joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
push edi
push edi
push edi
push 1
push edi
lea ecx, [ebp - 0x30]
call fcn.006046cb
mov eax, dword [ebp + 8]
push edi
push edi
push 1
push 1
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00604859
push 0x6e8734
lea ecx, [ebp + 8]
mov esi, eax
call fcn.005eb0b8
lea ecx, [ebp + 8]
push edi
push ecx
push 5
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00605796
mov edx, dword [ebp + 8]
push edx
call fcn.00460e8e
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
cmp edi, ebx
jae 0x44f150
cmp edi, 0x1000
jae 0x44f150
mov eax, ebx
sub eax, edi
cmp eax, 0x400
jbe 0x44f13f
mov eax, dword [esi]
push 0x400
push 0x6e8b4c
mov ecx, esi
call dword [eax + 0x34]
add edi, eax
jmp 0x44f113
mov edx, dword [esi]
push eax
push 0x6e8b4c
mov ecx, esi
call dword [edx + 0x34]
add edi, eax
jmp 0x44f113
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
jne 0x44f160
mov eax, 1
xor ecx, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ecx
fild qword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
fild qword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, esi
fdivp st(1)
fmul qword [0x6397b0]
fstp qword [ebp - 0x18]
call dword [eax + 0x4c]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.005eb04a
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00604686
fld qword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44f430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61c6c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebp, ebp
mov dword [esp + 0x18], ebp
call fcn.005e5e99
mov dword [esi], method.CPtrArray.virtual_0
lea edi, [esi + 0x14]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.005e5e99
mov dword [edi], method.CPtrArray.virtual_0
mov eax, dword [0x6925a8]
lea ecx, [esi + 0x2c]
mov dword [ecx], eax
lea edx, [esp + 0x20]
mov byte [esp + 0x18], 3
push edx
call fcn.005eb183
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push 0x2c
mov dword [esi + 0x40], eax
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], ecx
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov byte [esp + 0x18], 4
je 0x44f4c5
mov ecx, eax
call fcn.0044f200
jmp 0x44f4c7
xor eax, eax
mov edx, dword [esp + 0x28]
mov ecx, esi
push edx
mov byte [esp + 0x1c], 3
mov dword [esi + 0x28], eax
call fcn.0044fb10
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.005eb04a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x450cf0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x61ca41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
mov dword [esp + 0x14], 0
push 0x6e8734
lea ecx, [esp + 0xc]
mov dword [esp + 0x128], 2
call fcn.005eb0b8
mov eax, dword [esp + 0x130]
mov bl, 3
push 0x6921b4
push eax
mov byte [esp + 0x12c], bl
call fcn.00460ddf
add esp, 8
test eax, eax
jne 0x450dce
lea ecx, [esp + 0x18]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x450e72
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.0046f760
add esp, 8
lea ecx, [esp + 0x134]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x130], 4
call fcn.005eb279
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 5
call fcn.005eb183
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], 4
call fcn.005eb04a
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], bl
call fcn.005eb04a
jmp 0x450e72
mov eax, dword [esp + 0x130]
push 0x6921b0
push eax
call fcn.00460ddf
add esp, 8
test eax, eax
jne 0x450e5d
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x450e72
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0046f760
add esp, 8
lea ecx, [esp + 0x134]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x130], 6
call fcn.005eb279
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 7
call fcn.005eb183
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 6
call fcn.005eb04a
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], bl
call fcn.005eb04a
jmp 0x450e72
mov eax, dword [esp + 0x130]
push 0x6921b8
push eax
call fcn.00460ddf
add esp, 8
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.005eadbf
mov ebx, 1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x124], 2
call fcn.005eb04a
lea ecx, [esp + 0x130]
mov byte [esp + 0x124], bl
call fcn.005eb04a
lea ecx, [esp + 0x134]
mov byte [esp + 0x124], 0
call fcn.005eb04a
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x4519a0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61cb6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0x10
push 1
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
lea eax, [esi + 6]
push eax
call fcn.004625f9
mov edx, dword [0x6925a8]
lea ecx, [eax + eax + 0xb]
shr ecx, 2
mov dword [esp + 8], edx
lea ecx, [esi + ecx*4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, ecx
and ecx, 0xffff
mov edx, eax
and eax, 0xffff
shr esi, 0x10
push ecx
push esi
shr edx, 0x10
push eax
push edx
lea eax, [esp + 0x18]
push str._d._d._04d._04d
push eax
mov dword [esp + 0x30], 1
call fcn.005e38ee
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.005eadbf
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005eb04a
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x451a70
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61cb8b
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push edi
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
ja 0x451b4d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, eax
test ebx, ebx
jbe 0x451b4b
lea ecx, [esp + 0x10]
push esi
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0046f760
add esp, 8
mov ecx, 0x41
xor eax, eax
mov edi, ebp
mov dword [esp + 0x120], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax - 8]
push eax
call fcn.005eb47a
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0xffffffffffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.005eb4c9
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.005eb04a
mov eax, ebx
pop esi
jmp 0x451b4d
mov eax, ebx
mov ecx, dword [esp + 0x114]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x451ff0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x61cce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x38]
xor ebx, ebx
push eax
push 0x319
mov dword [esp + 0x24], ebx
call fcn.005ed327
mov ecx, dword [0x6925a8]
lea ebp, [esi + 0x70]
mov dword [ebp], ecx
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 2
call fcn.00454b00
lea ecx, [esi + 0x2f0]
mov byte [esp + 0x1c], 3
call fcn.00454b00
lea edi, [esi + 0x560]
mov byte [esp + 0x1c], 4
mov ecx, edi
call fcn.005e712b
mov dword [edi], vtable.CProgressCtrl.0
push 0x44
mov byte [esp + 0x20], 5
mov dword [esi], method.CDialog.virtual_0
call fcn.005e6fe9
mov edi, eax
add esp, 4
mov dword [esp + 0x38], edi
cmp edi, ebx
mov byte [esp + 0x1c], 6
je 0x4520b2
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
push ebx
push edx
push eax
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.005eadbf
mov ecx, edi
call fcn.0044f430
jmp 0x4520b4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x24]
mov dword [esi + 0x7c], ecx
push edx
mov ecx, ebp
mov byte [esp + 0x20], 5
mov dword [esi + 0x74], 1
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], eax
call fcn.005eb183
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005eb04a
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18
Function at 0x452380
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61cd90
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
push eax
mov ecx, dword [esi + 0x60]
call fcn.00450bc0
mov edi, eax
test edi, edi
je 0x4524fc
mov eax, dword [edi + 0xc]
push ebx
push ebp
push eax
push 0x49e
mov ecx, esi
call fcn.005ea4ae
mov ecx, eax
call fcn.005ea625
mov ecx, dword [esi + 0x60]
push edi
mov ebp, dword [ecx + 0x1c]
call fcn.00450b90
push 0x6e8734
lea ecx, [esp + 0x38]
mov ebx, eax
call fcn.005eb0b8
inc ebx
push ebp
push ebx
lea ecx, [esp + 0x3c]
push str.__d____d
push ecx
mov dword [esp + 0x3c], 0
call fcn.005e38ee
lea edx, [esp + 0x30]
push 0x819
push edx
call fcn.00429010
add esp, 0x18
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x38], 1
call fcn.005eb279
push 0x6905f0
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x34], 2
push eax
call fcn.005eb2df
lea ecx, [edi + 4]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x38], 3
call fcn.005eb279
push 0x6922c4
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x34], 4
push eax
call fcn.005eb2df
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 9
call fcn.005eb04a
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 8
call fcn.005eb04a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 7
call fcn.005eb04a
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 6
call fcn.005eb04a
mov ecx, dword [esp + 0x10]
push ecx
push 0x49d
mov ecx, esi
call fcn.005ea4ae
mov ecx, eax
call fcn.005ea625
push edi
mov ecx, esi
call fcn.004525a0
mov ecx, dword [esi + 0x60]
push edi
call fcn.00450c10
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.005eb04a
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005eb04a
pop ebp
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, esi
call fcn.004522d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x452539
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61cda8
mov edx, dword [esp + 0x14]
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edx
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x60]
push edx
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push eax
lea eax, [esp + 0x28]
push ecx
push eax
call fcn.00451cc0
add esp, 0x14
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
push ecx
push 0x4a0
mov ecx, esi
call fcn.005ea4ae
mov ecx, eax
call fcn.005ea625
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0xffffffff
call fcn.005eb04a
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc
Function at 0x452ea0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x61cf1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], 0
push eax
push 0x32a
call fcn.005ed327
mov ecx, dword [0x6925a8]
lea edi, [esi + 0x60]
mov dword [edi], ecx
mov edx, dword [0x6925a8]
lea ebp, [esi + 0x64]
mov dword [ebp], edx
lea ebx, [esi + 0x68]
mov byte [esp + 0x28], 3
mov ecx, ebx
call fcn.005e712b
mov dword [ebx], vtable.CEdit.0
lea ebx, [esi + 0xa4]
mov byte [esp + 0x28], 4
mov ecx, ebx
call fcn.005e712b
mov dword [ebx], vtable.CProgressCtrl.0
lea eax, [esp + 0x30]
mov ecx, edi
push eax
mov byte [esp + 0x2c], 5
mov dword [esi], method.CDialog.virtual_0
call fcn.005eb183
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0046f990
mov edi, eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x38], 6
call fcn.0046f760
add esp, 0x10
push edi
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x34], 7
call fcn.005eb279
push 0x68f498
push eax
lea eax, [esp + 0x3c]
mov bl, 8
push eax
mov byte [esp + 0x34], bl
call fcn.005eb2df
push eax
mov ecx, ebp
mov byte [esp + 0x2c], 9
call fcn.005eb183
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], bl
call fcn.005eb04a
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 7
call fcn.005eb04a
mov byte [esp + 0x28], 6
lea ecx, [esp + 0x14]
call fcn.005eb04a
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 5
call fcn.005eb04a
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005eb04a
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x4558b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61d268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x1c]
push eax
call edi
push eax
call fcn.005e7556
push eax
lea ecx, [esp + 0x30]
call fcn.005efd5d
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x1c]
push edx
call edi
push eax
call fcn.005e7556
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.005efc13
mov eax, dword [esi + 0xf4]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x4559ed
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0xf0]
call fcn.005ef4cf
lea edi, [esi + 0x100]
mov ecx, edi
call fcn.005f005c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
push eax
sub ecx, edx
mov edx, dword [esp + 0x34]
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.005f0005
test edi, edi
je 0x455999
mov edi, dword [edi + 4]
mov eax, dword [esi + 0xf4]
push edi
push eax
call fcn.005ef610
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x108], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0xf4]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0xf0]
sub ecx, edi
test edx, edx
je 0x455a0e
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.005efdcf
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x46fbf0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x61fc90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x34]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
sub eax, edi
lea ecx, [esp + 0x14]
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [esp + 0x48]
push eax
push 1
sar ebx, 1
push 0
sub ebx, 2
call fcn.005f0072
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.005ef663
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], eax
lea edx, [edi + ebx + 3]
mov ecx, esi
lea eax, [ebp + 1]
push edx
mov dword [esp + 0x4c], eax
push eax
lea eax, [esp + 0x24]
push eax
call fcn.005efae1
mov ecx, dword [esp + 0x44]
add ebp, 3
lea eax, [ecx - 2]
mov ecx, esi
push eax
push ebp
call fcn.005efb2d
mov edx, dword [esp + 0x44]
mov ecx, esi
lea eax, [edx - 2]
push eax
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.005efae1
mov ecx, dword [esp + 0x40]
lea edx, [edi + 2]
push edx
lea eax, [ecx - 1]
mov ecx, esi
push eax
mov dword [esp + 0x3c], eax
call fcn.005efb2d
mov ecx, dword [esp + 0x48]
lea eax, [edi + ebx + 2]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.005efae1
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0xfffffffd
push eax
push ebp
call fcn.005efb2d
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x1c]
lea eax, [ecx - 3]
mov ecx, esi
push eax
push ebp
push edx
call fcn.005efae1
mov ecx, dword [esp + 0x34]
lea eax, [edi + 1]
push eax
push ecx
mov ecx, esi
call fcn.005efb2d
mov eax, dword [esp + 0x48]
lea edx, [edi + ebx + 1]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.005efae1
mov edx, dword [esp + 0x44]
mov ecx, esi
lea ebx, [edx - 4]
push ebx
push ebp
call fcn.005efb2d
push ebx
lea eax, [esp + 0x3c]
push ebp
push eax
mov ecx, esi
call fcn.005efae1
mov ecx, dword [esp + 0x34]
push edi
push ecx
mov ecx, esi
call fcn.005efb2d
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
call fcn.005ef663
mov dword [esp + 0x14], vtable.CGdiObject.0
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 1
call fcn.005f005c
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x46ff20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61fd42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004770e0
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0x14], edi
call fcn.005e5196
push 0xa
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.005e6dfd
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 2
call fcn.005e5196
push 0xa
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 3
call fcn.005e6dfd
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 4
call fcn.005e5196
push 0xa
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 5
call fcn.005e6dfd
lea ecx, [esi + 0x94]
mov byte [esp + 0x14], 6
call fcn.005e5e99
push 0xa
lea ecx, [esi + 0xa8]
mov byte [esp + 0x18], 7
call fcn.005e6dfd
push 0xa
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 8
call fcn.005e634a
mov dword [esi + 0xfc], edi
mov dword [esi + 0xf8], vtable.CFont.0
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xf0], eax
mov dword [esi + 0xe8], eax
mov byte [esp + 0x14], 0xa
mov dword [esi], 0x642888
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xec], ecx
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.004723b0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x470090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61fdda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x642888
mov eax, dword [esi + 0xd8]
mov dword [esp + 0x14], 0xa
test eax, eax
je 0x4700f4
push edi
lea edi, [esi + 0xcc]
push 0
push 0
push 0
mov ecx, edi
call fcn.005e6476
push eax
call fcn.005ec482
push eax
mov ecx, esi
call fcn.00471b40
mov eax, dword [esi + 0xd8]
test eax, eax
jne 0x4700ce
pop edi
mov ecx, esi
call fcn.004701c0
lea ecx, [esi + 0xf8]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 0xb
call fcn.005f005c
lea ecx, [esi + 0xcc]
mov byte [esp + 0x14], 8
call fcn.005e6389
lea ecx, [esi + 0xa8]
mov byte [esp + 0x14], 7
call fcn.005e6eb0
lea ecx, [esi + 0x94]
mov byte [esp + 0x14], 6
call fcn.005e5ecc
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 5
call fcn.005e6eb0
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 4
call fcn.005e51bf
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 3
call fcn.005e6eb0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 2
call fcn.005e51bf
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.005e6eb0
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 0
call fcn.005e51bf
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00477120
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x470270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61fe10
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xor ebp, ebp
and edi, 0xffff
push ebp
mov esi, ecx
push edi
call fcn.004729c0
add esp, 8
cmp eax, ebp
je 0x470446
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], 0x6331b0
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebp
call fcn.005f0005
call fcn.00606265
mov ebx, dword [eax + 0xc]
cmp ebx, ebp
je 0x47042d
push 0xf1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
je 0x47042d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, ebp
je 0x47042d
mov edx, dword [esi + 0xe8]
xor ecx, ecx
mov cx, word [ebx + 4]
xor eax, eax
mov ax, word [ebx + 2]
cmp edx, ebp
jne 0x470407
push 0xa
push ebp
mov dword [esi + 0xe8], eax
lea edi, [eax + 4]
push 1
mov dword [esi + 0xec], ecx
lea edx, [ecx + 4]
push ecx
mov dword [esi + 0xf0], edi
push eax
lea ecx, [esi + 0x28]
mov dword [esi + 0xf4], edx
call fcn.005e525b
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
push 0xf
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
neg ecx
sbb ecx, ecx
push eax
and ecx, edi
push ecx
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp word [ebx + 6], bp
mov dword [esp + 0x14], ebp
jbe 0x4703de
lea edx, [ebx + 8]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
xor edi, edi
mov di, word [eax]
test edi, edi
jbe 0x4703c0
lea ecx, [esp + 0x18]
lea ebp, [esi + 0x30]
push ecx
push edi
mov ecx, ebp
call fcn.005e6f5c
test eax, eax
je 0x4703ae
mov eax, dword [esp + 0x18]
test eax, eax
jge 0x4703bc
push edi
mov ecx, ebp
call fcn.005e6f7e
mov edx, dword [esp + 0x34]
mov dword [eax], edx
inc dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
xor ecx, ecx
inc eax
mov cx, word [ebx + 6]
add edi, 2
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
jl 0x470385
lea ecx, [esp + 0x1c]
call fcn.005f0032
mov dword [esp + 0x1c], vtable.CGdiObject.0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 3
call fcn.005f005c
mov eax, 1
jmp 0x470448
cmp dword [esi + 0xe8], eax
jne 0x47041b
cmp dword [esi + 0xec], ecx
je 0x470344
mov dword [esp + 0x1c], vtable.CGdiObject.0
mov dword [esp + 0x2c], 2
jmp 0x47043d
mov dword [esp + 0x1c], vtable.CGdiObject.0
mov dword [esp + 0x2c], 1
lea ecx, [esp + 0x1c]
call fcn.005f005c
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4