joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475760
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
cmp dword [eax + 0x5c], 2
je 0x4758b4
mov ecx, dword [esp + 0x14]
cmp ecx, 0x60
jb 0x47578c
cmp ecx, 0x69
ja 0x47578c
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x4758b4
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x4758b4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
mov ebp, eax
push ebp
call fcn.00473c10
mov esi, eax
mov eax, dword [edi + 0x80]
add esp, 4
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ebp
test eax, eax
jle 0x475802
push ebx
mov ecx, edi
call fcn.004ecbc0
mov ebp, eax
mov eax, dword [ebp + 0x88]
test eax, eax
jne 0x475800
mov ecx, dword [edi + 0x70]
test byte [ecx + 0x5c], 1
je 0x4757f3
test esi, esi
jne 0x4757f3
push ebp
call fcn.00473c10
add esp, 4
test eax, eax
je 0x4757f3
mov esi, ebp
mov eax, dword [edi + 0x80]
inc ebx
cmp ebx, eax
jl 0x4757c3
jmp 0x475802
mov esi, ebp
test esi, esi
je 0x4758b4
push esi
call fcn.00473c10
add esp, 4
test eax, eax
je 0x4758b4
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x170]
test eax, eax
je 0x47583a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
push esi
call fcn.004754f0
mov ebp, eax
test ebp, ebp
je 0x4758b4
mov esi, dword [ebp + 0xbc]
mov ebx, dword [ebp + 0x3c]
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x475868
mov ecx, edi
call fcn.00475730
push 1
mov ecx, edi
call fcn.00475310
mov dword [edi + 0x40], 1
mov edx, dword [esi]
push 1
push 0
push 1
mov ecx, esi
call dword [edx + 0xbc]
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0xc4]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4758a8
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xac]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4758c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
cmp dword [edi + 4], 0x104
jne 0x47597c
mov eax, dword [edi + 0xc]
shr eax, 0x10
test ah, 0x20
je 0x47597c
call fcn.004753e0
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x47597c
push 0
mov ecx, esi
call fcn.004753e0
mov ecx, eax
call fcn.004d8860
test eax, eax
jne 0x47597c
mov ecx, esi
call fcn.004753e0
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x475920
mov eax, dword [eax + 0x1c]
push eax
call fcn.004d8510
add esp, 4
test eax, eax
je 0x47597c
cmp dword [edi + 8], 0x12
jne 0x475947
push 1
mov ecx, esi
call fcn.00475310
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x47595b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x47597c
mov eax, dword [edi + 8]
test eax, eax
je 0x47597c
push eax
mov ecx, esi
call fcn.00475760
test eax, eax
je 0x47597c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x105
je 0x47598d
cmp eax, 0x101
jne 0x4759bd
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x4759bd
mov eax, dword [esi + 0xac]
test eax, eax
je 0x4759bd
push 0
mov ecx, esi
call fcn.004753e0
mov ecx, eax
call fcn.004d8860
test eax, eax
jne 0x4759bd
push eax
mov ecx, esi
call fcn.00475310
mov eax, dword [edi + 4]
cmp eax, 0x7b
je 0x4759cc
cmp eax, 0x105
jne 0x475a0e
push 0
mov ecx, esi
call fcn.004753e0
mov ecx, eax
call fcn.004d8860
test eax, eax
je 0x475a0e
push 0x477440
mov ecx, 0x5c2a74
call fcn.005917bb
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x7b
mov ecx, eax
call fcn.004d8cb0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
cmp dword [edi + 4], 0x20a
jne 0x475acb
push 0x477440
mov ecx, 0x5c2a74
call fcn.005917bb
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jle 0x475a5d
push 0x477440
mov ecx, 0x5c2a74
call fcn.005917bb
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x20a
mov ecx, eax
call fcn.004d8cb0
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
lea ecx, [esp + 0xc]
mov ebx, eax
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
test ebx, ebx
je 0x475acb
cmp dword [ebx + 0xa0], 3
jne 0x475acb
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], edx
call fcn.0048c8b0
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
pop ebp
je 0x475acb
mov edx, dword [edi + 8]
xor eax, eax
shr edx, 0x10
test dx, dx
setle al
push eax
mov ecx, ebx
call fcn.004dd660
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x100
jb 0x47593c
cmp eax, 0x108
ja 0x47593c
push edi
mov ecx, esi
call fcn.00473f20
mov ecx, eax
call fcn.00478200
test eax, eax
je 0x47593c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
Function at 0x478ea0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59c397
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [esp + 0x138]
push ebp
push esi
cmp ebx, 0x60
push edi
jb 0x478ee9
cmp ebx, 0x69
ja 0x478ee9
movsx eax, byte [esp + 0x140]
add ebx, 0xffffffd0
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
jmp 0x4790d9
push 2
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test al, al
je 0x4790b0
mov edx, dword [esp + 0x140]
push edx
call fcn.00479230
mov cl, byte [esp + 0x144]
add esp, 4
cmp cl, bl
mov byte [esp + 0x13], al
je 0x4790d4
cmp al, bl
je 0x4790d4
mov ebp, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor esi, esi
push esi
push esi
call ebp
mov edi, eax
cmp edi, 1
jl 0x4790b0
xor ebx, ebx
mov dword [esp + 0x18], 0x422958
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
cmp edi, esi
mov dword [esp + 0x138], esi
jne 0x478f6b
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
jmp 0x478f92
lea eax, [edi*4]
push eax
call fcn.00576f33
add esp, 4
mov dword [esp + 0x1c], eax
push edi
push eax
call fcn.0048ae80
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
push ebx
push edi
call ebp
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x478fbd
mov dword [esp + 0x18], 0x422958
mov dword [esp + 0x138], 1
jmp 0x4790a3
cmp edi, esi
mov dword [esp + 0x2c], esi
jle 0x479090
mov ebp, dword [sym.imp.USER32.dll_ToAsciiEx]
mov esi, ebx
mov dword [esp + 0x14], 0
mov edx, dword [esi]
push edx
mov edx, dword [esp + 0x148]
lea eax, [esp + 0x18]
push 0
lea ecx, [esp + 0x38]
push eax
push ecx
push 0
push edx
call ebp
cmp eax, 1
jne 0x479021
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x140]
cmp cl, al
je 0x4790b4
push eax
call fcn.00479230
mov cl, byte [esp + 0x17]
add esp, 4
cmp cl, al
je 0x4790b4
mov bl, byte [esp + 0x40]
mov byte [esp + 0x40], 0x81
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x148]
push 0
lea edx, [esp + 0x38]
push ecx
push edx
push 0
push eax
call ebp
cmp eax, 1
jne 0x479072
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x140]
cmp cl, al
je 0x4790f2
push eax
call fcn.00479230
mov cl, byte [esp + 0x17]
add esp, 4
cmp cl, al
je 0x4790f2
mov eax, dword [esp + 0x2c]
add esi, 4
inc eax
mov byte [esp + 0x40], bl
mov ebx, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x2c], eax
jl 0x478fd1
xor esi, esi
mov dword [esp + 0x18], 0x422958
mov dword [esp + 0x138], 4
cmp ebx, esi
je 0x4790b0
push ebx
call fcn.00576f5c
add esp, 4
xor eax, eax
jmp 0x4790d9
mov dword [esp + 0x18], 0x422958
test ebx, ebx
mov dword [esp + 0x138], 2
je 0x4790d4
push ebx
call fcn.00576f5c
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret
mov dword [esp + 0x18], 0x422958
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x138], 3
test eax, eax
je 0x4790d4
push eax
jmp 0x4790cc
Function at 0x47aff0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x59c616
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
mov dword [esp + 0xc], 0
call fcn.0049d6d0
mov ecx, eax
call fcn.0049d750
test al, al
jne 0x47b03d
mov esi, dword [esp + 0x134]
push 0x5bf6ec
mov ecx, esi
call fcn.0057b087
jmp 0x47b1d7
mov eax, dword [0x4051a4]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 8], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x130], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x47b0bf
lea edx, [esp + 0x10]
push edx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x47b0a6
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x47b0a6
lea edx, [esp + 0x20]
lea ecx, [esp + 8]
push edx
call fcn.0057b1a2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [esp + 8]
mov eax, dword [edx - 8]
test eax, eax
jne 0x47b0e6
mov esi, dword [esp + 0x134]
push 0x5bf6ec
mov ecx, esi
call fcn.0057b087
mov dword [esp + 0xc], ebx
jmp 0x47b1c6
call fcn.0058f8dd
mov esi, dword [eax + 4]
push 0x4024a8
lea ecx, [esp + 0x18]
call fcn.0057b087
mov ecx, dword [esi + 0x78]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x138], 2
call fcn.0057b2ae
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 3
call fcn.0057b431
lea ecx, [esp + 0x1c]
mov byte [esp + 0x12c], 2
call fcn.0057b019
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], bl
call fcn.0057b019
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47b167
test al, 0x10
jne 0x47b180
mov esi, dword [esp + 0x134]
push 0x5bf6ec
mov ecx, esi
call fcn.0057b087
mov dword [esp + 0xc], ebx
jmp 0x47b1c6
lea edx, [esp + 8]
push 0x4024a8
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0057b2ae
mov ecx, dword [esp + 0x138]
mov esi, dword [esp + 0x134]
push ecx
push eax
push esi
mov byte [esp + 0x138], 4
call fcn.0057b248
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x12c], bl
call fcn.0057b019
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 0
call fcn.0057b019
mov ecx, dword [esp + 0x124]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret 8
Function at 0x47b6d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59c6be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
mov eax, dword [esp + 0xcc]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push 0x1000
push 1
push eax
lea ecx, [esp + 0x94]
call fcn.0057f5b5
lea ecx, [esp + 0x84]
mov dword [esp + 0xd0], ebx
push ecx
lea ecx, [esp + 0x44]
call fcn.004e3710
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0xc]
mov byte [esp + 0xd0], 1
mov dword [esp + 0x5c], edi
call fcn.0057a87a
mov dword [esp + 0x2c], 0x422348
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0xc], 0x422aa8
mov dword [esp + 0x28], esi
mov edx, dword [esi]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x40]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0xd8], 2
call dword [edx + 0x88]
test eax, eax
je 0x47b799
mov eax, dword [edi + 8]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x84]
call fcn.0057f719
lea ecx, [esp + 0xc]
mov byte [esp + 0xd0], 1
call fcn.004c8d60
lea ecx, [esp + 0x40]
mov byte [esp + 0xd0], bl
call fcn.004e2200
lea ecx, [esp + 0x84]
mov dword [esp + 0xd0], 0xffffffff
call fcn.0057f691
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc8
ret 8

Function at 0x47e320
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
cmp esi, 8
mov edi, ecx
je 0x47e365
cmp esi, 0x21
jb 0x47e33a
cmp esi, 0x2e
jbe 0x47e365
cmp esi, 0x43
je 0x47e34e
cmp esi, 0x56
je 0x47e34e
cmp esi, 0x58
je 0x47e34e
cmp esi, 0x5a
jne 0x47e35b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x47e365
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x1c]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
call fcn.0057a50f
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x1c
ret 8

Function at 0x47e580
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x47e598
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov ebx, dword [esp + 0x28]
cmp ebx, 0x26
je 0x47e5b0
cmp ebx, 0x28
je 0x47e5b0
cmp ebx, 0x22
je 0x47e5b0
cmp ebx, 0x21
jne 0x47e5bd
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x47e5c7
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [edi + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 1
push eax
call esi
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
neg eax
sbb eax, eax
pop esi
pop edi
pop ebx
neg eax
add esp, 0x1c
ret 8
Function at 0x483c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0x406c2c
push eax
push esi
mov byte [esp + 0x10], 0x89
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], 0x4e
mov byte [esp + 0x13], 0x47
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x483cc2
pop esi
pop ecx
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x483cd1
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax]
lea ecx, [esp + 4]
xor eax, eax
mov esi, dword [ecx]
cmp edx, esi
pop esi
sete al
pop ecx
ret

Function at 0x483cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x483d09
pop esi
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x483d17
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x483d24
pop esi
ret
xor ecx, ecx
cmp word [eax + 0xe], 0x20
pop esi
sete cl
mov eax, ecx
ret
Function at 0x484010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59d068
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x484057
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x484076
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x484096
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ebx, dword [ebp + 8]
mov dword [esp + 0x34], 0
imul ebx, dword [ebp + 4]
shl ebx, 2
cmp word [ebp + 0xe], 0x20
jne 0x48419b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x48419b
lea ecx, [esp + 0x14]
call fcn.0057e628
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.0057e6df
push 0x34
call fcn.00560da0
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x484123
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057e75d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, 0xa
mov esi, ebp
mov edi, edx
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
neg eax
mov dword [edx + 0x14], ebx
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x3c]
sbb eax, eax
push 0
push ecx
and eax, esi
push 0
push edx
push eax
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x48417d
mov edi, dword [esp + 0x38]
test edi, edi
je 0x48417d
mov ecx, ebx
lea esi, [ebp + 0x28]
mov edx, ecx
mov dword [esp + 0x34], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call fcn.00560cb7
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057e75d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x486560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 0x14]
call fcn.0057e628
xor ebx, ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.0057e6df
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00486410
add esp, 0x14
test eax, eax
jne 0x4865e9
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057e75d
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 8]
push ebp
neg eax
sbb eax, eax
push edi
and eax, edx
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, ebx
je 0x486637
cmp ebp, ebx
je 0x486637
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x48664c
push eax
call fcn.00560cb7
add esp, 4
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x486661
push eax
call fcn.00560cb7
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x48666f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0057e75d
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x489070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x59d560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x70]
push 0xe
push edi
mov dword [esp + 0x18], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x48919e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x489211
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x489211
xor ebx, ebx
cmp word [ebp + 4], bx
jbe 0x48917f
lea ecx, [esp + 0x14]
call fcn.004858b0
mov eax, ebx
xor edx, edx
and eax, 0xffff
mov dword [esp + 0x64], 0
lea ecx, [eax*8]
sub ecx, eax
mov dl, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
xor ecx, ecx
mov edi, edx
mov cl, byte [eax + 6]
mov esi, ecx
mov ecx, dword [esp + 0x78]
cmp ecx, esi
jne 0x489119
cmp dword [esp + 0x7c], edi
je 0x489125
test ecx, ecx
jne 0x489163
mov ecx, dword [esp + 0x7c]
test ecx, ecx
jne 0x489163
xor edx, edx
push 0
mov dx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00485ed0
test eax, eax
je 0x489189
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push esi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00488e00
test eax, eax
je 0x489189
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.00485b50
inc ebx
cmp bx, word [ebp + 4]
jb 0x4890d7
mov eax, 1
jmp 0x489211
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.00485b50
xor eax, eax
jmp 0x489211
lea ecx, [esp + 0x38]
call fcn.004858b0
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
push 0
push ebx
push ebp
push edi
push esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 1
call fcn.00485ed0
test eax, eax
jne 0x4891df
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], 0xffffffff
call fcn.00485b50
xor eax, eax
jmp 0x489211
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebp
lea eax, [esp + 0x44]
push edx
push eax
call fcn.00488e00
lea ecx, [esp + 0x38]
mov esi, eax
mov dword [esp + 0x64], 0xffffffff
call fcn.00485b50
mov eax, esi
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0x18
Function at 0x489310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59d598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x1c], ecx
je 0x48933f
mov eax, dword [ebx + 4]
test eax, eax
jne 0x489346
xor eax, eax
jmp 0x489495
mov edi, dword [esp + 0x6c]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test edi, edi
jne 0x489365
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x489365
push eax
call esi
mov dword [esp + 0x6c], eax
mov edi, eax
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x4893b6
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4893b6
test edi, edi
jle 0x4893b6
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, ebp
sub ecx, edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov ecx, dword [ebx + 4]
push ecx
call esi
xor edx, edx
cmp eax, edi
sete dl
xor ebx, ebx
mov dword [esp + 0x18], edx
test edi, edi
mov dword [esp + 0x14], ebx
jle 0x489490
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4893fa
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4893fa
mov ecx, dword [esp + 0x10]
cmp dword [ecx], 0
je 0x489474
mov edx, dword [esp + 0x64]
push 0
push ebx
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov esi, eax
test esi, esi
je 0x48933f
mov eax, dword [esp + 0x68]
test eax, eax
je 0x489425
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
jmp 0x489429
mov edi, dword [esp + 0x14]
push 1
push esi
lea ecx, [esp + 0x38]
call fcn.004858c0
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ebp
push edx
push eax
lea ecx, [esp + 0x3c]
push edi
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x70], 0
call fcn.00488e00
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00485b50
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov edi, dword [esp + 0x6c]
inc ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jl 0x4893e1
mov eax, 1
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x18