joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8100
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x553968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00490ba0
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], 0
dec edi
call fcn.0053e3e0
mov edx, dword [esi]
add esp, 4
mov ecx, esi
mov ebx, eax
call dword [edx + 0x130]
mov ecx, dword [ebx]
push 0xffffffffffffffff
push 0x5e
lea eax, [ecx + eax*2 + 2]
mov ecx, dword [esp + 0x3c]
sub esp, 0x10
mov edx, esp
mov dword [edx], edi
mov dword [edx + 4], ecx
add eax, edi
mov dword [edx + 8], eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x24]
mov dword [edx + 0xc], eax
call fcn.00490bd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00490bc0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x14

Function at 0x4cb7fa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x553b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.00482270
xor eax, eax
mov dword [esi], 0x5781c0
mov ecx, vtable.CBrush.0
mov dword [esp + 0x10], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], ecx
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], ecx
mov dword [esi + 0x94], eax
mov dword [esi + 0x90], ecx
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xac], eax
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xb8], eax
mov dword [esi + 0xb4], vtable.CPen.0
mov dword [esi + 0xcc], eax
mov dword [esi + 0xc8], ecx
mov ecx, 1
mov edx, 4
mov dword [esi + 0xd0], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], ecx
mov ecx, 0x5a7940
mov byte [esp + 0x10], 0xa
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0xc
mov dword [esi + 0x40], 5
mov dword [esi + 0x44], edx
mov dword [esi + 0x48], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], edx
call fcn.00480450
mov ecx, esi
call fcn.004c8660
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4e6390
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], esp
call fcn.00491b50
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00528757
mov esi, dword [0x5a7a24]
mov edi, dword [0x5a7a28]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.005280aa
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x34]
call fcn.00528623
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], vtable.CBitmap.0
mov eax, dword [ebp - 0x54]
push edi
push esi
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00528920
cmp eax, ebx
jne 0x4e6433
push 0xffffffffffffffff
push ebx
push 0x3e8a
call fcn.0052c1b3
jmp 0x4e64d3
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
push ecx
push edx
call fcn.005289a9
mov edx, dword [ebp - 0x30]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov eax, dword [0x5a79bc]
push eax
lea ecx, [ebp - 0x44]
push ecx
push edx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.user32.dll_FillRect]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004e6310
test ebx, ebx
je 0x4e647b
mov ebx, dword [ebx + 4]
mov edx, dword [ebp - 0x30]
push ebx
push edx
call fcn.005289a9
call fcn.00525e10
test eax, eax
je 0x4e6497
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x4e6499
xor eax, eax
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
jne 0x4e64b6
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.0052c1b3
jmp 0x4e64d3
call dword [sym.imp.user32.dll_EmptyClipboard]
test eax, eax
jne 0x4e6520
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.0052c1b3
call dword [sym.imp.user32.dll_CloseClipboard]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], vtable.CGdiObject.0
call fcn.00528977
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.005286a1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.005287b2
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00491b60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.0052894d
push eax
push 2
call dword [sym.imp.user32.dll_SetClipboardData]
test eax, eax
jne 0x4e6542
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.0052c1b3
call dword [sym.imp.user32.dll_CloseClipboard]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], vtable.CGdiObject.0
call fcn.00528977
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.005286a1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.005287b2
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00491b60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2890
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x555498
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0xc
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
call dword [sym.imp.user32.dll_GetKeyboardLayout]
mov esi, dword [esp + 0x58]
push eax
push 0
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyExA]
shl eax, 0x10
or eax, 1
cmp esi, 0x21
jb 0x4f28e6
cmp esi, 0x2f
ja 0x4f28e6
or eax, 0x1000000
push 0x32
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.user32.dll_GetKeyNameTextA]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00401bc0
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0
call fcn.00495200
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
xor esi, esi
test eax, eax
jle 0x4f29ba
mov edi, dword [sym.imp.user32.dll_IsCharLowerA]
lea ebx, [ebx]
test esi, esi
jl 0x4f2a49
cmp esi, eax
jg 0x4f2a49
mov bl, byte [esi + ecx]
mov byte [esp + 0x58], bl
mov eax, dword [esp + 0x58]
push eax
call edi
test eax, eax
jne 0x4f2960
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
inc esi
cmp esi, eax
jl 0x4f2930
jmp 0x4f29ba
movsx ecx, bl
push ecx
call fcn.00474347
mov bl, al
mov eax, dword [esp + 0x10]
mov edi, dword [eax - 0xc]
add esp, 4
cmp esi, edi
jge 0x4f2a49
cmp dword [eax - 4], 1
jle 0x4f2993
mov edx, edi
push edx
lea ecx, [esp + 0x10]
call fcn.00401270
mov eax, dword [esp + 0xc]
test edi, edi
mov byte [esi + eax], bl
jl 0x4f2a49
mov eax, dword [esp + 0xc]
cmp edi, dword [eax - 8]
jg 0x4f2a49
mov dword [eax - 0xc], edi
mov eax, dword [esp + 0xc]
mov byte [edi + eax], 0
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
mov edi, dword [esp + 0x54]
push eax
push ecx
mov ecx, edi
call fcn.00401840
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x4f2a0f
mov eax, dword [edi]
mov ebx, dword [eax - 0xc]
mov edx, dword [eax - 4]
mov eax, dword [eax - 8]
lea esi, [ebx + 1]
mov ecx, 1
sub ecx, edx
sub eax, esi
or eax, ecx
jge 0x4f29f5
push esi
mov ecx, edi
call fcn.00401470
test esi, esi
mov eax, dword [edi]
mov byte [eax + ebx], 0x2b
jl 0x4f2a49
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x4f2a49
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
mov byte [esi + ecx], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x4c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f2a35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0xc
push 0x80070057
call fcn.00401120
int3
Function at 0x4f3400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55555b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x57e590
lea edi, [esi + 0x3c]
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x30], ecx
mov ecx, 1
push eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x38], ecx
push 0x559e91
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], 0xffffffff
call fcn.004017a0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4fcdd6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5558f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004b0b70
mov edi, dword [esp + 0x1c]
test edi, edi
mov dword [esp + 0x14], 0
mov dword [esi], 0x57fce0
lea ecx, [esi + 0x10]
jne 0x4fce00
xor eax, eax
jmp 0x4fce10
mov eax, edi
push ebp
lea ebp, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4fce06
sub eax, ebp
pop ebp
push eax
push edi
call fcn.004017a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x74], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x7c], eax
mov word [esi + 0x68], 0xffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x84], edx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c

Function at 0x5009a6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x555bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004b0b70
mov edi, dword [esp + 0x28]
test edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esi], 0x5803e8
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ecx
jne 0x5009dc
mov edi, 0x559e91
test edi, edi
lea ecx, [esi + 0x10]
jne 0x5009e7
xor eax, eax
jmp 0x5009fa
mov eax, edi
push ebp
lea ebp, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5009f0
sub eax, ebp
pop ebp
push eax
push edi
call fcn.004017a0
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x70], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], 0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x507280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5560db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push esi
push edi
push eax
mov esi, ecx
push 0x3f05
mov dword [esp + 0x10], esi
call fcn.0051ff14
lea edi, [esi + 0x70]
mov ecx, edi
mov dword [esp + 0x2c], 0
mov dword [esi], method.CDialog.virtual_0
call fcn.00521511
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0xc0]
mov ecx, edi
mov byte [esp + 0x2c], 1
call fcn.00521511
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x110]
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.00521511
mov dword [edi], vtable.CStatic.0
push esi
lea ecx, [esi + 0x160]
mov byte [esp + 0x30], 3
call fcn.00505d00
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x228], ecx
lea edi, [esi + 0x258]
mov ecx, edi
mov byte [esp + 0x2c], 4
call fcn.0053f780
mov dword [edi], 0x580f20
lea ecx, [esi + 0xc60]
mov byte [esp + 0x2c], 5
call fcn.004ffac0
mov eax, dword [esi + 0x228]
mov ecx, dword [eax + 4]
lea edx, [esp + 0xc]
push edx
push 0x18
push ecx
call dword [sym.imp.gdi32.dll_GetObjectA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x22c], eax
mov eax, dword [esp + 0x3c]
cmp eax, 0xffffffff
mov dword [esi + 0x230], ecx
jne 0x507379
movzx eax, word [esp + 0x1e]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x234], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x518710
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x557401
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.gdi32.dll_GetStockObject]
xor ebp, ebp
push ebp
mov esi, ecx
call edi
push eax
call fcn.00528912
push 4
mov ebx, eax
call edi
push eax
call fcn.00528912
mov edi, eax
mov eax, vtable.CRgn.0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc0], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi + 0x3c]
add ecx, 2
push ecx
dec edx
push edx
push eax
mov ecx, esi
mov byte [esp + 0xd0], 2
call fcn.00518320
mov ebp, dword [sym.imp.gdi32.dll_CreatePolygonRgn]
push 1
push 6
lea ecx, [esp + 0x30]
push ecx
call ebp
push eax
lea ecx, [esp + 0x1c]
call fcn.00528920
test ebx, ebx
jne 0x5187bb
xor eax, eax
jmp 0x5187be
mov eax, dword [ebx + 4]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0xc8]
push 2
push 2
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.gdi32.dll_FrameRgn]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x3c]
add edx, 2
push edx
push eax
push ecx
mov ecx, esi
call fcn.00518320
push 1
push 6
lea edx, [esp + 0x60]
push edx
call ebp
push eax
lea ecx, [esp + 0x24]
call fcn.00528920
test edi, edi
jne 0x518811
xor eax, eax
jmp 0x518814
mov eax, dword [edi + 4]
mov ecx, dword [ebx + 4]
push 1
push 1
push eax
mov eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.gdi32.dll_FrameRgn]
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x88]
push edx
mov edx, dword [esi + 0x3c]
dec eax
push eax
push ecx
push edx
mov ecx, esi
call fcn.00518320
push 1
push 6
lea eax, [esp + 0x90]
push eax
call ebp
push eax
lea ecx, [esp + 0x14]
call fcn.00528920
test edi, edi
je 0x518863
mov edi, dword [edi + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 4]
push 1
push 1
push edi
push ecx
push edx
call dword [sym.imp.gdi32.dll_FrameRgn]
mov esi, vtable.CGdiObject.0
lea ecx, [esp + 0x20]
mov byte [esp + 0xc0], 1
mov dword [esp + 0x20], esi
call fcn.00528977
lea ecx, [esp + 0x18]
mov byte [esp + 0xc0], 0
mov dword [esp + 0x18], esi
call fcn.00528977
lea ecx, [esp + 0x10]
mov dword [esp + 0xc0], 0xffffffff
mov dword [esp + 0x10], esi
call fcn.00528977
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb4
ret 4
Function at 0x519b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.user32.dll_GetClientRect]
push 0xfffffffffffffffb
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.user32.dll_InflateRect]
mov esi, dword [esp + 0x3c]
cmp esi, dword [esp + 0x44]
jg 0x519c74
mov ebx, dword [sym.imp.user32.dll_FillRect]
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.user32.dll_GetClientRect]
push 0xfffffffffffffffb
push 0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.user32.dll_InflateRect]
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
mov edx, ecx
jg 0x519bde
mov edx, esi
mov eax, dword [esp + 0x24]
cmp edx, eax
jge 0x519bf0
cmp ecx, esi
jle 0x519bf4
mov dword [esp + 0xc], ecx
jmp 0x519bf4
mov dword [esp + 0xc], eax
fld qword [edi + 0x60]
sub esp, 0x18
fstp qword [esp + 0x10]
sub eax, ecx
fild dword [esp + 0x3c]
fisub dword [esp + 0x24]
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fdivp st(1)
fstp qword [esp + 8]
fld qword [edi + 0x68]
fstp qword [esp]
call fcn.00490770
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
call fcn.00528b08
mov eax, dword [edi + 0x78]
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x2c]
mov dword [esp + 0x30], esi
push edx
inc esi
push ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], esi
call ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00528977
cmp esi, dword [esp + 0x44]
jle 0x519bb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x51c259
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x51c275
call fcn.0046a1cb
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x51c2e7
push esi
push 0x8c
push 1
call fcn.0046707f
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x51c2cd
push esi
call fcn.0046ad80
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x51c1c7
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x51c2c5
push edi
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x51c2e4
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004660a2
test ebx, ebx
pop ecx
je 0x51c2df
push ebx
call fcn.0046a1dd
pop ecx
or eax, 0xffffffff
jmp 0x51c2e6
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x51c753
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54f733
call fcn.00468c5c
sub esp, 0x9c
mov eax, dword [0x5a2f48]
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], esi
call fcn.0051ff14
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFileDialog.0
call fcn.00401520
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
jne 0x51c7e4
mov edi, 0x94
push edi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.00468ca0
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], edi
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x51c7dd
cmp dword [ebp - 0xa0], 5
mov dword [ebp + 0x20], 0x58
jae 0x51c7e4
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.004661ba
cmp eax, ebx
pop ecx
mov dword [esi + 0x70], eax
jne 0x51c7f9
call fcn.0051c4d4
push dword [ebp + 0x20]
push ebx
push eax
call fcn.00468ca0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x74], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x1c0], ebx
lea ecx, [esi + 0x7c]
mov byte [ecx], bl
lea edi, [esi + 0xbc]
mov byte [edi], bl
mov dword [eax], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0x104
mov eax, dword [esi + 0x70]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x70]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x70]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x51c876
mov eax, dword [esi + 0x70]
and byte [eax + 0x36], 0x7f
call fcn.0053abfb
cmp dword [ebp + 0x10], ebx
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x44], 0x51cc8b
je 0x51c8a2
push 0x104
push dword [ebp + 0x10]
push edi
call dword [sym.imp.kernel32.dll_lstrcpyn]
cmp dword [ebp + 0x18], ebx
je 0x51c8d8
push dword [ebp + 0x18]
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.00401ae0
push ebx
mov ecx, edi
call fcn.00401540
jmp 0x51c8c1
mov byte [eax], bl
inc eax
push 0x7c
push eax
call fcn.00466cbf
cmp eax, ebx
pop ecx
pop ecx
jne 0x51c8be
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00464eaf
leave
ret 0x1c
Function at 0x5202be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x5202f5
call fcn.0053abfb
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x520306
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x52033f
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x520324
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x52032c
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x52033d
test ax, ax
jne 0x52033d
test si, si
je 0x52033f
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x52034e
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret