joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589740
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x214], eax
mov edx, ecx
or esi, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov bl, 1
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x21c], ecx
test edi, edi
je 0x5897f9
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529439
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00402f60
push dword [ebp - 0x218]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x218]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5897e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x210]
test bh, bh
setne al
dec al
and bl, al
mov eax, dword [ebp - 0x214]
jmp 0x5897ff
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x589876
test bl, bl
je 0x589876
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529439
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402f60
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x214]
test eax, eax
mov ecx, esi
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58986d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
setne al
dec al
and bl, al
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x58990e
test bl, bl
je 0x58990e
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00529439
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00402f60
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x210]
test eax, eax
sete bh
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x5898f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bh, bh
pop edi
setne al
dec al
pop esi
and al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
Function at 0x58b760
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.00409880
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0052a773
add esp, 4
test eax, eax
je 0x58b7ce
cmp eax, 1
je 0x58b7ce
cmp eax, 2
je 0x58b7ce
cmp eax, 0x37
je 0x58b7bc
cmp eax, 0x32
jl 0x58b7bc
cmp eax, 0x3c
jl 0x58b7ce
cmp eax, 0x1f4
jl 0x58b7ca
cmp eax, 0x258
jl 0x58b7ce
xor esi, esi
jmp 0x58b7d3
mov esi, 1
test ebx, ebx
je 0x58b7e0
push ebx
call fcn.0040d533
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58b990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
mov ebx, edx
mov dword [ebp - 0x14], 0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x58ba93
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x58baa6
cmp eax, 2
jbe 0x58ba43
cmp eax, 0xb
jne 0x58baa6
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
movzx ecx, byte [ebp - 5]
mov edi, eax
movzx eax, byte [ebp - 0xa]
push ecx
movzx ecx, byte [ebp - 6]
push ecx
movzx ecx, byte [ebp - 7]
push ecx
movzx ecx, byte [ebp - 8]
push ecx
movzx ecx, byte [ebp - 9]
push ecx
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
push esi
call fcn.00402d50
add esp, 0x28
jmp 0x58ba8f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push dword [ebp - 0x10]
call fcn.00402b80
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
mov edi, eax
mov eax, dword [esi]
test eax, eax
jne 0x58ba6b
xor ecx, ecx
jmp 0x58ba7d
push dword [eax - 8]
push eax
call fcn.00528e72
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x58babc
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x58babc
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
test edi, edi
je 0x58baa6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x58c100
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2bae
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.0041505f
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x58c146
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x58c17c
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402c20
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi - 8]
push esi
call fcn.00528e72
add esp, 8
test eax, eax
js 0x58c26c
cmp eax, dword [esi - 8]
jg 0x58c26c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test ebx, ebx
je 0x58c1f5
cmp dword [esi - 4], 1
jle 0x58c1c8
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push dword [esi - 8]
push esi
call fcn.00528e72
add esp, 8
test eax, eax
js 0x58c26c
cmp eax, dword [esi - 8]
jg 0x58c26c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x58c209
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402c90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [esi - 8]
push esi
call fcn.00528e72
add esp, 8
test eax, eax
js 0x58c26c
cmp eax, dword [esi - 8]
jg 0x58c26c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.004032d0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58c25a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402740
int3
Function at 0x58c680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], 1
push eax
mov esi, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
call fcn.00416d27
push 0x5ed238
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xd0]
movzx eax, si
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x58c6ee
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x58c6e5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x58c6e5
push dword [ebp - 4]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x58c6e5
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x58c76a
push dword [ebp - 4]
push ebx
push eax
call fcn.0052eff0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push esi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 4]
call fcn.0040ba60
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x58c763
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x58c6e5
push 0
push dword [ebp - 0xc]
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x58c78e
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push dword [ebp - 8]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58e510
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x5ed1a8
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x58e54c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x58e53c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
Function at 0x58f800
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [esp + 0x1c], ecx
fild qword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
fild qword [esp + 0x18]
fchs
faddp st(1)
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
fld qword [0x5ee9c0]
fmul st(1), st(0)
fmulp st(1)
fcomp qword [ebp + 8]
fnstsw ax
test ah, 5
jp 0x58f88e
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x58fa40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.00409880
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0052a773
add esp, 4
lea esi, [eax - 1]
neg esi
sbb esi, esi
neg esi
test ebx, ebx
je 0x58fa95
push ebx
call fcn.0040d533
add esp, 4
lea eax, [esi + 0x1235]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590840
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b31e3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x14]
push 0x20001
call fcn.0058f8e0
add esp, 4
mov esi, dword [ebp - 0x14]
mov ecx, 0x5ead7c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5908a8
test dx, dx
je 0x5908a4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x5908a8
add eax, 4
add ecx, 4
test dx, dx
jne 0x590882
xor eax, eax
jmp 0x5908ad
sbb eax, eax
or eax, 1
test eax, eax
jne 0x5908dc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x585940
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5908dc
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5908fd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x595290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3630
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
call fcn.00417716
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041792c
call fcn.00416d27
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x59537b
call fcn.0041505f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x595314
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417765
call fcn.00416d27
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417994
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x59537b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x5953a5
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x5953a5
cmp dword [0x62202c], 0
je 0x5953a5
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419e27
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417751
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x595470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b365b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.00417716
push 0x66
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0041792c
call fcn.00416d27
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x595553
call fcn.0041505f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5954ec
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.00417765
call fcn.00416d27
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00417994
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x595553
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x59557d
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x59557d
cmp dword [0x62202c], 0
je 0x59557d
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.0041a15c
mov ecx, esi
call fcn.00419e9d
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417751
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x597000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b38c4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [edi + 0x88], ebx
call fcn.00417716
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041792c
call fcn.00416d27
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x5970ec
call fcn.0041505f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x597085
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417765
call fcn.00416d27
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417994
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5970ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp word [esi], 1
jne 0x597120
mov eax, 0xffff
cmp word [esi + 2], ax
jne 0x597120
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x597120
cmp dword [ecx + 0x20], 0
je 0x597120
call fcn.00414a61
or dword [esi + 8], eax
push 0
push ebx
push esi
mov ecx, edi
call fcn.00419e27
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417751
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x599630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3bc6
mov eax, dword fs:[0]
push eax
sub esp, 0x50c
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
lea ecx, [ebp - 0x510]
call fcn.00555e80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x510]
mov eax, dword [edi + 0x100]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0xc4], 0x1faf
call fcn.005559d0
lea ecx, [ebp - 0x510]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00555b20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x518], eax
cmp esi, 1
je 0x59970d
mov eax, dword [0x621f18]
shr eax, 8
cmp al, 0xb
je 0x599880
lea esp, [esp]
mov ecx, dword [edi + 0x1d4]
xor edx, edx
mov esi, dword [ecx + 8]
test esi, esi
jle 0x5996fe
mov eax, dword [ecx + 4]
add eax, 0x20
cmp dword [eax], 0
je 0x5996eb
inc edx
add eax, 0x90
dec esi
jne 0x5996e5
test edx, edx
jle 0x5996fe
call fcn.0059e0f0
jmp 0x5996d0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x180]
jmp 0x599887
mov ecx, dword [0x621edc]
mov eax, 0x92492493
mov esi, dword [0x621ed8]
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x59975e
mov ecx, dword [edi + 0x1d4]
xor edx, edx
mov esi, dword [ecx + 8]
test esi, esi
jle 0x5996fe
mov eax, dword [ecx + 4]
add eax, 0x20
cmp dword [eax], 0
je 0x59974b
inc edx
add eax, 0x90
dec esi
jne 0x599745
test edx, edx
jle 0x5996fe
call fcn.0059e0f0
jmp 0x599730
or ebx, 0xffffffff
cmp esi, dword [0x621edc]
je 0x5997dd
lea esp, [esp]
call fcn.00416d27
mov ecx, dword [eax + 4]
call fcn.0040d5b7
mov dword [ebp - 4], 1
push dword [edi + 0x100]
fld1
push ecx
mov ecx, dword [edi + 0x1d4]
fstp dword [esp]
push dword [esi]
call fcn.0059de00
mov ebx, eax
test ebx, ebx
js 0x5997cb
push ebx
push esi
mov ecx, edi
call fcn.005998b0
lea ecx, [ebp - 0x511]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ab10
add esi, 0x1c
cmp esi, dword [0x621edc]
jne 0x599770
jmp 0x5997dd
lea ecx, [ebp - 0x511]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ab10
mov ecx, 0x621ed8
call fcn.00404190
mov ecx, dword [0x621ee0]
mov eax, 0x92492493
sub ecx, dword [0x621ed8]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x80
jae 0x59981c
push 0x80
mov ecx, 0x621ed8
call fcn.00404750
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x518]
cmp eax, 0x64
jae 0x59983b
mov ecx, 0x64
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jns 0x59984a
mov ecx, edi
call fcn.00599f90
xor eax, eax
jmp 0x59988c
mov ecx, dword [edi + 0x1d4]
push ebx
call fcn.0059e1b0
push 0
push eax
mov eax, dword [edi + 0x1c8]
push 0x186
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x1c4]
push 0
push 0
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, edi
call fcn.00599f90
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527e5c
mov esp, ebp
pop ebp
ret
Function at 0x59b310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3cf4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
call fcn.00417716
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041792c
call fcn.00416d27
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x59b3fb
call fcn.0041505f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x59b394
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417765
call fcn.00416d27
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417994
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x59b3fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x59b425
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x59b425
cmp dword [0x62202c], 0
je 0x59b425
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419e27
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417751
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8