joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554e08
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x606040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0053e7ac
mov dword [ebp - 0x14], eax
cmp dword [0x612e6c], esi
jne 0x554efb
push 0x800
push esi
push 0x5d7340
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x554e88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x554fdb
push esi
push esi
push 0x5d7340
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x554fdb
push 0x5d7358
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x554fdb
push eax
call ebx
push 0x5d7364
push edi
mov dword [0x612e6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5d7374
push edi
mov dword [0x612e70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x612e74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x612e7c], eax
test eax, eax
je 0x554ef8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x612e78], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x554f20
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x554f13
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x554f35
push 4
pop eax
jmp 0x554fdd
cmp dword [ebp - 0x14], esi
je 0x554f35
push dword [0x612e6c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x554f1a
mov eax, dword [0x612e78]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x554f93
cmp dword [0x612e7c], edi
je 0x554f93
push eax
call ebx
push dword [0x612e7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x554f93
test eax, eax
je 0x554f93
call ecx
test eax, eax
je 0x554f88
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x554f88
test byte [ebp - 8], 1
jne 0x554f93
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x554fc3
mov eax, dword [0x612e70]
cmp eax, edi
je 0x554fc0
push eax
call ebx
test eax, eax
je 0x554fc0
call eax
mov esi, eax
test esi, esi
je 0x554fc0
mov eax, dword [0x612e74]
cmp eax, edi
je 0x554fc0
push eax
call ebx
test eax, eax
je 0x554fc0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x612e6c]
call ebx
test eax, eax
je 0x554fdb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x554fdd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00535334
mov esp, ebp
pop ebp
ret
Function at 0x56b130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
xor bl, bl
mov ecx, dword [edi + 0x4f0]
test ecx, ecx
je 0x56b18d
push esi
lea eax, [ebp - 4]
push eax
call fcn.005715f0
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56b16a
mov eax, dword [edi + 0x4f0]
cmp dword [eax + 0x6c], 0
jbe 0x56b16a
mov bl, 1
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56b184
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56b400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
xor bl, bl
mov ecx, dword [edi + 0x4f0]
test ecx, ecx
je 0x56b45d
push esi
lea eax, [ebp - 4]
push eax
call fcn.005715f0
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56b43a
mov eax, dword [edi + 0x4f0]
cmp dword [eax + 0x6c], 0
ja 0x56b43a
mov bl, 1
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56b454
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56b470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0ec2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x4f0]
test ecx, ecx
je 0x56b538
lea eax, [ebp - 0x10]
push eax
call fcn.005715f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x56b4fa
mov eax, dword [edi + 0x4f0]
cmp dword [eax + 0x6c], 0
ja 0x56b4fa
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
call fcn.004039f0
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.0058fd60
add esp, 4
mov ecx, str.PELaunchAppExplorer
call fcn.0058fbc0
jmp 0x56b517
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56b506
mov edi, eax
push 0
mov edx, 0x103c01
mov ecx, edi
call fcn.00574b30
add esp, 4
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56b538
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56b550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0ee5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x4f0]
test ecx, ecx
je 0x56b63a
lea eax, [ebp - 0x10]
push eax
call fcn.005715f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x56b5fc
mov eax, dword [ebx + 0x4f0]
cmp dword [eax + 0x6c], 0
ja 0x56b5fc
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
call fcn.004039f0
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.005900a0
add esp, 4
test al, al
jne 0x56b5f0
mov eax, dword [ebx + 0x4c8]
test eax, eax
je 0x56b5df
mov ebx, eax
push 0
mov edx, 0x103800
mov ecx, ebx
call fcn.00574b30
add esp, 4
mov ecx, str.PELaunchAppPDFViewer
call fcn.0058fbc0
jmp 0x56b619
mov eax, dword [ebx + 0x4c8]
test eax, eax
je 0x56b608
mov ebx, eax
push 0
mov edx, 0x103c00
mov ecx, ebx
call fcn.00574b30
add esp, 4
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56b63a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56d310
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a10ac
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
mov dword [eax + 0x4ec], ecx
mov eax, dword [0x6157fc]
add eax, 0xfffffff0
push eax
call fcn.004039f0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov edi, 1
mov eax, dword [esi - 8]
mov ecx, edi
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x56d38a
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402400
mov esi, dword [ebp - 0x10]
push str.PETEMP_UI
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [esi - 8]
push esi
call fcn.005360d5
add esp, 8
test eax, eax
js 0x56d51c
cmp eax, dword [esi - 8]
jg 0x56d51c
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x56d3d2
push 0
push esi
call ebx
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x56d3ee
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push 4
push str._0d
push eax
call fcn.00404210
mov eax, dword [esi - 8]
add esp, 0x10
sub edi, dword [esi - 4]
sub eax, 0x104
or eax, edi
jge 0x56d434
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402400
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [esi - 8]
push esi
call fcn.005360d5
add esp, 8
test eax, eax
js 0x56d51c
cmp eax, dword [esi - 8]
jg 0x56d51c
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56d474
push eax
push esi
call ebx
push 0xb8
call fcn.0040a3f9
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x56d495
mov ecx, eax
call fcn.00572880
jmp 0x56d497
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 1
mov dword [ecx + 0x4f0], eax
test eax, eax
je 0x56d4ca
push ecx
lea eax, [esi - 0x10]
mov ebx, esp
push eax
call fcn.004039f0
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x4f0]
call fcn.00571770
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x56d4ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x56d508
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401e70
int3
Function at 0x572bd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1498
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x606040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp dword [edi + 0x80], 0
jne 0x572d53
call fcn.0040ca5f
test eax, 0x800
jne 0x572d53
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x572d53
push dword [edi + 0x74]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x572d53
push 0xd
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
mov dword [ebp - 0x30], esi
test esi, esi
jne 0x572c67
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push 0x5fd754
push eax
call fcn.00539115
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x572c89
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 0x5fd754
push eax
call fcn.00539115
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x572cbf
mov dword [ebp - 0x1c], ebx
mov word [ebp + ebx*2 - 0x2c], ax
jmp 0x572cc9
push ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405380
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x572cd5
lea eax, [ebp - 0x2c]
push ebx
push dword [ebp - 0x38]
push eax
call fcn.0053b3f0
add esp, 0xc
xor esi, esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jge 0x572d31
cmp eax, esi
ja 0x572cf9
push str.invalid_string_position
call fcn.00569015
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x572d05
lea eax, [ebp - 0x2c]
movzx eax, word [eax + esi*2]
test eax, eax
je 0x572d31
push eax
mov ecx, edi
call fcn.00572ac0
test eax, eax
jne 0x572d2e
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x2c]
call fcn.00402b20
mov eax, 1
jmp 0x572d55
inc esi
jmp 0x572ce4
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.00572a20
cmp dword [ebp - 0x18], 8
jb 0x572d4d
push dword [ebp - 0x2c]
call fcn.0040a426
add esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00535334
mov esp, ebp
pop ebp
ret 4
Function at 0x574850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a171f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
push 0x147
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x574936
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5748cf
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x574936
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x574960
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x574960
cmp dword [0x6157f4], 0
je 0x574960
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x575900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a18bb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
push 0x13e
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x5759e6
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x57597f
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5759e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x575a10
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x575a10
cmp dword [0x6157f4], 0
je 0x575a10
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x575ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a19cb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
push 0x141
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x575f86
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x575f1f
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x575f86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x575fb0
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x575fb0
cmp dword [0x6157f4], 0
je 0x575fb0
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x577fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1ccb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
mov dword [ebp - 4], 0
mov eax, dword [esi + 0xf4]
cmp eax, 3
je 0x577ff7
cmp eax, 4
je 0x577ff7
push 0x145
jmp 0x577ffc
push 0x146
lea ecx, [ebp - 0x20]
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x57809d
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x578036
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x57809d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x5780c7
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x5780c7
cmp dword [0x6157f4], 0
je 0x5780c7
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x579bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1f63
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
push 0x13f
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x579c96
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x579c2f
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x579c96
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x579cc0
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x579cc0
cmp dword [0x6157f4], 0
je 0x579cc0
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57b0a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2210
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x606040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.0043d420
push 0x144
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0043d636
call fcn.0041a0c0
mov eax, dword [eax + 4]
cmp word [eax + 0x120], 0
jbe 0x57b186
call fcn.0040a74d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x57b11f
push 0x80004005
call fcn.00401e70
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0043d46f
call fcn.0041a0c0
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x120]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0043d69e
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x57b186
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x57b1b0
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x57b1b0
cmp dword [0x6157f4], 0
je 0x57b1b0
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0043e3cb
mov ecx, esi
call fcn.0043e137
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.0043d45b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret