROR
lea ecx, [esp + 0x80]
call fcn.00403cb0
mov dword [esp + 0xdc], 0
push 0x5955cf
lea ecx, [esp + 0x48]
call fcn.00403cb0
mov byte [esp + 0xdc], 1
push 0x5955cf
lea ecx, [esp + 0x10]
call fcn.00403cb0
mov byte [esp + 0xdc], 2
push str.assertion_failed
lea ecx, [esp + 0x2c]
call fcn.00403cb0
mov byte [esp + 0xdc], 3
push str..SysInc.cpp
lea ecx, [esp + 0x64]
call fcn.00403cb0
mov byte [esp + 0xdc], 4
lea eax, [esp + 0x7c]
push eax
push 0
lea ecx, [esp + 0x4c]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
push 0x75
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0xb8]
call fcn.00535de0
push 0x5b7828
lea edx, [esp + 0x9c]
push edx
call fcn.0053fb12
int3
Function at 0x529380
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58e262
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebp
push esi
mov esi, dword [esp + 0xe0]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5293b0
sub eax, edx
push 0
lea ebp, [eax + 1]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x5293e1
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
add esp, 0xd4
ret
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x5295cd
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5295cd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x5294d0
push str.textdata_NULL
lea ecx, [esp + 0x84]
call fcn.00403cb0
mov dword [esp + 0xe0], 0
push 0x5955cf
lea ecx, [esp + 0x4c]
call fcn.00403cb0
mov byte [esp + 0xe0], 1
push 0x5955cf
lea ecx, [esp + 0x14]
call fcn.00403cb0
mov byte [esp + 0xe0], 2
push str.assertion_failed
lea ecx, [esp + 0x30]
call fcn.00403cb0
mov byte [esp + 0xe0], 3
push str..SysInc.cpp
lea ecx, [esp + 0x68]
call fcn.00403cb0
mov byte [esp + 0xe0], 4
lea eax, [esp + 0x80]
push eax
push 0
lea ecx, [esp + 0x50]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x40]
push eax
push 0xd0
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0xbc]
call fcn.00535de0
push 0x5b7828
lea edx, [esp + 0xa0]
push edx
call fcn.0053fb12
lea ecx, [ebp - 1]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
mov byte [eax + ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, eax
test esi, esi
je 0x5295c0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x5295c0
push str.result0__GetLastError__NO_ERROR
lea ecx, [esp + 0x68]
call fcn.00403cb0
mov dword [esp + 0xe0], 5
push str.GetLastError__
lea ecx, [esp + 0x30]
call fcn.00403cb0
mov byte [esp + 0xe0], 6
push str.result
lea ecx, [esp + 0x14]
call fcn.00403cb0
mov byte [esp + 0xe0], 7
push str.assertion_failed
lea ecx, [esp + 0x4c]
call fcn.00403cb0
mov byte [esp + 0xe0], 8
push str..SysInc.cpp
lea ecx, [esp + 0x84]
call fcn.00403cb0
mov byte [esp + 0xe0], 9
lea eax, [esp + 0x64]
push eax
call edi
push eax
lea ecx, [esp + 0x34]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
push 0xd4
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0xbc]
call fcn.00535de0
push 0x5b7828
lea edx, [esp + 0xa0]
push edx
call fcn.0053fb12
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x5295d7
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x5295df
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
mov ecx, dword [esp + 0xd8]
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xd4
ret
Function at 0x532fb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x590108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0xc], esi
call fcn.00532df0
mov dword [esp + 0x10], 0
mov dword [esi], 0x5af880
mov byte [esi + 0x30], 1
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x536c40
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor eax, eax
mov edi, 8
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
sub eax, 0x61c88647
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add ebx, ecx
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
sub eax, 0x61c88647
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add ebx, ecx
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
add edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
add edx, ebx
dec edi
jne 0x536c58
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x536d70
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, 0xc6ef3720
mov edi, 8
jmp 0x536d90
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub ecx, ebx
add eax, 0x61c88647
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add ebx, ecx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub ecx, ebx
add eax, 0x61c88647
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add ebx, ecx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
sub edx, ebx
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
sub edx, ebx
dec edi
jne 0x536d90
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x53d969
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x53d97e
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x53d990
xor eax, eax
jmp 0x53d9c2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x53d9b4
cmp esi, eax
jae 0x53d98c
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x53d9a6
cmp esi, eax
jae 0x53d98c
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x54085e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x54087b
call fcn.00542a74
mov dword [eax], 0x16
xor eax, eax
jmp 0x5408e5
push esi
push 0x8c
push 1
call fcn.0054314a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x5408d0
push esi
call fcn.00543b04
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x5408ae
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x5407c9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5408e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0053f8fd
test ebx, ebx
pop ecx
je 0x5408e2
push ebx
call fcn.00542a86
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x540c03
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x540c23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00542a86
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x540c46
test byte [esp + 8], 2
je 0x540c46
call fcn.00542a74
mov dword [eax], 0xd
call fcn.00542a7d
mov dword [eax], 5
jmp 0x540c1f
xor eax, eax
ret