joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f040
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004d69a0
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004d7920
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 9
jne 0x51f108
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esi + 0xf8]
jl 0x51f0bd
test eax, eax
je 0x51f081
mov eax, dword [eax + 0x14]
inc eax
jmp 0x51f083
xor eax, eax
mov edx, dword [esi + 0xd8]
mov ecx, dword [esi + 0x104]
cmp eax, edx
jl 0x51f0aa
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, ecx
jne 0x51f0b0
xor eax, eax
push eax
mov ecx, esi
call fcn.0051efc0
pop edi
pop esi
ret 0xc
test eax, eax
je 0x51f0c6
mov eax, dword [eax + 0x14]
jmp 0x51f0cc
mov eax, dword [esi + 0xd8]
dec eax
test eax, eax
jge 0x51f0e9
mov eax, dword [esi + 0x104]
test eax, eax
je 0x51f0f4
dec eax
mov ecx, esi
push eax
call fcn.0051efc0
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jne 0x51f0fb
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, 0x25
jne 0x51f15d
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x51f221
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x51f221
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
test ecx, ecx
lea eax, [ecx - 1]
jg 0x51f13a
lea eax, [edi - 1]
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x51f150
mov eax, ecx
push eax
mov ecx, esi
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, 0x27
jne 0x51f1b4
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x51f221
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x51f221
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
dec edi
cmp ecx, edi
jge 0x51f18f
lea eax, [ecx + 1]
jmp 0x51f191
xor eax, eax
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x51f1a7
mov eax, ecx
push eax
mov ecx, esi
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, 0x28
jne 0x51f1e8
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x51f1c9
mov eax, dword [eax + 0x14]
inc eax
jmp 0x51f1cb
xor eax, eax
mov ecx, dword [esi + 0xd8]
xor edx, edx
cmp eax, ecx
mov ecx, esi
setge dl
dec edx
and edx, eax
push edx
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, 0x26
jne 0x51f213
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x51f1ff
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jge 0x51f206
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.0051efc0
pop edi
pop esi
ret 0xc
cmp eax, 0x10
je 0x51f221
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
ret 0xc
Function at 0x5215b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5efc00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, vtable.CRgn.0
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call esi
push eax
lea ecx, [esp + 0x10]
call fcn.005c9aa6
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
push 0xfffffffffffffffc
lea edx, [esp + 0x18]
push 0xfffffffffffffffc
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x14]
push eax
call esi
push eax
lea ecx, [esp + 8]
call fcn.005c9aa6
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.005c9aa6
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
neg eax
mov edx, dword [esp + 0x10]
push 3
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, vtable.CGdiObject.0
mov dword [esp + 4], esi
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.005c9afd
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call fcn.005c9afd
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x527050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5efffe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005c43c1
xor edi, edi
mov eax, 0xa
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], 0x617ca0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x60f7b0
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov dword [esi + 0x80], eax
mov dword [esi], method.COleControlContainer.virtual_0
mov dword [esi + 0x7c], 1
mov dword [edx], ecx
xor eax, eax
push esi
push 4
mov dword [edx + 4], ecx
mov byte [esp + 0x1c], 2
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea ecx, [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx]
call dword [edx + 0xc4]
mov ecx, dword [esi + 0x80]
mov dword [esi + 0x20], eax
push esi
push 2
mov eax, dword [ecx]
call dword [eax + 0xc4]
cmp eax, edi
je 0x52711b
lea ecx, [eax - 0x1c]
jmp 0x52711d
xor ecx, ecx
mov edx, dword [esi + 0x80]
mov dword [esi + 0x1c], ecx
mov eax, dword [edx + 0x80]
mov edx, dword [esi + 0x20]
push eax
push 1
push edx
call fcn.005339c0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x529090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f01c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x60f7b0
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xa
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push edi
mov eax, dword [ecx]
mov dword [esp + 0x3c], edi
call dword [eax + 0xc]
cmp dword [esp + 0x1c], edi
jne 0x529111
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 1
cmp eax, edi
je 0x529214
mov eax, dword [eax]
cmp eax, edi
jne 0x529106
jmp 0x529214
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x529121
add eax, 0xffffffe4
jmp 0x529123
xor eax, eax
push eax
mov ecx, ebp
call fcn.00528f10
cmp eax, edi
mov dword [esp + 0x40], eax
je 0x5291fa
cmp dword [eax + 8], edi
je 0x5291fa
mov ecx, dword [esp + 0x3c]
mov esi, dword [ecx + 0x78]
cmp esi, edi
je 0x529191
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x52915b
lea ebx, [eax - 0x3c]
jmp 0x52915d
xor ebx, ebx
lea ecx, [ebx + 0x3c]
call fcn.00582180
cmp eax, edi
je 0x529188
add eax, 0xffffffe4
cmp eax, edi
je 0x529188
push eax
mov ecx, ebp
call fcn.00528f10
cmp eax, edi
je 0x529188
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + 8]
je 0x5291ad
cmp esi, edi
jne 0x52914b
mov ebx, 0x60f7b0
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 4
cmp eax, edi
je 0x529214
mov eax, dword [eax]
cmp eax, edi
jne 0x5291a5
jmp 0x529214
lea ecx, [esp + 0x10]
push 2
push ecx
push ebx
mov ecx, ebp
call fcn.00529020
mov dword [esp + 0x10], 0x60f7b0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
cmp eax, edi
je 0x5291da
mov eax, dword [eax]
cmp eax, edi
jne 0x5291d4
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005bf55a
mov eax, 1
jmp 0x52922f
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 2
cmp eax, edi
je 0x529214
mov eax, dword [eax]
cmp eax, edi
jne 0x52920e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005bf55a
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x52af30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x52afb7
lea edi, [esi + 0xcc]
push 0x11
mov ecx, edi
call fcn.005821c0
test eax, eax
jne 0x52afb7
mov ecx, edi
call fcn.0052f580
mov edi, dword [eax + 0xec]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call fcn.0052a130
test eax, eax
je 0x52af83
add eax, 0x3c
jmp 0x52af85
xor eax, eax
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov ecx, edi
call fcn.00521120
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x53862a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5f0be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esi + 0xe0]
mov ecx, eax
mov eax, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
je 0x538670
mov eax, ebp
sub eax, edi
jmp 0x538672
sub eax, ebx
sub eax, edx
mov edx, dword [esi + 0x214]
dec eax
test ecx, ecx
je 0x538687
push 0
push eax
push 0
push edx
jmp 0x53868d
push eax
push 0
push edx
push 0
lea ecx, [esp + 0x28]
call fcn.005d32f3
mov eax, dword [esi + 0x20]
test eax, eax
je 0x5386b3
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
mov eax, dword [ecx + 0x148]
test eax, eax
jne 0x5386bb
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5386e0
mov eax, dword [esp + 0x4c]
push 0xf
sub eax, ebx
mov ecx, esi
mov ebp, eax
call fcn.00535c90
mov edx, dword [esp + 0x20]
push eax
add edx, 2
push ebp
push edx
jmp 0x5386f5
push 0xf
mov ecx, esi
sub ebp, edi
call fcn.00535c90
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push ebp
push ebx
push edi
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.005d30d5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x53870f
lea ebx, [ecx + 0x3c]
jmp 0x538711
xor ebx, ebx
lea edx, [esp + 0x3c]
push edx
call fcn.00530950
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x3c], 0
sub esp, 0x10
mov eax, esp
push ebx
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.005c4b60
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18
Function at 0x53de00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f11a8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [ebp + 8], 0
call fcn.005c9afd
mov esi, dword [esp + 0x48]
test esi, esi
je 0x53dea7
push edi
mov edi, dword [esp + 0x48]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
pop edi
je 0x53dea7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x53dea7
cmp ebx, 0xa
jb 0x53dea7
push 0
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.005d0fe9
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
mov dword [esp + 0x40], 0
call fcn.0053dec0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.005d1062
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8
Function at 0x54e0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f1c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, 0xaa
mov ecx, 0x55
xor esi, esi
mov word [esp + 0x20], cx
mov word [esp + 0x22], ax
mov word [esp + 0x24], cx
mov word [esp + 0x26], ax
mov word [esp + 0x28], cx
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], vtable.CBitmap.0
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.005c9aa6
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], vtable.CBrush.0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
mov byte [esp + 0x38], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.005c9aa6
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005c909c
mov ebp, dword [esi]
push 0xf
mov ecx, edi
mov ebx, eax
call fcn.004c72d0
push eax
mov ecx, esi
call dword [ebp + 0x2c]
mov edx, dword [esi]
push 0x14
mov ecx, edi
mov ebp, eax
mov dword [esp + 0x44], edx
call fcn.004c72d0
mov edx, dword [esp + 0x40]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edx
sub eax, edi
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call fcn.005c909c
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0x10]
call fcn.005c9afd
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.005c9afd
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 3
call fcn.005c9afd
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x575c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f39b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push 1
lea ecx, [esp + 8]
call fcn.005733f0
mov ecx, dword [esp + 0x48]
lea eax, [esp + 4]
push 0
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov edx, esp
mov dword [esp + 0x4c], 0
mov dword [edx], eax
mov eax, dword [esp + 0x5c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.00575e30
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.00572d60
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0x14

Function at 0x577530
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f3cc8
push eax
mov eax, dword [0x69a3f8]
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov esi, ecx
push eax
call fcn.00573010
xor edi, edi
cmp eax, edi
je 0x57759a
cmp dword [eax + 0x14], 2
jne 0x57759a
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
lea ecx, [esi + 0x50]
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [ecx], edx
mov edx, dword [esp + 0x50]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x54]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x3c
ret 0x10
cmp dword [esi + 0x64], edi
je 0x5775e3
mov eax, dword [esi + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.005759b0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
sub eax, ecx
mov ecx, dword [esp + 0x50]
push eax
sub ecx, edx
mov dword [esp + 0x44], edi
push ecx
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005776a0
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0xffffffff
call fcn.00575ab0
cmp dword [esi + 0x70], edi
jne 0x577600
cmp dword [esi + 0x74], edi
jne 0x577600
lea edx, [esi + 0x50]
lea eax, [esp + 0x48]
push edx
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x57763e
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
mov edx, dword [esi]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], 1
mov dword [eax], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
mov ecx, esi
mov dword [esi + 0x78], edi
call fcn.00576ff0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
lea edx, [esi + 0x50]
mov dword [esi + 0x70], edi
pop edi
pop esi
mov dword [edx], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x4c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x579090
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x5f3dd4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005c43c1
mov eax, dword [0x65290c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x1c], eax
mov ecx, dword [0x65290c]
mov dword [esi + 0x20], ecx
lea edi, [esi + 0x50]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.005c8e51
mov dword [edi], method.CDC.virtual_0
mov dword [edi + 0x10], ebx
lea ebp, [esi + 0x70]
push 0xa
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.005bfcbe
push ebx
push 0xc7
mov ecx, ebp
mov byte [esp + 0x24], 4
mov dword [esi], method.COleControlContainer.virtual_0
call fcn.005bff88
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x4c], ebx
call fcn.005da7f7
mov eax, dword [eax + 8]
push ebx
push ebx
push eax
mov ecx, esi
call fcn.00579980
lea eax, [esi + 0x68]
push eax
push 0x200
push 0x200
push ebx
mov dword [eax], ebx
call fcn.004bea90
add esp, 0x10
mov dword [esi + 0x64], eax
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, edi
call fcn.005c8f08
push ebp
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea edx, [esi + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x579450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3e8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push ecx
lea eax, [esp + 0x30]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x28], ebx
call fcn.005c48d5
push ecx
mov byte [esp + 0x28], 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Images
call fcn.005c4bce
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
push ecx
mov ecx, esi
call fcn.00579e20
mov edx, dword [esp + 8]
mov byte [esp + 0x20], 3
mov eax, dword [edx - 8]
test eax, eax
je 0x5794d2
lea eax, [esp + 8]
lea ecx, [esp + 0x2c]
push eax
call fcn.005c4c99
push 0x5f
push 0x2e
lea ecx, [esp + 0x34]
call fcn.005bcfe2
push 0x5f
push 0x5c
lea ecx, [esp + 0x34]
call fcn.005bcfe2
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.005c48d5
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call fcn.005c4b60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.005c4b60
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 8
Function at 0x579770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f3ef8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
call fcn.005793b0
mov eax, dword [esi + 0x20]
lea ebx, [esi + 0x20]
push str.TEXTFILE
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5797b3
push eax
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
jmp 0x5797d4
mov ecx, dword [esi + 0x24]
push str.OFFICE2007BLUE_INI
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x5797d8
push str.OFFICE2007BLUE_INI
mov ecx, ebx
call fcn.005c4ce9
test edi, edi
jne 0x5797ee
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
jne 0x5797ee
mov eax, dword [esi + 0x24]
mov ecx, esi
push eax
call fcn.005798d0
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x579825
mov ecx, dword [esi + 0x24]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x579825
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esi + 0x24]
push edi
push edx
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esi + 0x28]
mov ebx, 1
add eax, ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x57983c
push 0
push 0
push 0
push 0x294f
call fcn.00581350
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.PremultiplyImages
call fcn.005c4bce
push ecx
mov dword [esp + 0x28], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Global
call fcn.005c4bce
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00579d20
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x4c], eax
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret