joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c6600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70ed90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 3]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, edx
mov esi, ecx
mov byte [esp + 0x1c], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
push 6
push str.frame
push esi
mov dword [esp + 0x50], ebx
call fcn.00662b70
add esp, 0xc
test eax, eax
jne 0x5c6655
xor ebp, ebp
add esi, 6
jmp 0x5c6675
push 7
push str.shadow
push esi
call fcn.00662b70
add esp, 0xc
test eax, eax
jne 0x5c6772
mov ebp, 1
add esi, 7
mov cl, byte [esp + 0x13]
push ebx
mov byte [esp + 0x30], cl
lea ecx, [esp + 0x30]
call fcn.00407e50
mov al, byte [esi]
mov byte [esp + 0x44], 1
cmp al, bl
je 0x5c674c
movsx edx, al
push edx
call fcn.006619fd
add esp, 4
test eax, eax
je 0x5c66b8
movsx eax, byte [esi + 1]
inc esi
push eax
call fcn.006619fd
add esp, 4
test eax, eax
jne 0x5c66a6
cmp byte [esi], bl
je 0x5c674c
mov ecx, dword [0x71eb00]
push ecx
push ebx
lea ecx, [esp + 0x34]
call fcn.00438190
movsx edx, byte [esi]
push edx
call fcn.006619fd
add esp, 4
test eax, eax
jne 0x5c670d
mov al, byte [esi]
cmp al, bl
je 0x5c670d
mov byte [esp + 0x14], al
lea ecx, [esp + 0x2c]
mov eax, dword [esp + 0x14]
push eax
push 1
call fcn.0040cb30
movsx ecx, byte [esi + 1]
inc esi
push ecx
call fcn.006619fd
add esp, 4
test eax, eax
je 0x5c66e1
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x5c671a
mov eax, 0x71eb04
push eax
call fcn.00661b0c
add esp, 4
cmp eax, 1
jl 0x5c6742
dec eax
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push edx
push 1
push eax
lea ecx, [esp + 0x28]
call fcn.0061eb40
mov al, byte [esi]
cmp al, bl
jne 0x5c6696
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x5c6763
mov edx, dword [esp + 0x24]
mov eax, edx
sub eax, ecx
test eax, 0xfffffffc
jne 0x5c6794
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], bl
call fcn.00407e50
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00652870
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov dword [edi], ebp
mov eax, dword [edi + 8]
mov dword [edi + 8], ecx
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 0xc], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x10]
push 1
lea ecx, [esp + 0x30]
mov dword [edi + 0x10], edx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x48], bl
call fcn.00407e50
mov eax, dword [esp + 0x20]
push eax
call fcn.00652870
mov ecx, dword [esp + 0x40]
add esp, 4
mov al, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x5d0510
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x70fbf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
call fcn.005bf580
mov edi, eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], 0x81e44c
call fcn.00660a1c
mov dl, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esp + 0x2c], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x71eb00]
push eax
push ebx
push edi
call fcn.00407c50
mov eax, dword [esp + 0x18]
mov dword [esi], vtable.std::runtime_error.0
cmp eax, ebx
je 0x5d05a3
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5d059a
cmp al, 0xff
je 0x5d059a
dec al
mov byte [ecx], al
jmp 0x5d05a3
push ecx
call fcn.00652870
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.t_constructor_failure_class_t_directory_changer__class_std::runtime_error_.0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x5d2030
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70fd44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x18]
mov dl, byte [esp + 0x18]
mov dword [esi + 8], ecx
mov dword [esp + 0x10], eax
mov byte [esi + 0xc], dl
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov cl, byte [esp + 0x18]
mov dword [esi + 0x24], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov ecx, dword [esi + 8]
mov byte [esp + 0x10], 4
mov dword [esi], vtable.map_renderer_details::t_internal_map_data.0
call fcn.00405870
push eax
mov ecx, esi
call fcn.005dc270
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x5d4a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70fe18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [esp + 0x54]
push esi
mov esi, ecx
mov dword [esp + 0x34], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x2c], vtable.t_bitmap_1d_to_2d_horizontal_adapter_unsigned_char_.0
mov cl, byte [esp + 0x54]
xor eax, eax
neg cl
sbb ecx, ecx
mov dword [esp + 0x48], eax
and ecx, 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
add ecx, 0xffffffe0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
lea eax, [esp + 0x30]
push ecx
push eax
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0x20
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x1c], 0xfffffff1
call fcn.005d45c0
mov ecx, dword [esp + 0x40]
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 0xc
Function at 0x5d5180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x71003f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], 0
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x58]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], eax
call fcn.00493040
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x70], 1
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
cmp eax, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x7c], eax
je 0x5d5308
mov ebx, dword [eax + 4]
mov edi, dword [eax]
mov edx, ebx
mov eax, edi
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esi + 0x24]
call fcn.00405bf0
mov edx, dword [esi + 0x50]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x4c]
sub ebp, edx
sub esp, 0xc
mov dword [esp + 0x30], ebp
mov ebp, esp
sub eax, ecx
mov ecx, dword [esi + 0x24]
mov dword [ebp], edi
sub eax, 0x20
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x48]
mov edx, dword [ecx]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], eax
lea eax, [esp + 0x34]
push eax
call dword [edx + 0x40]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
xor ecx, ecx
mov cx, word [edx]
mov ebx, dword [esp + 0x30]
mov edx, ecx
mov ecx, eax
sub ecx, edx
xor edx, edx
mov dx, word [edi]
mov ebp, dword [esp + 0x34]
mov edi, edx
mov edx, eax
sub edx, edi
xor edi, edi
mov di, word [ebx]
add ecx, 0x10
mov ebx, edi
mov edi, eax
sub edi, ebx
xor ebx, ebx
mov bx, word [ebp]
add edi, 0x10
sub eax, ebx
add eax, 0x20
cmp ecx, edx
jge 0x5d5280
mov edx, ecx
jmp 0x5d5286
cmp ecx, eax
jle 0x5d5286
mov eax, ecx
cmp edi, edx
jge 0x5d528e
mov edx, edi
jmp 0x5d5294
cmp edi, eax
jle 0x5d5294
mov eax, edi
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
cmp ebx, edi
lea ecx, [ebx + 0x40]
jge 0x5d52f1
test ecx, ecx
jle 0x5d52f1
mov ebp, dword [esp + 0x14]
cmp edx, ebp
jge 0x5d52f1
test eax, eax
jle 0x5d52f1
cmp eax, ebp
jge 0x5d52b9
mov ebp, eax
cmp ecx, edi
jge 0x5d52bf
mov edi, ecx
xor ecx, ecx
lea eax, [esp + 0x38]
test edx, edx
setle cl
dec ecx
push eax
and ecx, edx
xor edx, edx
test ebx, ebx
setle dl
dec edx
mov dword [esp + 0x40], ecx
and edx, ebx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebp
call fcn.004941b0
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x18]
add eax, 8
cmp eax, ecx
mov dword [esp + 0x7c], eax
jne 0x5d51df
mov esi, dword [esp + 0x78]
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.00493100
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], 0
call fcn.00493530
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret 8
Function at 0x5d7f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x710093
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x5c]
call fcn.00562c40
lea ecx, [esi + 0x178]
mov edi, eax
call fcn.00432fa0
mov edx, dword [esi + 0x24]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [esp + 0x2c], ecx
mov dword [ecx], edx
mov dword [ecx + 8], eax
mov al, byte [esp + 0x5c]
lea edx, [ecx + 0xc]
mov dword [ecx + 4], edi
mov byte [edx], al
xor eax, eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x54], eax
mov eax, dword [ecx + 0x34]
lea ecx, [eax + 1]
call fcn.00605420
mov edi, dword [esp + 0x5c]
lea edx, [esp + 0x34]
push edx
mov ecx, edi
mov dword [esp + 0x58], 0xffffffff
call fcn.00416420
push eax
lea eax, [esi + 0x4c]
push eax
mov edx, edi
lea ecx, [esp + 0x44]
call fcn.00407020
mov ebx, dword [esi + 0x48]
push esi
lea ecx, [esp + 0x38]
mov edi, eax
call fcn.00547520
mov ecx, dword [eax]
mov edx, edi
push ecx
mov ecx, ebx
call fcn.005e11d0
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 4
Function at 0x5d9519
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x710128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x34]
call fcn.00493040
mov eax, dword [esp + 0x64]
mov dword [esp + 0x5c], 0
mov ebx, dword [eax + 4]
mov ecx, dword [eax + 8]
cmp ebx, ecx
je 0x5d9627
push ebp
mov eax, dword [ebx]
mov ecx, esi
push eax
call fcn.005da1c0
mov dl, byte [esi + 0x34]
mov ecx, dword [ebx]
mov edi, dword [esi + 0x3c]
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 0x14]
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x38]
push edx
mov edx, edi
call fcn.0061eec0
cmp eax, edi
je 0x5d957f
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
cmp ecx, edx
jl 0x5d9581
mov edi, eax
cmp edi, dword [esi + 0x3c]
jne 0x5d9590
mov dword [esp + 0x14], 0
jmp 0x5d9597
mov edx, dword [esi + 0x30]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x10c]
mov ebp, dword [ebx]
cmp eax, 6
je 0x5d9616
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x1c]
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x48]
cmp eax, ecx
jne 0x5d9616
mov ecx, dword [esi + 0x24]
push ebp
mov edx, dword [ecx]
call dword [edx + 0x14]
mov ecx, dword [esi + 0x10c]
mov edi, eax
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x60]
test al, al
je 0x5d9616
mov ecx, dword [esi + 0x24]
push ebp
call fcn.00405880
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x38]
mov dword [esp + 0x34], edx
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
push edi
mov ecx, esi
call fcn.005d8a20
mov eax, dword [esp + 0x68]
add ebx, 4
cmp ebx, dword [eax + 8]
jne 0x5d9541
pop ebp
mov ecx, dword [esp + 0x68]
mov eax, dword [esi + 0x48]
cmp ecx, eax
jne 0x5d9666
mov edi, dword [esp + 0x78]
mov ecx, esi
push edi
call fcn.005da540
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x70]
push eax
push ecx
push edx
mov ecx, esi
call fcn.005d9b30
lea eax, [esp + 0x34]
mov ecx, esi
push eax
push edi
call fcn.005d86a0
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005d5630
lea ecx, [esp + 0x34]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00493530
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 0x18
Function at 0x5dc0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x710318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [edi + 0x28]
xor esi, esi
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
call fcn.00652870
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x30], esi
mov eax, dword [edi + 0x1c]
add esp, 4
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
mov ebx, dword [edi + 0x1c]
cmp dword [ebx], esi
jne 0x5dc194
cmp ebx, esi
je 0x5dc194
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
lea esi, [ebx + 4]
push ebp
push eax
push ecx
mov ecx, esi
call fcn.004d1a20
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
mov ecx, esi
shr eax, 0x1f
add edx, eax
push edx
push ebp
call fcn.00435290
xor eax, eax
push ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00652870
add esp, 4
mov dword [edi], vtable.t_counted_object.0
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov dword [edi], vtable.t_counted_object.0
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5e4e28
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71061b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esp + 0x14], 0
call fcn.006dcb22
mov cl, byte [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub esp, 8
mov byte [esp + 0x1c], 1
mov eax, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 0
mov byte [eax], cl
lea ecx, [esi + 0x30]
mov dword [eax + 4], edx
call fcn.004222f0
mov dword [esi], vtable.t_adv_object_data_source.2.0
mov ax, word [0x847540]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.006dcd35
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8
Function at 0x5e56f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7106a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], edx
mov esi, ecx
xor edx, edx
xor ecx, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
mov byte [esp + 0x20], al
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], edx
mov edi, dword [ebp]
mov ebx, dword [ebp + 4]
add edi, dword [eax]
add ebx, dword [eax + 4]
mov eax, dword [ebp + 4]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jge 0x5e57ee
mov edx, dword [ebp]
cmp edx, edi
mov dword [esp + 0x18], edx
jge 0x5e57df
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.00405ad0
test al, al
je 0x5e57c6
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x30]
push eax
call fcn.0046ffb0
mov esi, eax
cmp esi, dword [esp + 0x28]
je 0x5e57a9
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.004052d0
test al, al
je 0x5e57c6
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x18]
sub esi, eax
push ecx
sar esi, 3
push 1
lea ecx, [esp + 0x28]
lea edx, [eax + esi*8]
push edx
call fcn.005df630
mov eax, dword [esp + 0x18]
inc eax
cmp eax, edi
mov dword [esp + 0x18], eax
jl 0x5e5767
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
inc eax
cmp eax, ebx
mov dword [esp + 0x1c], eax
jl 0x5e575c
xor edx, edx
mov al, byte [esp + 0x20]
mov byte [esi], al
mov eax, dword [esp + 0x24]
cmp eax, edx
jne 0x5e5800
xor ecx, ecx
jmp 0x5e5805
sub ecx, eax
sar ecx, 3
cmp ecx, edx
mov eax, ecx
jge 0x5e580d
xor eax, eax
lea ecx, [eax*8]
push ecx
call fcn.00652710
mov edx, dword [esp + 0x2c]
add esp, 4
mov dword [esi + 4], eax
mov ecx, esi
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.0045ded0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00652870
mov ecx, dword [esp + 0x34]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
Function at 0x5e8990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x710a80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, ecx
push ebp
push esi
push edi
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x7c]
lea edx, [esp + 0x2c]
push eax
push edx
call fcn.005dc900
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], vtable.CPen.0
push 6
mov dword [esp + 0x48], 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov ecx, esi
push eax
mov dword [esp + 0x18], esi
call fcn.006c6b4d
mov edi, eax
mov dword [esp + 0x18], edi
push 7
mov ecx, esi
mov byte [esp + 0x48], 1
mov dword [esp + 0x20], esi
call fcn.006c6bf0
mov ebp, eax
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x50], 2
call fcn.006c6feb
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
dec edx
push ecx
push edx
mov ecx, esi
call fcn.006c7037
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
dec eax
dec ecx
push eax
push ecx
mov ecx, esi
call fcn.006c7037
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
dec edx
mov ecx, esi
push edx
push eax
call fcn.006c7037
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov ecx, esi
call fcn.006c7037
push ebp
mov ecx, esi
mov byte [esp + 0x48], 1
call fcn.006c6bf0
push edi
mov ecx, esi
mov byte [esp + 0x48], 0
call fcn.006c6b4d
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 3
call fcn.006c7566
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x5ea570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x710c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x3c]
xor ebx, ebx
mov dword [esp + 0x30], ebx
call fcn.005dc9d0
mov edi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax + 4]
mov eax, dword [edx + eax + 4]
call dword [eax + 0x30]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x14], edi
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test al, al
je 0x5ea6a2
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 0x2c]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.005e8ac0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, esi
call fcn.005e7650
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push edi
push edx
lea eax, [esp + 0x44]
sub esp, 8
mov byte [esp + 0x44], 1
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004f6600
mov ecx, dword [esi + 0x28]
push ecx
mov ecx, dword [esi + 0x24]
call fcn.00466e90
mov edi, eax
mov eax, dword [esp + 0x1c]
push eax
lea edx, [esp + 0x44]
mov ecx, dword [eax]
mov byte [esp + 0x34], bl
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.005ef350
mov eax, dword [esp + 0x1c]
push eax
call fcn.00652870
add esp, 4
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
xor esi, esi
call fcn.006747e8
mov eax, dword [0x847584]
dec eax
mov dword [0x847584], eax
jne 0x5ea68a
mov esi, dword [0x81de4c]
mov dword [0x81de4c], ebx
lea ecx, [esp + 0x40]
call fcn.00674884
cmp esi, ebx
je 0x5ea6c8
push esi
call fcn.00652870
add esp, 4
jmp 0x5ea6c8
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
sub esp, 8
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.004f6600
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push eax
call fcn.00466d20
mov edi, eax
mov al, byte [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
cmp al, bl
je 0x5ea6f2
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x5ea6f2
mov ecx, dword [eax + 4]
push 1
mov edx, dword [ecx + 4]
lea ecx, [edx + eax + 4]
mov eax, dword [edx + eax + 4]
call dword [eax]
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 0xc
Function at 0x5f9c70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, dword [edx + 4]
sub esp, 0x1c
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
jne 0x5f9c14
mov eax, 0x71eb04
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [edi + 0x1c]
push 0
push 0x143
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x5f9c50
cmp esi, 0xfffffffe
je 0x5f9c50
mov ecx, dword [esp + 0x2c]
mov edx, dword [edi + 0x1c]
push ecx
push esi
push 0x151
push edx
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
lea ecx, [esp + 0xc]
call 0x5f9c70
lea eax, [esp + 0xc]
push 0x7c76c8
push eax
call fcn.006609b5
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
push 0x711b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov edx, 0x81e44c
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
call fcn.005f9a50
mov edi, eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], 0x81e44c
call fcn.00660a1c
mov dl, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esp + 0x2c], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x71eb00]
push eax
push ebx
push edi
call fcn.00407c50
mov eax, dword [esp + 0x18]
mov dword [esi], vtable.std::runtime_error.0
cmp eax, ebx
je 0x5f9d08
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5f9cff
cmp al, 0xff
je 0x5f9cff
dec al
mov byte [ecx], al
jmp 0x5f9d08
push ecx
call fcn.00652870
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.t_mfc_control_item_insert_failure_class_CComboBox_.0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x5fa210
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x711bd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov edx, 0x81e44c
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
call fcn.005f9a50
mov edi, eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], 0x81e44c
call fcn.00660a1c
mov dl, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esp + 0x2c], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x71eb00]
push eax
push ebx
push edi
call fcn.00407c50
mov eax, dword [esp + 0x18]
mov dword [esi], vtable.std::runtime_error.0
cmp eax, ebx
je 0x5fa2a8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5fa29f
cmp al, 0xff
je 0x5fa29f
dec al
mov byte [ecx], al
jmp 0x5fa2a8
push ecx
call fcn.00652870
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.t_mfc_control_item_insert_failure_class_CListBox_.0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret