joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfc60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jne 0x4dfdaf
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0xc0]
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x160]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x84]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x15c]
push 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4dfd2c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4dfd0c
sub eax, dword [ebp - 0x18]
cdq
idiv dword [esi + 0x14c]
lea ecx, [eax + 1]
mov eax, dword [esi + 0x13c]
cmp eax, ecx
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jl 0x4dfd2c
sub eax, dword [ebp - 0x20]
cdq
idiv dword [esi + 0x150]
lea edi, [eax + 1]
mov eax, dword [esi + 0x140]
cmp eax, edi
cmovl edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x15c]
jne 0x4dfd5c
cmp edi, dword [esi + 0x160]
jne 0x4dfd5c
push 0
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004dfdd0
jmp 0x4dfdaf
push 1
push dword [esi + 0x148]
mov ecx, esi
mov dword [esi + 0x15c], eax
push dword [esi + 0x144]
mov dword [esi + 0x160], edi
call fcn.004dfdd0
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0x164], 1
mov eax, dword [ecx]
call dword [eax + 0x1a4]
push dword [ebp - 8]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0xc]
mov dword [esi + 0x164], 0
call dword [eax + 0x104]
push dword [ebp + 8]
mov ecx, esi
call fcn.0048cbf0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056e41f
mov esp, ebp
pop ebp
ret 4

Function at 0x4e2b10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x4e2b20
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4e40d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 8], 0
je 0x4e4149
mov edi, dword [ebp + 8]
cmp edi, 0x26
je 0x4e40f7
cmp edi, 0x28
je 0x4e40f7
cmp edi, 0x22
je 0x4e40f7
cmp edi, 0x21
jne 0x4e4149
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4e4149
push 5
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 8]
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x4e4149
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e4810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x4e486b
mov esi, dword [ebp + 8]
cmp esi, 0x2e
je 0x4e4832
cmp esi, 8
je 0x4e4832
xor eax, eax
jmp 0x4e4837
mov eax, 1
mov dword [edi + 0x170], eax
mov eax, dword [edi + 0x144]
test eax, eax
je 0x4e4854
cmp dword [eax + 0x80], 0
jne 0x4e49d0
cmp esi, 9
jne 0x4e4874
cmp dword [edi + 0x194], 0
je 0x4e486b
test byte [edi + 0x174], 8
jne 0x4e48c9
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
cmp esi, 0xd
je 0x4e486b
cmp esi, 0x1b
jne 0x4e48c9
mov ecx, dword [edi + 0x138]
mov eax, dword [ecx]
call dword [eax + 0x1a8]
push dword [edi + 0x150]
mov ecx, edi
call fcn.004e5a10
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.004e5d90
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x4e490d
cmp dword [eax + 0x20], 0
je 0x4e490d
push 0x12
call ebx
test ax, ax
jns 0x4e490d
push 0x11
call ebx
test ax, ax
js 0x4e490d
mov ecx, dword [edi + 0xc0]
call fcn.004a26f0
test eax, eax
je 0x4e490d
movzx ecx, si
push ecx
mov ecx, eax
call fcn.0047d6c0
test eax, eax
jne 0x4e49a6
cmp esi, 0x73
jne 0x4e4983
push 0x12
call ebx
test ax, ax
jns 0x4e4996
mov ecx, dword [edi + 0x194]
test ecx, ecx
je 0x4e4932
push dword [ebp + 0xc]
push esi
call fcn.004e40d0
test eax, eax
jne 0x4e49a6
cmp dword [edi + 0x144], 0
je 0x4e4958
cmp esi, 0x26
je 0x4e494f
cmp esi, 0x28
je 0x4e494f
cmp esi, 0x22
je 0x4e494f
cmp esi, 0x21
jne 0x4e49b2
push 0x12
call ebx
test ax, ax
js 0x4e49b2
mov ecx, edi
call fcn.004e4170
test eax, eax
je 0x4e49b2
mov ecx, dword [edi + 0x138]
mov edx, dword [ebp + 0xc]
push edx
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x258]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
cmp esi, 0x26
je 0x4e498d
cmp esi, 0x28
jne 0x4e491b
push 0x12
call ebx
test ax, ax
jns 0x4e491b
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
push 0
call dword [eax + 0xd4]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, dword [edi + 0x144]
test ecx, ecx
je 0x4e49d0
cmp dword [ecx + 0x20], 0
je 0x4e49d0
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.0049e920
test eax, eax
jne 0x4e49a6
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 8
Function at 0x4e5760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x240]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x144], 0
je 0x4e57b9
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4e589d
mov eax, dword [ebp + 0xc]
cmp eax, 0x26
je 0x4e57ae
cmp eax, 0x28
je 0x4e57ae
cmp eax, 0x21
je 0x4e57ae
cmp eax, 0x22
jne 0x4e589d
push dword [ebp + 0x10]
push eax
push 0x100
jmp 0x4e581f
mov edi, dword [ebp + 0xc]
cmp edi, 0x73
jne 0x4e587e
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4e589d
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
push 1
push 0x102
push 0x102
push dword [esi + 0x20]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4e5826
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x102
mov ecx, esi
call fcn.0053b9bd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x240]
cmp dword [ebp - 4], eax
je 0x4e5870
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
mov edi, dword [ebx + 0x144]
test edi, edi
je 0x4e5870
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4e5870
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x26
je 0x4e588c
cmp edi, 0x28
jne 0x4e57d6
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4e57d6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e8b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2f95
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.0049a9c0
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00548e33
mov esi, dword [ebp + 0x18]
mov ecx, edi
sub esi, dword [ebp + 0x10]
push 0x34
call fcn.0049a9c0
push eax
mov eax, dword [ebp + 0x1c]
push 1
push esi
mov esi, dword [ebp - 0x24]
dec eax
push eax
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00548dd3
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00476390
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.0049a9c0
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405d05
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4e8c8b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00476740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4eabc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x74]
test eax, eax
je case.0x4eac3d.10
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x4eac15
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x8c]
test eax, eax
je 0x4eac15
mov eax, dword [ebp + 8]
cmp eax, 0xd
je 0x4eabfb
cmp eax, 0x20
jne case.0x4eac3d.10
mov ecx, dword [esi + 0xc0]
push 0
push dword [esi + 0x40]
call fcn.004a4da0
mov eax, 1
pop esi
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc0]
call fcn.00477ab0
mov eax, dword [ebp + 8]
add esp, 8
add eax, 0xfffffff7
cmp eax, 0x1f
ja case.0x4eac3d.10
movzx eax, byte [eax + 0x4eae14]
jmp dword [eax*4 + 0x4eade8]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.004e9cf0
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
jmp 0x4eac46
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004ea060
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004ea060
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004e9da0
cmp eax, 0xffffffff
jne 0x4eac4f
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push eax
push dword [esi + 0x40]
call fcn.00488150
cmp eax, dword [esi + 0x40]
jne case.0x4eac3d.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.004e9cf0
cmp eax, 0xffffffff
je case.0x4eac3d.10
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004e9ed0
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004e9ed0
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004e9da0
cmp eax, 0xffffffff
jne 0x4eac4f
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push 1
push dword [esi + 0x40]
call fcn.00488150
cmp eax, dword [esi + 0x40]
jne case.0x4eac3d.10
push 1
jmp 0x4eacdb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x1bc]
test ax, ax
js 0x4eadb2
push 1
push ecx
mov ecx, esi
call fcn.004e9cf0
cmp eax, dword [esi + 0x1bc]
jle case.0x4eac3d.10
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.004e9cf0
cmp eax, dword [esi + 0x1bc]
jge case.0x4eac3d.10
push eax
mov ecx, esi
call fcn.004eba70
mov eax, 1
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4edff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x60]
test edi, edi
je 0x4ee086
mov eax, dword [ebp + 8]
shr eax, 8
push ebx
mov ebx, dword [edi + 0x34]
cmp al, 2
jne 0x4ee085
test ebx, ebx
je 0x4ee085
push dword [ebp + 0x10]
lea eax, [edi + 4]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ee03a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp dword [eax + 0x14], 0
jne 0x4ee03a
mov ecx, dword [ebx + 0x2c]
jmp 0x4ee05e
mov eax, dword [edi + 0x34]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x40]
cmp dword [eax + 0x58], 0
cmovne edx, dword [ebp + 0x10]
add edx, dword [edi + 0x1c]
cmp edx, ecx
jl 0x4ee05e
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov ecx, edx
cmp edx, eax
cmovge ecx, eax
push ecx
mov ecx, esi
call fcn.004ed940
cmp dword [ebp + 8], 0x202
je 0x4ee07c
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4ee085
push 0
mov ecx, esi
call fcn.004ed7f0
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4f5460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b39d5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xaa0055
mov dword [ebp - 0x1c], 0xaa0055
mov dword [ebp - 0x18], 0xaa0055
mov dword [ebp - 0x14], 0xaa0055
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], vtable.CBitmap.0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [ebp - 0x34]
call fcn.005460ea
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CBrush.0
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005460ea
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.005467b4
mov esi, dword [ebx]
mov ecx, edi
push 0xf
mov dword [ebp - 0x3c], eax
call fcn.0049a9c0
push eax
mov ecx, ebx
call dword [esi + 0x2c]
mov esi, dword [ebp - 0x24]
mov ecx, edi
push 0x14
mov ebx, eax
mov esi, dword [esi]
call fcn.0049a9c0
mov ecx, dword [ebp - 0x24]
push eax
call dword [esi + 0x30]
mov edi, eax
mov eax, dword [ebp - 0x38]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov esi, dword [eax]
sub ecx, edx
push ecx
mov ecx, dword [eax + 8]
sub ecx, esi
push ecx
push edx
push esi
mov esi, dword [ebp - 0x24]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_PatBlt]
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.005467b4
mov eax, dword [esi]
mov ecx, esi
push ebx
call dword [eax + 0x2c]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x30]
lea ecx, [ebp - 0x2c]
call fcn.0054625a
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CBrush.0
call fcn.0040c42b
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.CBitmap.0
call fcn.0040c42b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret 8
Function at 0x4fee60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2f95
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.0049a9c0
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00548e33
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push 0xc5c5c5
sub eax, ecx
push 1
push eax
mov eax, dword [ebp + 0x1c]
dec eax
push eax
push ecx
mov ecx, esi
call fcn.00548dd3
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00476390
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.0049a9c0
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405d05
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4fef63
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00476740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret 0x18
Function at 0x503880
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x503a79
mov edi, dword [esi + 4]
test edi, edi
je 0x503a79
push edi
mov dword [ebp + 8], 0
call fcn.00505db0
test eax, eax
je 0x503923
mov ecx, edi
call fcn.004b4820
test eax, eax
je 0x503a79
cvtsi2ss xmm0, dword [esi]
mov ebx, dword [eax + 0x14]
movss dword [ebp + 0xc], xmm0
call fcn.00505b80
mov edi, eax
mov edx, dword [edi + 0x38]
test edx, edx
jne 0x5038ee
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5e2084
push dword [edi]
call eax
mov dword [edi + 0x38], eax
mov edx, eax
fld dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push 0
push ecx
movzx ecx, bl
shl ecx, 8
movzx eax, bx
shr eax, 8
or ecx, eax
mov eax, ebx
shr eax, 0x10
and ebx, 0xff000000
shl ecx, 8
movzx eax, al
or ecx, eax
or ecx, ebx
fstp dword [esp]
push ecx
call edx
jmp 0x503978
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.005034a0
mov ebx, eax
test ebx, ebx
je 0x503978
cvtsi2ss xmm0, dword [esi]
movss dword [ebp + 0xc], xmm0
call fcn.00505b80
mov edi, eax
mov eax, dword [edi + 0x3c]
test eax, eax
jne 0x50395c
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5e2094
push dword [edi]
call eax
mov dword [edi + 0x3c], eax
fld dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push ecx
fstp dword [esp]
push ebx
call eax
push ebx
call fcn.00505b80
push eax
call fcn.00505a90
cmp dword [ebp + 8], 0
je 0x503a79
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5039cd
call fcn.00479f30
mov ecx, dword [esi + 8]
cmp eax, 1
jne 0x5039b0
push 0
call fcn.00479ea0
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
lea eax, [ebp - 8]
fst dword [ebp - 8]
fstp dword [ebp - 4]
push 2
jmp 0x5039be
call fcn.00479f30
mov ecx, dword [esi + 8]
push eax
call fcn.00479f40
push eax
push dword [ebp + 8]
call fcn.00505b80
push eax
call fcn.00505af0
mov edi, dword [esi + 0x14]
test edi, edi
je 0x503a04
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00505b80
mov ebx, eax
mov eax, dword [ebx + 0xb0]
test eax, eax
jne 0x5039fe
push 0x5e2198
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb0], eax
push edi
push dword [ebp + 0xc]
call eax
mov edi, dword [esi + 0xc]
test edi, edi
je 0x503a3b
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00505b80
mov ebx, eax
mov eax, dword [ebx + 0xb4]
test eax, eax
jne 0x503a35
push 0x5e21ac
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb4], eax
push edi
push dword [ebp + 0xc]
call eax
mov esi, dword [esi + 0x10]
test esi, esi
je 0x503a6d
mov ebx, dword [ebp + 8]
call fcn.00505b80
mov edi, eax
mov eax, dword [edi + 0xb8]
test eax, eax
jne 0x503a69
push 0x5e21c0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xb8], eax
push esi
push ebx
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x505b90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.00505b80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [eax + 4], 0
je 0x505c03
mov esi, dword [ebx + 4]
mov ebx, dword [ebx + 8]
call fcn.00505b80
cmp esi, ebx
je 0x505be7
mov ecx, dword [eax + 0x24]
mov dword [ebp - 8], eax
test ecx, ecx
jne 0x505bdd
push 0x5e2024
push dword [eax]
call edi
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov ecx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
call ecx
jmp 0x505c03
mov ebx, eax
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x505bfc
push 0x5e2038
push dword [ebx]
call edi
mov dword [ebx + 0x28], eax
lea ecx, [ebp - 4]
push ecx
push esi
call eax
mov ebx, dword [ebp - 4]
test ebx, ebx
jne 0x505c13
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00505b80
mov esi, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x505c2d
push 0x5e1fe4
push dword [esi]
call edi
mov dword [esi + 0x18], eax
push 2
push ebx
call eax
mov ebx, dword [ebp - 4]
call fcn.00505b80
mov esi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x505c4f
push 0x5e1ff4
push dword [esi]
call edi
mov dword [esi + 0x1c], eax
push 2
push ebx
call eax
mov ebx, dword [ebp - 4]
call fcn.00505b80
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x505c71
push 0x5e1fcc
push dword [esi]
call edi
mov dword [esi + 0x14], eax
push 4
push ebx
call eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret