joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529780
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5a2280
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
je 0x5297bd
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5297bd
call fcn.005767db
test ah, 8
jne 0x5297bd
mov eax, dword [esi + 0x58]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x5297e0
mov edx, dword [esi]
push 0
push 0
push 0x301
mov ecx, esi
call dword [edx + 0xa0]
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push edi
test eax, eax
je 0x52989a
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x3c]
push ebx
push ebp
push 0xb0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [esi + 0x68]
mov ecx, esi
push edi
call fcn.00574177
mov eax, dword [esi + 0x6c]
mov edx, dword [edi]
lea ecx, [esi + 0x6c]
mov eax, dword [eax - 8]
mov edx, dword [edx - 8]
cmp edx, eax
jle 0x52984a
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.0056f9b7
push eax
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.005773e9
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
jmp 0x529876
jge 0x52987b
sub eax, edx
push eax
push edx
lea edx, [esp + 0x20]
push edx
call fcn.0056f8a5
push eax
mov ecx, edi
mov dword [esp + 0x28], 1
call fcn.005776c8
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.005772b0
push 1
push ebp
mov ecx, esi
call fcn.0052a880
push 1
push ebx
mov ecx, esi
call fcn.0052a880
mov ebp, dword [ebp]
mov eax, dword [ebx]
cmp eax, ebp
jge 0x52989a
mov dword [ebx], ebp
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.0052a7b0
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x529919
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x529913
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x10]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x10]
call fcn.005772b0
mov ecx, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x52cb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a250f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push ecx
lea eax, [esp + 0x30]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x28], ebx
call fcn.00577025
push ecx
mov byte [esp + 0x28], 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Images
call fcn.0057731e
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
push ecx
mov ecx, esi
call fcn.0052d4c0
mov edx, dword [esp + 8]
mov byte [esp + 0x20], 3
mov eax, dword [edx - 8]
test eax, eax
je 0x52cbb2
lea eax, [esp + 8]
lea ecx, [esp + 0x2c]
push eax
call fcn.005773e9
push 0x5f
push 0x2e
lea ecx, [esp + 0x34]
call fcn.0056f6e2
push 0x5f
push 0x5c
lea ecx, [esp + 0x34]
call fcn.0056f6e2
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00577025
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call fcn.005772b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.005772b0
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 8

Function at 0x52cd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a2558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
lea eax, [edi + 0x30]
push eax
call fcn.004b99d0
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x52cd70
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b99f0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x52cd9f
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b99f0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
lea ecx, [esp + 0x10]
lea ebx, [edi + 0x68]
push ecx
push esi
mov ecx, ebx
mov dword [esp + 0x18], 0
call fcn.0057257c
test eax, eax
jne 0x52ce0a
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0057731e
mov ecx, edi
call fcn.0052cc10
test eax, eax
mov dword [esp + 0x10], eax
jne 0x52cdfe
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b99f0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
push esi
mov ecx, ebx
mov edi, eax
call fcn.005725c0
mov dword [eax], edi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b99f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4
Function at 0x52cf30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5a2598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x52cf61
cmp dword [esi + 0x2c], edi
je 0x52cf61
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ebp
call fcn.0057731e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
cmp dword [eax - 8], edi
jne 0x52cf8a
push str.OFFICE2007BLUE_INI
lea ecx, [esp + 0x14]
call fcn.00577439
push 0x5f
push 0x2e
lea ecx, [esp + 0x18]
call fcn.0056f6e2
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
mov dword [esi + 0x2c], ecx
mov ecx, esi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
call fcn.0052ca90
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x20]
push str.TEXTFILE
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x52cfda
test ebp, ebp
jne 0x52cfda
push ebx
mov ecx, esi
call fcn.0052ce80
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x52d011
mov ecx, dword [esi + 0x20]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x52d011
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esi + 0x20]
push edi
push edx
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esi + 0x24]
mov ebx, 1
add eax, ecx
mov dword [esi + 0x28], eax
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x52d028
push 0
push 0
push 0
push 0x294f
call fcn.0053c0d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005772b0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x52d130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a25f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov dword [esp + 0x30], 1
call fcn.00577025
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x34], 2
call fcn.00577025
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov byte [esp + 0x34], 1
call fcn.0052d560
mov eax, dword [esp + 8]
xor ebx, ebx
cmp dword [eax - 8], ebx
jne 0x52d1da
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.005772b0
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.005772b0
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.005772b0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x24
ret 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
push edx
push ecx
push str._i__i__i
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.0056ccc9
mov eax, dword [esp + 0x28]
xor edx, edx
mov dh, byte [esp + 0x20]
and eax, 0xff
mov dl, byte [esp + 0x24]
add esp, 0x14
shl edx, 8
or edx, eax
lea ecx, [esp + 8]
mov esi, edx
mov byte [esp + 0x28], 1
call fcn.005772b0
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.005772b0
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.005772b0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0xc
Function at 0x532c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a2ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push 1
lea ecx, [esp + 8]
call fcn.00530960
mov ecx, dword [esp + 0x48]
lea eax, [esp + 4]
push 0
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov edx, esp
mov dword [esp + 0x4c], 0
mov dword [edx], eax
mov eax, dword [esp + 0x5c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.00532e00
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.005302e0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0x14

Function at 0x534cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5a3238
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [ebp + 8], 0
call fcn.0057c6e2
mov esi, dword [esp + 0x48]
test esi, esi
je 0x534d67
push edi
mov edi, dword [esp + 0x48]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
pop edi
je 0x534d67
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x534d67
cmp ebx, 0xa
jb 0x534d67
push 0
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.00582ae6
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
mov dword [esp + 0x40], 0
call fcn.00534d80
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.00582b5f
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8

Function at 0x53fa60
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x100]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x53fafa
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 0x34]
shr eax, 8
cmp al, 2
jne 0x53fafa
test edi, edi
je 0x53fafa
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ebx
lea ecx, [esi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x53faa6
mov eax, dword [edi + 0x2c]
jmp 0x53facb
mov edx, dword [esi + 0x34]
mov ecx, ebx
mov eax, dword [edx + 0x58]
test eax, eax
jne 0x53fab4
mov ecx, ebp
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x53fac9
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x53facb
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0053f9e0
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x53faf1
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x53fafa
push 0
mov ecx, esi
call fcn.0053f8d0
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x5463f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a46b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
mov dword [esp + 0xc], ebx
call fcn.005302a0
mov ebp, dword [esp + 0x28]
lea eax, [ebx + 0x20]
xor esi, esi
push eax
mov dword [esp + 0x1c], esi
mov dword [ebx], 0x5c6f0c
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
cmp ebp, esi
jle 0x54648b
lea esi, [ebp*8]
push edi
push esi
call fcn.0057284c
mov ecx, esi
mov esi, dword [esp + 0x28]
mov edx, ecx
mov edi, eax
shr ecx, 2
mov dword [ebx + 0x14], eax
push ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0057284c
mov esi, dword [esp + 0x30]
mov ecx, ebp
mov dword [ebx + 0x1c], eax
mov edi, eax
mov eax, ecx
add esp, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov ecx, ebx
call fcn.005464b0
mov ecx, dword [esp + 0x10]
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x5549e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a5ccf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5f2384]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x28], 1
call fcn.0056fdd7
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.00577025
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005772b0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x55a760
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0
call fcn.0055a5b0
mov ecx, dword [eax + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ecx, ecx
je 0x55a7d6
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
cmp edi, ebx
je 0x55a7b2
call fcn.0055a5b0
mov esi, eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x55a7a6
mov eax, dword [esi]
push str.GdipCreateFromHDC2
push eax
call ebp
mov dword [esi + 0x24], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
call dword [esi + 0x24]
jmp 0x55a7d6
call fcn.0055a5b0
mov esi, eax
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x55a7cd
mov edx, dword [esi]
push str.GdipCreateFromHDC
push edx
call ebp
mov dword [esi + 0x28], eax
lea eax, [esp + 0x10]
push eax
push edi
call dword [esi + 0x28]
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x55a7e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
call fcn.0055a5b0
mov esi, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x55a801
mov ecx, dword [esi]
push str.GdipSetPageUnit
push ecx
call ebp
mov dword [esi + 0x18], eax
push 2
push edi
call dword [esi + 0x18]
mov edi, dword [esp + 0x10]
call fcn.0055a5b0
mov esi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x55a826
mov edx, dword [esi]
push str.GdipSetSmoothingMode
push edx
call ebp
mov dword [esi + 0x1c], eax
push 2
push edi
call dword [esi + 0x1c]
mov edi, dword [esp + 0x10]
call fcn.0055a5b0
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x55a84b
mov eax, dword [esi]
push str.GdipSetPixelOffsetMode
push eax
call ebp
mov dword [esi + 0x14], eax
push 4
push edi
call dword [esi + 0x14]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x56c370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00451240
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x56c43b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x56c43b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x56c3ee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x56c3f9
or bh, 8
and edi, 0x8000000
je 0x56c414
mov eax, dword [0x610adc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x56c43b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56c810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x56c83b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x56c85f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x56c87a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x572a5a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x572a7c
cmp dword [edi + 0x3c], 0
jne 0x572a7c
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0058b5c7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00572aa9
pop edi
pop esi
pop ebx
ret 8

Function at 0x572af7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0058b5c7
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x572b28
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00572b3b
pop edi
pop esi
pop ebx
ret 8

Function at 0x574177
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5741af
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00577757
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0057772f
jmp 0x5741bb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5741bf
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x60d8e8
mov ecx, edi
call fcn.00577439
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x574212
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x574225
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00577757
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057772f
jmp 0x574225
mov ecx, esi
call fcn.005766ba
test eax, eax
je 0x574225
push edi
mov ecx, eax
call fcn.00574177
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x575e47
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x575e89
call fcn.0058b5c7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x575e89
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x575e80
xor eax, eax
jmp 0x575e91
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00575e97
pop edi
pop esi
pop ebx
ret 4