joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0xe9
jne 0x10002aa8
mov eax, dword [ebx + 1]
push dword [ebp + 0xc]
add eax, 5
add eax, ebx
push eax
call fcn.10002a80
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10061110]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10060a48]
cmp eax, dword [ecx + 4]
jg 0x10002b67
push esi
mov esi, dword [0x10060a44]
push edi
lea edi, [esi + 0x1000]
cmp esi, edi
je 0x10002af3
nop word [eax + eax]
lea ecx, [esi + 0x1c]
call fcn.10002bb0
test eax, eax
je 0x10002af5
add esi, 0x20
cmp esi, edi
jne 0x10002ae0
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10002840
add edi, eax
cmp edi, 5
jl 0x10002af7
test edi, edi
jle 0x10002b21
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10002b10
mov ebx, dword [ebp + 8]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call dword [0x10060bc4]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
sub ecx, ebx
mov byte [ebx], 0xe9
push 5
sub ecx, 5
push ebx
mov dword [ebx + 1], ecx
call dword [0x10060bc4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10060a48
call fcn.10025da5
add esp, 4
cmp dword [0x10060a48], 0xffffffff
jne 0x10002ac8
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10060a48
mov dword [0x10060a44], eax
call fcn.10025d5b
add esp, 4
jmp 0x10002ac8
Function at 0x100039a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048cf1
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x1005f1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x110]
push eax
call fcn.10004c70
test al, al
je 0x10003b81
lea ecx, [ebp - 0x110]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100039f0
sub ecx, edx
sar ecx, 1
je 0x10003b81
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.10005330
test al, al
je 0x10003b81
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003a24
sub ecx, edx
sar ecx, 1
je 0x10003b81
lea eax, [ebp - 0x310]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._____________:_
push eax
call fcn.100023f0
push eax
mov ecx, esi
call fcn.100040b0
test al, al
je 0x10003b81
lea eax, [ebp - 0x310]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003a63
sub eax, edx
sar eax, 1
je 0x10003b81
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x328]
call fcn.10002ea0
lea eax, [ebp - 0x328]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x340]
mov ecx, esi
push eax
call fcn.100054a0
push eax
mov ecx, esi
call fcn.10003560
lea ecx, [ebp - 0x340]
call fcn.10001300
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 0xffffffff
call fcn.10003140
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x328]
call fcn.10002ea0
lea eax, [ebp - 0x328]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x340]
mov ecx, esi
push eax
call fcn.100054a0
push eax
lea ecx, [esi + 0x18]
call fcn.10003560
lea ecx, [ebp - 0x340]
call fcn.10001300
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 0xffffffff
call fcn.10003140
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x358]
call fcn.10002ea0
lea eax, [ebp - 0x358]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
call fcn.100054a0
push eax
lea ecx, [esi + 0x30]
call fcn.10003560
lea ecx, [ebp - 0x370]
call fcn.10001300
lea ecx, [ebp - 0x358]
call fcn.10003140
push 0
push 0
push 0x100042f0
call fcn.1002d75b
add esp, 0xc
mov al, 1
jmp 0x10003b83
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026240
mov esp, ebp
pop ebp
ret
Function at 0x10007170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049198
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1005f1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10060a6c], 0
jne 0x10007355
lea eax, [ebp - 0x28]
mov dword [0x10060a6c], 1
push eax
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._____________:_
call fcn.10002310
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x100071cd
mov eax, dword [eax]
push eax
call dword [0x10060b98]
mov edx, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x10007211
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10007207
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000736f
push edx
push ecx
call fcn.10025eec
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
je 0x10007355
lea eax, [ebp - 0x40]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._____________:_
push eax
call fcn.10001cf0
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 1
jb 0x10007248
mov eax, dword [eax]
push eax
push esi
call dword [0x10060b50]
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10001300
test esi, esi
je 0x10007355
push 0x100091b0
push esi
call fcn.10002a80
add esp, 8
mov dword [0x10060a5c], eax
call fcn.10010590
test al, al
je 0x10007355
mov ecx, 0x10060b10
call fcn.100103b0
test al, al
jne 0x100072b3
mov ecx, 0x10060b10
call fcn.1000d350
test al, al
jne 0x100072b3
mov ecx, 0x10060b10
call fcn.1000d400
test al, al
je 0x100072bd
mov dword [0x10060af4], 1
mov ecx, 0x1005f0c0
call fcn.100039a0
test al, al
je 0x10007355
cmp dword [0x10060ad8], 0
je 0x10007355
lea eax, [ebp - 0x58]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._____________:_
push eax
call fcn.10001ff0
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 2
jb 0x100072f5
mov eax, dword [eax]
push eax
push dword [0x10060ad8]
call dword [0x10060b50]
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10001300
test esi, esi
je 0x10007355
push esi
call fcn.1000a590
add esp, 4
push 0
push 0
push 0x1000d2c0
push 0xd
call dword [0x10060c5c]
push 0
push 0
push 0x10007380
mov dword [0x10060ae0], eax
call fcn.1002d75b
push 0
push 0
push 0x10006a30
call fcn.1002d75b
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026240
mov esp, ebp
pop ebp
ret
call fcn.1002ab19
int3

Function at 0x1003ea38
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003e8b7

Function at 0x100417ec
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100414ac
Function at 0x401d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51c7f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x14]
lea ebx, [esi + 0x1c]
lea ebp, [esi + 0x24]
mov dword [esi], 0x533dac
mov dword [edi], 0x533ba4
mov dword [ebx], fcn.00401cd0
mov dword [ebp], fcn.00401cd0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x18], 0x533a38
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x38]
mov dword [eax + esi + 0x14], ecx
mov edx, dword [esi + 0x18]
push 0x570ad8
mov dword [esp + 0x2c], 0xa
mov eax, dword [edx + 4]
lea ecx, [eax + esi + 0x18]
call fcn.0046cc00
lea ecx, [esi + 0x44]
mov byte [esp + 0x28], 9
call fcn.00509099
lea ecx, [esi + 0x40]
mov byte [esp + 0x28], 8
call fcn.00509099
lea ecx, [esi + 0x3c]
mov byte [esp + 0x28], 7
call fcn.00509099
lea ecx, [esi + 0x38]
mov byte [esp + 0x28], 6
call fcn.00509099
lea ecx, [esi + 0x34]
mov byte [esp + 0x28], 5
call fcn.00509099
lea ecx, [esi + 0x30]
mov byte [esp + 0x28], 4
call fcn.00509099
lea ecx, [esi + 0x2c]
mov byte [esp + 0x28], 3
call fcn.00509099
mov eax, esi
mov byte [esp + 0x28], 2
neg eax
sbb eax, eax
and eax, ebp
lea ecx, [eax + 0xc]
call fcn.00487310
mov eax, esi
mov byte [esp + 0x28], 1
neg eax
sbb eax, eax
and eax, ebx
lea ecx, [eax + 0xc]
call fcn.0048bba0
mov eax, esi
mov byte [esp + 0x28], 0
neg eax
sbb eax, eax
and eax, edi
lea ecx, [eax + 0xc]
call fcn.00478f00
mov dword [esp + 0x28], 0xffffffff
mov ecx, esi
call fcn.00433690
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x404af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51cba3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.0050346c
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0050346c
or eax, 0xffffffff
push 0x5706c0
mov dword [ebx], method.CPtrArray.virtual_0
push edi
mov dword [esi], 0x5340cc
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.DLL_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4082f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51d040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.0050c564
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0050bbfe
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0050c040
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.0050c08c
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0050c040
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.0050c08c
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0050c040
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.0050c08c
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0050c040
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.0050c08c
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0050c040
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.0050c08c
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.0050c040
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.0050c08c
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.0050c040
push ebp
push ebx
mov ecx, esi
call fcn.0050c08c
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.0050bbfe
lea ecx, [esp + 0x10]
call fcn.0050c5bb
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.0050c5bb
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4092f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51d170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], vtable.CBrush.0
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00404c40
test eax, eax
je 0x40934e
push 0xf
jmp 0x409350
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x409371
push 0x3fe33333
push 0x33333333
push eax
call fcn.00405b50
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.0050c564
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.0050c5bb
call fcn.00404c30
test eax, eax
je 0x4093c9
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
push 7
test eax, eax
jne 0x4093ed
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.004082f0
jmp 0x409405
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.004081d0
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.0050c5bb
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x409920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.00517a8a
mov edi, dword [esp + 0x14]
mov ebx, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.DLL_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40995b
xor ebx, ebx
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40995b
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x40996c
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
jne 0x40997c
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004098e0
add esp, 4
cmp ax, 0x10
je 0x409992
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push ebx
call fcn.0050e786
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x5706e0]
sub esp, 0x134
test eax, eax
jne 0x409af5
lea eax, [esp]
mov dword [0x5706e0], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409af5
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409ae8
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x409ae8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x409ae8
mov dword [0x5706dc], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x5706dc]
add esp, 0x134
ret
Function at 0x40c3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51d458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x1c]
push eax
call edi
push eax
call fcn.00505731
push eax
lea ecx, [esp + 0x30]
call fcn.0050c2bc
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x1c]
push edx
call edi
push eax
call fcn.00505731
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.0050c172
mov eax, dword [esi + 0x148]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x40c506
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x144]
call fcn.0050ba6a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, edi
push eax
push ecx
push edx
lea edi, [esi + 0x154]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.0050c564
test edi, edi
je 0x40c4b2
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x148]
push edi
push eax
call fcn.0050bbab
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x15c], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x148]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0x144]
sub ecx, edi
test edx, edx
je 0x40c527
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0050c32e
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x41d0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51f3e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x14]
lea ebx, [esi + 0x1c]
lea ebp, [esi + 0x24]
mov dword [esi], 0x5364dc
mov dword [edi], 0x5362d4
mov dword [ebx], fcn.00401cd0
mov dword [ebp], fcn.00401cd0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x18], 0x536168
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x50]
mov dword [eax + esi + 0x14], ecx
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x28], 6
test eax, eax
push 0x570ad8
je 0x41d154
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
lea ecx, [eax + esi + 0x18]
call fcn.0046cb40
jmp 0x41d163
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx + 4]
lea ecx, [edx + esi + 0x18]
call fcn.0046c980
lea ecx, [esi + 0x44]
mov byte [esp + 0x28], 5
call fcn.0050407b
lea ecx, [esi + 0x34]
mov byte [esp + 0x28], 4
call fcn.00509099
lea ecx, [esi + 0x30]
mov byte [esp + 0x28], 3
call fcn.00509099
mov eax, esi
mov byte [esp + 0x28], 2
neg eax
sbb eax, eax
and eax, ebp
lea ecx, [eax + 0xc]
call fcn.00487310
mov eax, esi
mov byte [esp + 0x28], 1
neg eax
sbb eax, eax
and eax, ebx
lea ecx, [eax + 0xc]
call fcn.0048bba0
mov eax, esi
mov byte [esp + 0x28], 0
neg eax
sbb eax, eax
and eax, edi
lea ecx, [eax + 0xc]
call fcn.00478f00
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00433690
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x422970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x520121
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x14]
lea ebx, [esi + 0x1c]
lea ebp, [esi + 0x24]
mov dword [esi], 0x536870
mov dword [edi], 0x536668
mov dword [ebx], fcn.00401cd0
mov dword [ebp], fcn.00401cd0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x18], 0x5364fc
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x28]
mov dword [eax + esi + 0x14], ecx
mov eax, dword [esi + 0x38]
mov dword [esp + 0x28], 4
test eax, eax
je 0x4229f2
mov edx, dword [esi + 0x18]
push 0x570ad8
mov eax, dword [edx + 4]
lea ecx, [eax + esi + 0x18]
call fcn.0046cc00
mov eax, dword [esi + 0x34]
cmp eax, 1
je 0x4229fe
test eax, eax
jne 0x422a12
mov ecx, dword [esi + 0x18]
push 0x570ad8
mov edx, dword [ecx + 4]
lea ecx, [edx + esi + 0x18]
call fcn.0046cdc0
lea ecx, [esi + 0x30]
mov byte [esp + 0x28], 3
call fcn.00509099
mov eax, esi
mov byte [esp + 0x28], 2
neg eax
sbb eax, eax
and eax, ebp
lea ecx, [eax + 0xc]
call fcn.00487310
mov eax, esi
mov byte [esp + 0x28], 1
neg eax
sbb eax, eax
and eax, ebx
lea ecx, [eax + 0xc]
call fcn.0048bba0
mov eax, esi
mov byte [esp + 0x28], 0
neg eax
sbb eax, eax
and eax, edi
lea ecx, [eax + 0xc]
call fcn.00478f00
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00433690
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x423a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x520288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call fcn.004a47a0
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.004a4863
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004a47dd
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x423ac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
and eax, 0xffff
push 0x565a2c
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x423ae4
pop edi
pop esi
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
jne 0x423af7
pop edi
pop esi
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x423b08
pop edi
pop esi
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [esp + 0x14]
mov ebx, eax
push 0x565514
mov eax, dword [ecx]
push eax
call fcn.004a68bf
mov esi, eax
add esp, 8
test esi, esi
jne 0x423b2f
pop edi
pop esi
pop ebx
ret
push esi
push edi
push 1
push ebx
call fcn.004a7774
add esp, 0x10
cmp eax, edi
push esi
je 0x423b4f
call fcn.004a6555
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
call fcn.004a6555
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret