joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493ee0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61dea0
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
je 0x493f1d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x493f1d
call fcn.005f6ea3
test ah, 8
jne 0x493f1d
mov eax, dword [esi + 0x58]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x493f40
mov edx, dword [esi]
push 0
push 0
push 0x301
mov ecx, esi
call dword [edx + 0xa0]
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push edi
test eax, eax
je 0x493ffa
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x3c]
push ebx
push ebp
push 0xb0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [esi + 0x68]
mov ecx, esi
push edi
call fcn.005f4861
mov eax, dword [esi + 0x6c]
mov edx, dword [edi]
lea ecx, [esi + 0x6c]
mov eax, dword [eax - 8]
mov edx, dword [edx - 8]
cmp edx, eax
jle 0x493faa
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.005ef79a
push eax
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.005f7ab5
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
jmp 0x493fd6
jge 0x493fdb
sub eax, edx
push eax
push edx
lea edx, [esp + 0x20]
push edx
call fcn.005ef688
push eax
mov ecx, edi
mov dword [esp + 0x28], 1
call fcn.005f7d94
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.005f797c
push 1
push ebp
mov ecx, esi
call fcn.00495fd0
push 1
push ebx
mov ecx, esi
call fcn.00495fd0
mov ebp, dword [ebp]
mov eax, dword [ebx]
cmp eax, ebp
jge 0x493ffa
mov dword [ebx], ebp
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.00495dc0
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x494079
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x494073
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x10]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x10]
call fcn.005f797c
mov ecx, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49f2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61e9b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005f3a24
mov eax, dword [0x86a874]
lea edi, [esi + 0x3c]
mov dword [esp + 0x14], 0
mov dword [edi], eax
mov edx, dword [0x86a874]
lea ecx, [esi + 0x40]
mov dword [ecx], edx
mov eax, dword [0x86a874]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov byte [esp + 0x18], 3
mov dword [esi], method.CWnd.virtual_0
mov dword [esi + 0x48], edx
call fcn.005f7b05
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x4c], edx
mov ecx, edi
mov dword [esi + 0x50], eax
call fcn.005f7907
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edx
mov dword [esi + 0x58], 1
mov dword [esi + 0x64], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x4a0640
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
cmp dword [eax + 0x5c], 2
je 0x4a0794
mov ecx, dword [esp + 0x14]
cmp ecx, 0x60
jb 0x4a066c
cmp ecx, 0x69
ja 0x4a066c
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x4a0794
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x4a0794
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
mov ebp, eax
push ebp
call fcn.0049e8e0
mov esi, eax
mov eax, dword [edi + 0x80]
add esp, 4
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ebp
test eax, eax
jle 0x4a06e2
push ebx
mov ecx, edi
call fcn.004a0fc0
mov ebp, eax
mov eax, dword [ebp + 0x88]
test eax, eax
jne 0x4a06e0
mov ecx, dword [edi + 0x70]
test byte [ecx + 0x5c], 1
je 0x4a06d3
test esi, esi
jne 0x4a06d3
push ebp
call fcn.0049e8e0
add esp, 4
test eax, eax
je 0x4a06d3
mov esi, ebp
mov eax, dword [edi + 0x80]
inc ebx
cmp ebx, eax
jl 0x4a06a3
jmp 0x4a06e2
mov esi, ebp
test esi, esi
je 0x4a0794
push esi
call fcn.0049e8e0
add esp, 4
test eax, eax
je 0x4a0794
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x174]
test eax, eax
je 0x4a071a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
push esi
call fcn.004a03e0
mov ebp, eax
test ebp, ebp
je 0x4a0794
mov esi, dword [ebp + 0xbc]
mov ebx, dword [ebp + 0x3c]
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x4a0748
mov ecx, edi
call fcn.004a0610
push 1
mov ecx, edi
call fcn.004a01c0
mov dword [edi + 0x40], 1
mov edx, dword [esi]
push 1
push 0
push 1
mov ecx, esi
call dword [edx + 0xbc]
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0xc4]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4a0788
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xb0]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4a07a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp dword [edi + 4], 0x104
jne 0x4a084c
mov eax, dword [edi + 0xc]
shr eax, 0x10
test ah, 0x20
je 0x4a084c
call fcn.004a0290
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x4a084c
push 0
mov ecx, esi
call fcn.004a0290
mov ecx, eax
call fcn.004fae20
test eax, eax
jne 0x4a084c
mov ecx, esi
call fcn.004a0290
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x4a07f8
mov eax, dword [eax + 0x1c]
push eax
call fcn.004faad0
add esp, 4
test eax, eax
je 0x4a084c
cmp dword [edi + 8], 0x12
jne 0x4a081b
push 1
mov ecx, esi
call fcn.004a01c0
pop edi
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4a082f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x4a084c
mov eax, dword [edi + 8]
test eax, eax
je 0x4a084c
push eax
mov ecx, esi
call fcn.004a0640
test eax, eax
je 0x4a084c
pop edi
mov eax, 1
pop esi
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x105
je 0x4a085d
cmp eax, 0x101
jne 0x4a088d
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x4a088d
mov eax, dword [esi + 0xac]
test eax, eax
je 0x4a088d
push 0
mov ecx, esi
call fcn.004a0290
mov ecx, eax
call fcn.004fae20
test eax, eax
jne 0x4a088d
push eax
mov ecx, esi
call fcn.004a01c0
mov eax, dword [edi + 4]
cmp eax, 0x7b
je 0x4a089c
cmp eax, 0x105
jne 0x4a08da
push 0
mov ecx, esi
call fcn.004a0290
mov ecx, eax
call fcn.004fae20
test eax, eax
je 0x4a08da
push 0x4a2430
mov ecx, 0x8c2ed8
call fcn.006105c0
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x7b
mov ecx, eax
call fcn.0050c4d0
pop edi
mov eax, 1
pop esi
ret 4
cmp dword [edi + 4], 0x20a
jne 0x4a0959
push 0x4a2430
mov ecx, 0x8c2ed8
call fcn.006105c0
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jle 0x4a0921
push 0x4a2430
mov ecx, 0x8c2ed8
call fcn.006105c0
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x20a
mov ecx, eax
call fcn.0050c4d0
pop edi
pop esi
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
test eax, eax
je 0x4a0959
cmp dword [eax + 0xa0], 3
jne 0x4a0959
mov ecx, dword [edi + 8]
xor edx, edx
shr ecx, 0x10
test cx, cx
setle dl
push edx
mov ecx, eax
call fcn.004e7b50
test eax, eax
je 0x4a0959
pop edi
mov eax, 1
pop esi
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x100
jb 0x4a0814
cmp eax, 0x108
ja 0x4a0814
push edi
mov ecx, esi
call fcn.0049ebf0
mov ecx, eax
call fcn.004d0e30
test eax, eax
je 0x4a0814
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x4a3050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [ebx + 0xa4]
push edi
and esi, 0xffff
call fcn.004b3c90
test esi, esi
jne 0x4a3078
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
call fcn.0060e02b
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x4a308d
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
push 0xf1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4a30a5
pop edi
pop esi
pop ebx
pop ecx
ret 8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a30b8
pop edi
pop esi
pop ebx
pop ecx
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4a30cc
pop edi
pop esi
pop ebx
pop ecx
ret 8
xor eax, eax
push ebp
mov ax, word [esi + 6]
shl eax, 2
push eax
call fcn.005f2f36
xor edi, edi
add esp, 4
cmp word [esi + 6], di
mov dword [esp + 0x10], eax
jbe 0x4a310f
mov ebp, eax
mov ecx, esi
call fcn.004a31a0
xor ecx, ecx
xor edx, edx
mov cx, word [eax + edi*2]
inc edi
mov dword [ebp], ecx
mov dx, word [esi + 6]
add ebp, 4
cmp edi, edx
jl 0x4a30ed
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [esi + 6]
push ecx
push eax
mov ecx, ebx
call fcn.004a2df0
mov ebp, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4a3180
mov ecx, ebx
call fcn.004b1e10
xor edi, edi
xor edx, edx
mov di, word [esi + 4]
mov dx, word [esi + 2]
mov ecx, dword [esp + 0x10]
push 0
push edi
push edx
xor edx, edx
mov dx, word [esi + 6]
push edx
mov edx, dword [esp + 0x28]
push ecx
push edx
mov ecx, eax
call fcn.004ad400
test eax, eax
jne 0x4a315d
xor ebp, ebp
mov ax, word [esi + 2]
cmp ax, 0x10
je 0x4a3180
and eax, 0xffff
mov ecx, eax
xor eax, eax
mov ax, word [esi + 4]
mov dword [ebx + 0xb4], ecx
mov dword [ebx + 0xb8], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.005f2f5f
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x4a6de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0x86f2ac
push eax
push esi
mov byte [esp + 0x10], 0x89
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], 0x4e
mov byte [esp + 0x13], 0x47
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4a6e12
pop esi
pop ecx
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a6e21
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax]
lea ecx, [esp + 4]
xor eax, eax
mov esi, dword [ecx]
cmp edx, esi
pop esi
sete al
pop ecx
ret

Function at 0x4a6e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4a6e59
pop esi
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a6e67
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4a6e74
pop esi
ret
xor ecx, ecx
cmp word [eax + 0xe], 0x20
pop esi
sete cl
mov eax, ecx
ret
Function at 0x4a7160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61f058
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4a71a7
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4a71c6
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4a71e6
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ebx, dword [ebp + 8]
mov dword [esp + 0x34], 0
imul ebx, dword [ebp + 4]
shl ebx, 2
cmp word [ebp + 0xe], 0x20
jne 0x4a72eb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x4a72eb
lea ecx, [esp + 0x14]
call fcn.005fb867
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.005fb91e
push 0x34
call fcn.004803ad
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x4a7273
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005fb99c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, 0xa
mov esi, ebp
mov edi, edx
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
neg eax
mov dword [edx + 0x14], ebx
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x3c]
sbb eax, eax
push 0
push ecx
and eax, esi
push 0
push edx
push eax
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x4a72cd
mov edi, dword [esp + 0x38]
test edi, edi
je 0x4a72cd
mov ecx, ebx
lea esi, [ebp + 0x28]
mov edx, ecx
mov dword [esp + 0x34], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call fcn.004802c4
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005fb99c
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4a9ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61f258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 0x14]
call fcn.005fb867
xor ebx, ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.005fb91e
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004a9980
add esp, 0x14
test eax, eax
jne 0x4a9b59
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005fb99c
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 8]
push ebp
neg eax
sbb eax, eax
push edi
and eax, edx
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, ebx
je 0x4a9ba7
cmp ebp, ebx
je 0x4a9ba7
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4a9bbc
push eax
call fcn.004802c4
add esp, 4
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4a9bd1
push eax
call fcn.004802c4
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4a9bdf
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.005fb99c
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4ac370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
and edi, 0xffff
jne 0x4ac385
pop edi
xor eax, eax
pop esi
ret 0x10
call fcn.0060e02b
mov esi, dword [eax + 0xc]
push 0xf1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4ac3a3
pop edi
pop esi
ret 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4ac3b4
pop edi
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4ac3c6
pop edi
pop esi
ret 0x10
xor eax, eax
push ebx
mov ax, word [esi + 6]
push ebp
shl eax, 2
push eax
call fcn.005f2f36
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edi, edi
add esp, 4
mov dword [ebp], eax
mov dword [ebx], 0
cmp word [esi + 6], di
jbe 0x4ac426
mov ecx, esi
call fcn.004a31a0
cmp word [eax + edi*2], 0
je 0x4ac41b
mov ecx, esi
call fcn.004a31a0
mov edx, dword [ebx]
xor ecx, ecx
mov cx, word [eax + edi*2]
mov eax, dword [ebp]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
xor ecx, ecx
inc edi
mov cx, word [esi + 6]
cmp edi, ecx
jl 0x4ac3f3
mov edx, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 2]
xor ecx, ecx
mov cx, word [esi + 4]
pop ebp
pop ebx
mov dword [edx], eax
pop edi
mov dword [edx + 4], ecx
mov eax, 1
pop esi
ret 0x10
Function at 0x4ac790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x61f570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x70]
push 0xe
push edi
mov dword [esp + 0x18], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4ac8be
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4ac931
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4ac931
xor ebx, ebx
cmp word [ebp + 4], bx
jbe 0x4ac89f
lea ecx, [esp + 0x14]
call fcn.004a8e20
mov eax, ebx
xor edx, edx
and eax, 0xffff
mov dword [esp + 0x64], 0
lea ecx, [eax*8]
sub ecx, eax
mov dl, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
xor ecx, ecx
mov edi, edx
mov cl, byte [eax + 6]
mov esi, ecx
mov ecx, dword [esp + 0x78]
cmp ecx, esi
jne 0x4ac839
cmp dword [esp + 0x7c], edi
je 0x4ac845
test ecx, ecx
jne 0x4ac883
mov ecx, dword [esp + 0x7c]
test ecx, ecx
jne 0x4ac883
xor edx, edx
push 0
mov dx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.004a9440
test eax, eax
je 0x4ac8a9
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push esi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004ac4f0
test eax, eax
je 0x4ac8a9
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a90c0
inc ebx
cmp bx, word [ebp + 4]
jb 0x4ac7f7
mov eax, 1
jmp 0x4ac931
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a90c0
xor eax, eax
jmp 0x4ac931
lea ecx, [esp + 0x38]
call fcn.004a8e20
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
push 0
push ebx
push ebp
push edi
push esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 1
call fcn.004a9440
test eax, eax
jne 0x4ac8ff
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], 0xffffffff
call fcn.004a90c0
xor eax, eax
jmp 0x4ac931
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebp
lea eax, [esp + 0x44]
push edx
push eax
call fcn.004ac4f0
lea ecx, [esp + 0x38]
mov esi, eax
mov dword [esp + 0x64], 0xffffffff
call fcn.004a90c0
mov eax, esi
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0x18
Function at 0x4aca30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x61f5a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x1c], ecx
je 0x4aca5f
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4aca66
xor eax, eax
jmp 0x4acbc1
mov edi, dword [esp + 0x6c]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test edi, edi
jne 0x4aca85
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x4aca85
push eax
call esi
mov dword [esp + 0x6c], eax
mov edi, eax
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x4acad6
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4acad6
test edi, edi
jle 0x4acad6
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, ebp
sub ecx, edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov ecx, dword [ebx + 4]
push ecx
call esi
xor edx, edx
cmp eax, edi
sete dl
xor ebx, ebx
mov dword [esp + 0x18], edx
test edi, edi
mov dword [esp + 0x14], ebx
jle 0x4acbbc
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4acb26
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4acb26
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x4acba0
cmp eax, 0xdeadbeaf
je 0x4acba0
mov edx, dword [esp + 0x64]
push 0
push ebx
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov esi, eax
test esi, esi
je 0x4aca5f
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4acb51
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
jmp 0x4acb55
mov edi, dword [esp + 0x14]
push 1
push esi
lea ecx, [esp + 0x38]
call fcn.004a8e30
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ebp
push edx
push eax
lea ecx, [esp + 0x3c]
push edi
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x70], 0
call fcn.004ac4f0
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.004a90c0
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov edi, dword [esp + 0x6c]
inc ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jl 0x4acb01
mov eax, 1
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x18