joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fc0cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xf8]
xor ebp, ebp
cmp eax, ebp
jne 0x5fc0f4
pop esi
mov eax, 0x80004003
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0080262b
add esp, 0x70
ret
push ebx
push edi
mov dword [esp + 0x14], ebp
mov edi, dword [eax + 8]
xor eax, eax
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0xec]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], 0x24
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], ebp
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
add edi, edi
add edi, edi
call eax
test eax, eax
js 0x5fc19a
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0xf8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x5fc19a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebp
mov eax, dword [esi + 0xf0]
lea ebx, [esi + 0xf0]
cmp eax, ebp
je 0x5fc1b4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebx], ebp
mov eax, dword [esi + 0xf8]
mov ecx, dword [0x48b790]
mov edx, dword [0x48b794]
mov dword [esp + 0x54], eax
mov eax, dword [0x48b798]
mov dword [esp + 0x58], ecx
mov ecx, dword [0x48b79c]
push ebp
mov dword [esp + 0x64], eax
mov eax, dword [esi + 0xec]
mov dword [esp + 0x68], ecx
push ebx
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0x24
mov dword [esp + 0x50], 0x180e0
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebp
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
push eax
call edx
mov edi, eax
mov dword [esi + 0xfc], ebp
cmp edi, ebp
jl 0x5fc297
mov eax, dword [ebx]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], 0x14
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edi, eax
cmp edi, ebp
jl 0x5fc297
mov ecx, dword [esp + 0x70]
mov dword [esi + 0xfc], ecx
mov ecx, esi
call fcn.005fb6a0
mov ebx, dword [ebx]
mov edx, dword [ebx]
mov edi, eax
mov eax, dword [esi + 0xf8]
mov ecx, dword [eax + 4]
fild dword [eax + 4]
test ecx, ecx
jns 0x5fc268
fadd qword [0x409f88]
fmul qword [esi + 0x108]
mov ecx, dword [edx + 0x44]
fnstcw word [esp + 0x12]
movzx eax, word [esp + 0x12]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 0x18]
mov eax, dword [esp + 0x18]
push eax
push ebx
fldcw word [esp + 0x1a]
call ecx
mov ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.0080262b
add esp, 0x70
ret
Function at 0x5ff100
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, 3
cmp dword [esi + 0xfb0], eax
je 0x5ff217
mov eax, dword [esi + 0xf90]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
mov ecx, dword [esi + 0xf88]
mov bl, 1
push ecx
mov byte [esi + 0xf94], bl
call edi
mov edx, dword [esi + 0xf98]
push edx
mov byte [esi + 0xf8c], bl
call edi
mov eax, dword [esi + 0xfa8]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0xf9c], bl
cmp eax, 0xffffffff
je 0x5ff180
push 0x2710
push eax
call edi
cmp eax, 0x102
jne 0x5ff180
mov eax, dword [esi + 0xfa8]
push 0xdead
push eax
call ebp
mov eax, dword [esi + 0xfa8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x5ff194
push eax
call ebx
mov eax, dword [esi + 0xfac]
cmp eax, 0xffffffff
je 0x5ff1bc
push 0x2710
push eax
call edi
cmp eax, 0x102
jne 0x5ff1bc
mov ecx, dword [esi + 0xfac]
push 0xdead
push ecx
call ebp
mov eax, dword [esi + 0xfac]
cmp eax, 0xffffffff
je 0x5ff1ca
push eax
call ebx
mov eax, dword [esi + 0xf90]
cmp eax, 0xffffffff
je 0x5ff1d8
push eax
call ebx
mov eax, dword [esi + 0xf88]
cmp eax, 0xffffffff
je 0x5ff1e6
push eax
call ebx
mov eax, dword [esi + 0xf98]
cmp eax, 0xffffffff
je 0x5ff1f4
push eax
call ebx
pop edi
xor al, al
pop ebp
pop ebx
mov byte [esi + 0xf94], al
mov byte [esi + 0xf8c], al
mov byte [esi + 0xf9c], al
mov dword [esi + 0xfb0], 3
pop esi
ret
mov dword [esi + 0xfb0], eax
pop esi
ret
Function at 0x5ff6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0xa0]
push edi
call fcn.00533c70
fld qword [eax + 0x58]
fst qword [esi + 0x428]
mov ebp, 1
fsub qword [eax + 0x60]
xor edi, edi
fstp qword [esi + 0x420]
fld qword [esi + 0x428]
fadd qword [eax + 0x60]
mov eax, dword [esi + 0x38]
fstp qword [esi + 0x430]
mov ecx, dword [eax + 0x2008]
fld qword [eax + 0x2010]
lea ecx, [eax + ecx*8 + 8]
fld qword [esp + 0x14]
fadd st(1), st(0)
fxch st(1)
fsub qword [ecx]
fstp qword [eax + 0x2010]
fst qword [ecx]
mov edx, dword [eax]
add dword [eax + 0x2008], ebp
mov dword [esp + 0x14], edx
cmp dword [eax + 0x2008], edx
jne 0x5ff758
mov dword [eax + 0x2008], edi
fild dword [esp + 0x14]
fdivr qword [eax + 0x2010]
fstp qword [esi + 0x50]
fcom qword [esi + 0x40]
fnstsw ax
test ah, 0x41
jne 0x5ff774
fld qword [esi + 0x40]
jmp 0x5ff776
fld st(0)
fstp qword [esi + 0x40]
fcom qword [esi + 0x48]
fnstsw ax
test ah, 5
jp 0x5ff788
fstp st(0)
fld qword [esi + 0x48]
mov eax, dword [esi + 0x3c]
fstp qword [esi + 0x48]
fld qword [eax + 0x2010]
mov edx, dword [eax + 0x2008]
fld qword [esp + 0x1c]
lea ecx, [eax + edx*8 + 8]
fadd st(1), st(0)
fxch st(1)
fsub qword [ecx]
fstp qword [eax + 0x2010]
fst qword [ecx]
mov edx, dword [eax]
add dword [eax + 0x2008], ebp
mov dword [esp + 0x14], edx
cmp dword [eax + 0x2008], edx
jne 0x5ff7ca
mov dword [eax + 0x2008], edi
fild dword [esp + 0x14]
fdivr qword [eax + 0x2010]
fstp qword [esi + 0x68]
fcom qword [esi + 0x58]
fnstsw ax
test ah, 0x41
jne 0x5ff7e6
fld qword [esi + 0x58]
jmp 0x5ff7e8
fld st(0)
fstp qword [esi + 0x58]
fcom qword [esi + 0x60]
fnstsw ax
test ah, 5
jp 0x5ff7fa
fstp st(0)
fld qword [esi + 0x60]
push edi
fstp qword [esi + 0x60]
push 0x43a3a8
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esi + 0xa8], eax
cmp eax, edi
je 0x5ff8db
cmp dword [esi], edi
je 0x5ff8db
fld qword [esi + 0x430]
fcomp qword [esi + 0x50]
fnstsw ax
test ah, 5
jp 0x5ff845
cmp dword [esi + 8], ebp
je 0x5ff845
fld qword [esi + 0x88]
mov dword [esi + 8], ebp
lea eax, [esi + 0xfc]
jmp 0x5ff8a4
fld qword [esi + 0x420]
or ecx, 0xffffffff
fcomp qword [esi + 0x50]
fnstsw ax
test ah, 0x41
jne 0x5ff86e
cmp dword [esi + 8], ecx
je 0x5ff86e
fld qword [esi + 0x80]
mov dword [esi + 8], ecx
lea eax, [esi + 0x28c]
jmp 0x5ff8a4
fld qword [esi + 0x428]
fcomp qword [esi + 0x50]
fnstsw ax
test ah, 0x41
jne 0x5ff883
cmp dword [esi + 8], ebp
je 0x5ff898
fld qword [esi + 0x428]
fcomp qword [esi + 0x50]
fnstsw ax
test ah, 5
jp 0x5ff8d2
cmp dword [esi + 8], ecx
jne 0x5ff8d2
fld qword [esi + 0x78]
lea eax, [esi + 0x1c4]
mov dword [esi + 8], edi
push eax
fstp qword [esi + 0x90]
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov edx, dword [esi + 0xa8]
movzx edi, ax
push edi
push ebx
push 0x4d3
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
add dword [esi + 0x20], ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
ret 0x10
Function at 0x60b2a1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xfb0], 3
jne 0x60b33d
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0xf88], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0xf90], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xf98], eax
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x605340
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push eax
mov dword [esi + 0xfac], eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x60a370
push 0
push 0
call edi
push 0xf
push eax
mov dword [esi + 0xfa8], eax
call ebx
pop edi
mov dword [esi + 0xfb0], 0
pop ebx
pop esi
pop ecx
ret

Function at 0x60c5e0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4de], 0
je 0x60c65a
mov eax, dword [esi + 0x598]
test eax, eax
je 0x60c65a
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x59c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x60c646
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x60c633
mov eax, dword [esi + 0x59c]
push 0xdead
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x59c]
push ecx
call edi
mov dword [esi + 0x59c], 0
mov edx, dword [esi + 0x598]
push edx
call edi
mov dword [esi + 0x598], 0
pop edi
pop esi
ret

Function at 0x60df40
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x4de], 0
je 0x60df8f
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x598], eax
test eax, eax
je 0x60df8f
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x60df20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x59c], eax
test eax, eax
je 0x60df8f
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
pop ecx
ret
Function at 0x616860
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x2e98], 3
je 0x616942
mov eax, dword [esi + 0x2e80]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
mov ecx, dword [esi + 0x2e78]
mov bl, 1
push ecx
mov byte [esi + 0x2e84], bl
call edi
mov eax, dword [esi + 0x2e90]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esi + 0x2e7c], bl
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, 0xffffffff
je 0x6168cc
push 0x2710
push eax
call edi
cmp eax, 0x102
jne 0x6168cc
mov edx, dword [esi + 0x2e90]
push 0xdead
push edx
call ebx
mov eax, dword [esi + 0x2e94]
cmp eax, 0xffffffff
je 0x6168f4
push 0x2710
push eax
call edi
cmp eax, 0x102
jne 0x6168f4
mov eax, dword [esi + 0x2e94]
push 0xdead
push eax
call ebx
mov eax, dword [esi + 0x2e90]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x616908
push eax
call edi
mov eax, dword [esi + 0x2e94]
cmp eax, 0xffffffff
je 0x616916
push eax
call edi
mov eax, dword [esi + 0x2e80]
cmp eax, 0xffffffff
je 0x616924
push eax
call edi
mov eax, dword [esi + 0x2e78]
cmp eax, 0xffffffff
je 0x616932
push eax
call edi
xor al, al
pop edi
mov byte [esi + 0x2e84], al
mov byte [esi + 0x2e7c], al
pop ebx
mov dword [esi + 0x2e98], 3
pop esi
ret
Function at 0x61bfb1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x2e98], 3
jne 0x61c039
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x2e78], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2e80], eax
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x61bf90
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xf
push eax
mov dword [esi + 0x2e90], eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x61a470
push 0
push 0
call edi
push 2
push eax
mov dword [esi + 0x2e94], eax
call ebx
pop edi
mov dword [esi + 0x2e98], 0
pop ebx
pop esi
pop ecx
ret
Function at 0x624690
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x824]
mov eax, dword [esi + 0x820]
dec ecx
cmp eax, ecx
jge 0x6246ab
inc eax
mov dword [esi + 0x820], eax
mov edx, dword [esi + 0x820]
mov eax, dword [esi + edx*4 + 0x84c]
push 0
push 0
push 0
push eax
call fcn.0080c15f
mov eax, dword [esi + 0x818]
mov edx, dword [esi + 0x820]
mov ecx, 0x800
sub ecx, eax
push ecx
add eax, esi
push eax
mov eax, dword [esi + edx*4 + 0x84c]
push eax
call fcn.0080bfe4
add esp, 0x1c
pop esi
ret

Function at 0x624750
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x800]
cmp dword [edi], edi
jb 0x624825
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push 0x800
push esi
push ecx
call fcn.0080bfe4
add esp, 0xc
mov dword [esi + 0x818], eax
cmp eax, 0x800
jae 0x6247e3
mov edx, dword [esi + 0x824]
mov eax, dword [esi + 0x820]
dec edx
cmp eax, edx
jge 0x6247a3
inc eax
mov dword [esi + 0x820], eax
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push 0
push 0
push 0
push ecx
call fcn.0080c15f
mov eax, dword [esi + 0x818]
mov edx, 0x800
sub edx, eax
push edx
add eax, esi
push eax
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push ecx
call fcn.0080bfe4
add esp, 0x1c
cmp dword [esi + 0x83c], 0
je 0x62480d
test byte [esi + 0x14], 0x10
je 0x62480d
mov edx, dword [esi + 0x844]
mov eax, dword [esi + 0x840]
mov ecx, dword [esi + 0x848]
push edx
push eax
push esi
call ecx
and byte [esi + 0x14], 0xef
add dword [edi], 0xfffff800
add dword [esi + 0x804], 0xfffff800
cmp dword [edi], edi
jae 0x624762
mov ecx, dword [edi]
movzx eax, byte [ecx]
inc ecx
mov dword [edi], ecx
pop edi
pop esi
ret

Function at 0x625fe0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push 0x800
push esi
push ecx
call fcn.0080bfe4
add esp, 0xc
mov dword [esi + 0x818], eax
cmp eax, 0x800
jae 0x626013
mov ecx, esi
call fcn.00624690
cmp dword [esi + 0x83c], 0
je 0x62603d
test byte [esi + 0x14], 0x10
je 0x62603d
mov edx, dword [esi + 0x844]
mov eax, dword [esi + 0x840]
mov ecx, dword [esi + 0x848]
push edx
push eax
push esi
call ecx
and byte [esi + 0x14], 0xef
cmp dword [esi + 0x830], 0
mov dword [esi + 0x800], esi
je 0x626056
add dword [esi + 0x804], 0xfffff800
pop esi
ret
Function at 0x631b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x87bf8f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edi
push eax
call fcn.00631610
xor ebx, ebx
push ebx
lea ecx, [esi + 0x50]
mov dword [esp + 0x24], ebx
call fcn.005d9e50
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi], 0x440204
mov dword [esi + 0xc], 0x4401d4
mov dword [esi + 0x50], 0x4401c8
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], 0xa
lea eax, [esi + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x20], 3
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
cmp edi, ebx
je 0x631bdb
cmp dword [edi], ebx
jl 0x631c1d
cmp dword [esi + 0x98], 1
jge 0x631bf2
mov eax, esi
cmp edi, ebx
je 0x631c1f
mov dword [edi], 0x80070057
jmp 0x631c1f
mov byte [esi + 0xe8], bl
lea edi, [esi + 0xec]
mov ebp, 2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi], eax
add edi, 4
dec ebp
jne 0x631c03
lea ecx, [esi + 0x50]
call fcn.005da310
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x632d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87c0d3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00635620
mov eax, dword [esp + 0x40]
mov dword [esi], 0x440298
mov dword [esi + 0xc], 0x440234
mov dword [esp + 0x38], 0
mov dword [esi + 0x70], eax
test eax, eax
je 0x632dd2
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [esp + 0x44]
mov cl, byte [esp + 0x48]
mov dword [esi + 0x74], eax
xor eax, eax
mov byte [esi + 0x78], cl
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x70]
mov edx, dword [eax]
mov edx, dword [edx + 0x30]
lea ecx, [esp + 0xc]
push ecx
push eax
mov byte [esp + 0x40], 1
call edx
test eax, eax
js 0x632e39
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
push eax
push 0
mov dword [esi + 0x40], eax
push 0
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x44], ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0080262b
add esp, 0x34
ret 0xc
Function at 0x637b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0xb8]
fld qword [eax + 0xa0]
push esi
push ecx
sub esp, 0x20
fstp qword [esp + 0x18]
mov edx, dword [eax + 0x80]
fld qword [eax + 0x98]
movzx ecx, byte [eax + 0x7e]
fstp qword [esp + 0x10]
mov esi, dword [esp + 0x2c]
fld qword [eax + 0x90]
fstp qword [esp + 8]
fld qword [eax + 0x88]
fstp qword [esp]
push edx
movzx edx, byte [eax + 0x7d]
fld qword [eax + 0x70]
push ecx
movzx ecx, byte [eax + 0x7c]
push edx
mov edx, dword [eax + 0x78]
push ecx
push edx
mov ecx, dword [eax + 0x50]
sub esp, 0x20
mov edx, dword [eax + 0x4c]
fstp qword [esp + 0x18]
fld qword [eax + 0x68]
fstp qword [esp + 0x10]
fld qword [eax + 0x60]
fstp qword [esp + 8]
fld qword [eax + 0x58]
fstp qword [esp]
push ecx
movzx ecx, byte [eax + 0x4b]
fld qword [eax + 0x30]
push edx
movzx edx, byte [eax + 0x4a]
push ecx
movzx ecx, byte [eax + 0x49]
push edx
movzx edx, byte [eax + 0x48]
push ecx
mov ecx, dword [eax + 0x44]
push edx
mov edx, dword [eax + 0x40]
push ecx
mov ecx, dword [eax + 0x3c]
push edx
mov edx, dword [eax + 0x38]
push ecx
mov ecx, dword [eax + 0x14]
push edx
mov edx, dword [eax + 0x10]
sub esp, 0x20
fstp qword [esp + 0x18]
fld qword [eax + 0x28]
fstp qword [esp + 0x10]
fld qword [eax + 0x20]
fstp qword [esp + 8]
fld qword [eax + 0x18]
fstp qword [esp]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax]
push ecx
push edx
push 0x441268
push esi
call fcn.004aa600
add esp, 0xc0
mov eax, esi
pop esi
ret
Function at 0x642830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87ccd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x413454
lea ecx, [esp + 0x18]
call fcn.004a8f10
mov eax, dword [esp + 0x30]
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x28], esi
cmp eax, dword [edi + 0xc]
jb 0x642882
push 0x80070057
call fcn.004a8210
imul eax, eax, 0x34
add eax, dword [edi + 8]
lea ecx, [esp + 0x30]
mov eax, dword [eax + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push ecx
push eax
lea ecx, [edi + 0x58]
call fcn.005a8560
cmp eax, esi
je 0x6428aa
mov ebp, dword [eax + 4]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
lea ecx, [edi + 0x58]
call fcn.005a8560
test eax, eax
je 0x6428cd
mov esi, dword [eax + 4]
test ebp, ebp
jne 0x642912
test esi, esi
jne 0x6428e0
push 1
mov ecx, edi
call fcn.00642700
mov esi, eax
mov ebp, esi
test esi, esi
jne 0x642912
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64290e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x642961
mov edi, dword [esp + 0x34]
push ebp
mov ecx, edi
call fcn.004f7250
cmp dword [edi + 0xb8], 2
jne 0x642937
test esi, esi
je 0x642937
mov ecx, dword [esi + 0xb8]
mov dword [edi + 0xb8], ecx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x64295f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x642bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87d5a9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
cmp ebx, dword [edi + 0xc]
jb 0x642c06
push 0x80070057
call fcn.004a8210
mov eax, dword [edi + 8]
mov esi, ebx
imul esi, esi, 0x34
mov al, byte [eax + esi + 4]
push ebx
mov byte [esp + 0x34], al
call fcn.00642980
mov ebp, eax
cmp ebx, dword [edi + 0xc]
jb 0x642c2d
push 0x80070057
call fcn.004a8210
mov eax, dword [edi + 8]
mov eax, dword [eax + esi]
sub eax, 0x10
push eax
call fcn.004a9b50
mov esi, dword [esp + 0x30]
add eax, 0x10
add esp, 4
mov dword [esi], eax
cmp byte [esp + 0x30], 0
mov ebx, 1
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], ebx
jne 0x642cb7
push ebp
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.004a9b50
lea ecx, [esp + 0x24]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.006398f0
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.004aa540
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x642cb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x34], 0
jne 0x642d20
mov ecx, dword [esp + 0x30]
mov eax, dword [esi]
push ebp
push ecx
push ecx
sub eax, 0x10
mov dword [esp + 0x40], esp
mov edi, esp
push eax
call fcn.004a9b50
lea edx, [esp + 0x44]
add esp, 4
add eax, 0x10
push edx
mov dword [edi], eax
call fcn.00637390
add esp, 0x10
push eax
mov ecx, esi
mov dword [esp + 0x28], 2
call fcn.004aa540
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x642d20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc