joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59c238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 0x14]
call fcn.0057bab0
xor ebx, ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.0057bb67
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004a3db0
add esp, 0x14
test eax, eax
jne 0x4a3f89
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057bbe5
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 8]
push ebp
neg eax
sbb eax, eax
push edi
and eax, edx
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, ebx
je 0x4a3fd7
cmp ebp, ebx
je 0x4a3fd7
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4a3fec
push eax
call fcn.0045147b
add esp, 4
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4a4001
push eax
call fcn.0045147b
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4a400f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0057bbe5
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4a6780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
and edi, 0xffff
jne 0x4a6795
pop edi
xor eax, eax
pop esi
ret 0x10
call fcn.0058b5c7
mov esi, dword [eax + 0xc]
push 0xf1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4a67b3
pop edi
pop esi
ret 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a67c4
pop edi
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4a67d6
pop edi
pop esi
ret 0x10
xor eax, eax
push ebx
mov ax, word [esi + 6]
push ebp
shl eax, 2
push eax
call fcn.0057284c
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edi, edi
add esp, 4
mov dword [ebp], eax
mov dword [ebx], 0
cmp word [esi + 6], di
jbe 0x4a6836
mov ecx, esi
call fcn.004f4e20
cmp word [eax + edi*2], 0
je 0x4a682b
mov ecx, esi
call fcn.004f4e20
mov edx, dword [ebx]
xor ecx, ecx
mov cx, word [eax + edi*2]
mov eax, dword [ebp]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
xor ecx, ecx
inc edi
mov cx, word [esi + 6]
cmp edi, ecx
jl 0x4a6803
mov edx, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 2]
xor ecx, ecx
mov cx, word [esi + 4]
pop ebp
pop ebx
mov dword [edx], eax
pop edi
mov dword [edx + 4], ecx
mov eax, 1
pop esi
ret 0x10
Function at 0x4a6b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x59c550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x70]
push 0xe
push edi
mov dword [esp + 0x18], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4a6c9e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a6d11
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4a6d11
xor ebx, ebx
cmp word [ebp + 4], bx
jbe 0x4a6c7f
lea ecx, [esp + 0x14]
call fcn.004a3260
mov eax, ebx
xor edx, edx
and eax, 0xffff
mov dword [esp + 0x64], 0
lea ecx, [eax*8]
sub ecx, eax
mov dl, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
xor ecx, ecx
mov edi, edx
mov cl, byte [eax + 6]
mov esi, ecx
mov ecx, dword [esp + 0x78]
cmp ecx, esi
jne 0x4a6c19
cmp dword [esp + 0x7c], edi
je 0x4a6c25
test ecx, ecx
jne 0x4a6c63
mov ecx, dword [esp + 0x7c]
test ecx, ecx
jne 0x4a6c63
xor edx, edx
push 0
mov dx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.004a3870
test eax, eax
je 0x4a6c89
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push esi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004a6900
test eax, eax
je 0x4a6c89
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a3500
inc ebx
cmp bx, word [ebp + 4]
jb 0x4a6bd7
mov eax, 1
jmp 0x4a6d11
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a3500
xor eax, eax
jmp 0x4a6d11
lea ecx, [esp + 0x38]
call fcn.004a3260
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
push 0
push ebx
push ebp
push edi
push esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 1
call fcn.004a3870
test eax, eax
jne 0x4a6cdf
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a3500
xor eax, eax
jmp 0x4a6d11
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebp
lea eax, [esp + 0x44]
push edx
push eax
call fcn.004a6900
lea ecx, [esp + 0x38]
mov esi, eax
mov dword [esp + 0x64], 0xffffffff
call fcn.004a3500
mov eax, esi
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0x18
Function at 0x4a6e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59c588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x1c], ecx
je 0x4a6e3f
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4a6e46
xor eax, eax
jmp 0x4a6f95
mov edi, dword [esp + 0x6c]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test edi, edi
jne 0x4a6e65
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x4a6e65
push eax
call esi
mov dword [esp + 0x6c], eax
mov edi, eax
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x4a6eb6
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4a6eb6
test edi, edi
jle 0x4a6eb6
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, ebp
sub ecx, edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov ecx, dword [ebx + 4]
push ecx
call esi
xor edx, edx
cmp eax, edi
sete dl
xor ebx, ebx
mov dword [esp + 0x18], edx
test edi, edi
mov dword [esp + 0x14], ebx
jle 0x4a6f90
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4a6efa
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4a6efa
mov ecx, dword [esp + 0x10]
cmp dword [ecx], 0
je 0x4a6f74
mov edx, dword [esp + 0x64]
push 0
push ebx
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov esi, eax
test esi, esi
je 0x4a6e3f
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4a6f25
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
jmp 0x4a6f29
mov edi, dword [esp + 0x14]
push 1
push esi
lea ecx, [esp + 0x38]
call fcn.004a3270
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ebp
push edx
push eax
lea ecx, [esp + 0x3c]
push edi
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x70], 0
call fcn.004a6900
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.004a3500
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov edi, dword [esp + 0x6c]
inc ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jl 0x4a6ee1
mov eax, 1
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x18
Function at 0x4a77f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59c628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], vtable.CBitmap.0
mov ecx, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0x20], 0
call fcn.004a16f0
add esp, 8
test eax, eax
jne 0x4a786e
mov dword [esp + 8], vtable.CGdiObject.0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.0057c6e2
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18
push eax
lea ecx, [esp + 0xc]
call fcn.0057c68b
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.004a7430
mov esi, eax
mov dword [esp + 8], vtable.CGdiObject.0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 2
call fcn.0057c6e2
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18

Function at 0x4a7a60
Capabilities:
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x59c670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
push esi
mov esi, ecx
push 0x400
lea ecx, [esp + 0x10]
call fcn.00582a9a
push 0
push 0x1000
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x90], 0
call fcn.0057b603
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x34]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x88], 1
call fcn.004a8410
lea ecx, [esp + 0x34]
call fcn.0057b914
lea ecx, [esp + 0xc]
call fcn.00582bfc
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00582b4d
push esi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4a7b2f
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov edi, eax
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [0x60e42c]
push ebp
and ecx, 0xffff
push ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
lea ecx, [esp + 0x34]
call fcn.0057b767
lea ecx, [esp + 0xc]
call fcn.00582d46
push ebx
call fcn.0045147b
add esp, 4
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 0
call fcn.0057b6df
lea ecx, [esp + 0xc]
mov dword [esp + 0x80], 0xffffffff
call fcn.00582b5f
mov ecx, dword [esp + 0x78]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret 4

Function at 0x4a8e80
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x4a8eb0
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov ax, word [esp]
pop ecx
ret
Function at 0x4a97d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
mov ecx, dword [esp + 0x1c]
push edi
call fcn.0057723b
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, edi
push 6
shr eax, 4
inc eax
and eax, 0xffff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x4a980d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a9821
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4a9836
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4a9855
cmp esi, eax
jae 0x4a9859
xor ecx, ecx
dec edi
mov cx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4a9845
cmp esi, eax
jb 0x4a9863
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
xor ebx, ebx
mov bx, word [esi]
test ebx, ebx
jne 0x4a9876
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x4a9886
mov ebp, dword [eax + 4]
jmp 0x4a9888
xor ebp, ebp
push 0
push 0
push 0
lea edi, [esi + 2]
push 0
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
mov esi, eax
push esi
call fcn.00577757
push 0
push 0
push esi
push eax
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
push esi
call fcn.0057772f
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4af710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004ae830
mov ecx, eax
jmp fcn.004af7a0
Function at 0x4b0cc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0x59ce00
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp edx, 0xfffffffe
push esi
push edi
jne 0x4b0e32
mov ecx, 0x55
mov eax, 0xaa
mov word [esp + 0x18], cx
mov word [esp + 0x1c], cx
mov word [esp + 0x20], cx
mov word [esp + 0x24], cx
push ebx
lea ecx, [esp + 0xc]
mov word [esp + 0x1e], ax
mov word [esp + 0x22], ax
mov word [esp + 0x26], ax
mov word [esp + 0x2a], ax
call fcn.00412160
mov dword [esp + 0xc], vtable.CBitmap.0
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x10]
call fcn.0057c68b
lea ecx, [esp + 0x14]
call fcn.00412160
mov dword [esp + 0x14], vtable.CBrush.0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
mov byte [esp + 0x34], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x18]
call fcn.0057c68b
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0057bcfb
push 0xf
mov edi, eax
call fcn.004ae830
mov ecx, eax
call fcn.004af0c0
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x2c]
push 0x14
call fcn.004ae830
mov ecx, eax
call fcn.004af0c0
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
sub eax, edx
sub ecx, ebx
push 0xf00021
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
mov ecx, esi
call fcn.0057bcfb
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call fcn.0057c6e2
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 3
call fcn.0057c6e2
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x20
mov eax, dword [esp + 0x54]
cmp eax, 2
je 0x4b0e43
test eax, eax
je 0x4b0e43
xor esi, esi
jmp 0x4b0e48
mov esi, 1
test eax, eax
je 0x4b0e59
cmp eax, 1
je 0x4b0e59
mov eax, edx
mov edx, dword [esp + 0x50]
jmp 0x4b0e5d
mov eax, dword [esp + 0x50]
mov ecx, dword [ecx + 0x204]
mov edi, dword [ecx + 0x7c]
test edi, edi
je 0x4b0e70
mov ecx, edx
mov edx, eax
mov eax, ecx
xor ecx, ecx
test esi, esi
sete cl
push ecx
push eax
mov eax, dword [esp + 0x40]
push edx
lea edx, [esp + 0x48]
push edx
push eax
call fcn.00490a40
mov ecx, eax
call fcn.00490d10
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x20
Function at 0x4b44b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59cf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0057c497
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
add eax, 0x10c
mov dword [esp + 0x38], 0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00490030
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
push ecx
push 1
push 0x5a80a8
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + 8]
add eax, 3
cmp eax, 0x12
jge 0x4b342d
mov eax, 0x12
lea ecx, [esp + 0xc]
mov dword [esi + 0x18], eax
call fcn.00490090
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0057c509
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
jmp 0x4b33c0

Function at 0x4ba360
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov dword [esi], 0
push eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x4ba2e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xc], eax
je 0x4ba3ac
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret

Function at 0x4ba3b0
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xc], ebx
je 0x4ba436
mov eax, dword [esi + 0x14]
push ebp
push edi
push eax
mov dword [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push edx
call edi
test eax, eax
je 0x4ba423
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x10], 0x103
jne 0x4ba423
inc ebx
cmp ebx, 0xa
ja 0x4ba417
mov eax, dword [esi + 0xc]
push 0x64
push eax
call ebp
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
call edi
test eax, eax
jne 0x4ba3ee
jmp 0x4ba423
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0xc], 0
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x4bb900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59d352
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004f8680
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 0x20], eax
push str.WM_SKINFRAMEWORK_UPDATESTATE
mov dword [esp + 0x20], ebx
mov dword [esi], 0x5bbba8
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 8], ebx
call edi
push str.WM_SKINFRAMEWORK_QUERYSTATE
mov dword [esi + 0x4c], eax
call edi
mov dword [esi + 0x50], eax
mov eax, dword [0x60ed04]
cmp eax, ebx
jne 0x4bb996
push str.WM_GETFRAMEHOOK
call edi
mov dword [0x60ed04], eax
push 0x40
mov dword [esi + 0x48], ebx
call fcn.0057284c
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x4bb9b9
mov ecx, eax
call fcn.004c0a40
jmp 0x4bb9bb
xor eax, eax
push 0x14
push 0xf060
mov ecx, esi
mov byte [esp + 0x24], bl
mov dword [esi + 0x2c], eax
call fcn.004bb6d0
push 9
push 0xf030
mov ecx, esi
call fcn.004bb6d0
push 9
push 0xf120
mov ecx, esi
call fcn.004bb6d0
push 8
push 0xf020
mov ecx, esi
call fcn.004bb6d0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4c0a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d8b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00576b13
xor edi, edi
mov dword [esi + 0x20], 0x5b7e9c
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov ecx, esi
mov byte [esp + 0x14], 1
mov dword [esi], 0x5bc018
call fcn.00590b47
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4c7b56
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59daee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
xor eax, eax
mov dword [esi + 8], 0x5bc778
mov dword [esp + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], 0x5bc76c
push 1
mov byte [esp + 0x14], 2
mov dword [esi], 0x5bc768
mov dword [esi + 0x1c], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x40], eax
call fcn.004c8240
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4c8ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59dbd7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x5f2384]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov esi, dword [esp + 0x34]
mov ebx, 1
mov dword [esp + 0x28], ebx
fld qword [esi]
call fcn.00451024
test eax, eax
jne 0x4c8b20
lea ecx, [esp + 0x34]
push str._H:_M:_S
push ecx
mov ecx, esi
call fcn.0044848f
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call fcn.005773e9
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x4c8ba1
mov edx, dword [esi]
mov eax, dword [esi + 4]
fld qword [esi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.00451024
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
fcomp qword [esp + 0x18]
fnstsw ax
test ah, 0x40
je 0x4c8b79
lea ecx, [esp + 0x34]
push str._Y__d__m
push ecx
mov ecx, esi
call fcn.0044848f
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.005773e9
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x4c8ba1
lea edx, [esp + 0x34]
push str._Y__d__mT_H:_M:_S
push edx
mov ecx, esi
call fcn.0044848f
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.005773e9
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
call fcn.005772b0
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00577025
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.005772b0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret