joyce8/EMBER2024-capa huggingface dataset:
Function at 0x568170
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
call fcn.00568150
mov ecx, esi
call fcn.00568140
lea eax, [esp + 4]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x5681be
xor al, al
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.006108ae
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
mov al, 1
mov byte [esi + 4], al
pop esi
xor ecx, esp
call fcn.006108ae
add esp, 0x194
ret

Function at 0x568d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6653cf
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00558a60
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esi + 4], vtable.CLightBase.0
mov eax, esi
mov dword [esi + 8], vtable.CSingleton_class_CLightManager_.0
mov dword [0x7464fc], eax
push 4
mov byte [esp + 0x30], 2
mov dword [esi], vtable.CLightManager.2.0
mov dword [esi + 4], vtable.CLightManager.1.0
mov dword [esi + 8], vtable.CLightManager.0
lea edi, [esi + 0xc]
call fcn.00610463
add esp, 4
cmp eax, ebx
je 0x568dba
mov dword [eax], edi
jmp 0x568dbc
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
lea edx, [esp + 0x13]
push edx
lea eax, [esp + 0x17]
mov ebx, 3
lea ecx, [esi + 0x2c]
push eax
mov byte [esp + 0x34], bl
call fcn.005a9ba0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x2c], 4
call fcn.00577e00
lea ecx, [esi + 0x78]
mov byte [esp + 0x2c], 5
call fcn.00568890
fldz
fst dword [esp + 0x18]
mov dword [esi + 0x70], ebx
mov ecx, dword [esp + 0x18]
fst dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
fstp dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x5691e0
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 4]
mov byte [ecx + 0x19], al
test al, al
je 0x5691fa
mov eax, dword [ecx + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov ecx, dword [ecx + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4

Function at 0x56a5a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov eax, dword [0x747a24]
push esi
push 0
push 0
push 0
push 0
push eax
push 0x747a28
mov esi, ecx
mov ecx, dword [0x748244]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, dword [esi + 8]
jl 0x56a5e8
mov edx, dword [esp + 8]
push 0
push 4
push 0x15
push edx
call sub.IMM32.dll_ImmNotifyIME
mov dword [0x74822c], 0
pop esi
ret 4
mov eax, dword [esp + 8]
push 0x800
add esi, 0x2e
push esi
push 8
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
shr eax, 1
mov dword [0x74822c], eax
pop esi
ret 4
Function at 0x56a610
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x404
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push esi
push 0x400
lea ecx, [esp + 8]
push ecx
push 0x10
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x56a657
mov al, byte [esp + ecx + 4]
cmp al, 1
je 0x56a657
cmp al, 3
je 0x56a657
inc ecx
cmp ecx, esi
jl 0x56a646
cmp ecx, esi
mov edx, ecx
jge 0x56a66c
mov al, byte [esp + ecx + 4]
cmp byte [esp + edx + 4], al
jne 0x56a66c
inc edx
cmp edx, esi
jl 0x56a661
mov dword [0x746530], ecx
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
mov dword [0x74652c], edx
call fcn.006108ae
add esp, 0x404
ret 4
Function at 0x56a910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x114], eax
mov ecx, dword [0x747a04]
cmp ecx, 0xe00e0804
je 0x56aa57
cmp ecx, 0xe0090404
je 0x56aa57
mov eax, dword [0x748238]
test eax, eax
je 0x56aa57
push ebx
mov edx, 0x404
xor bl, bl
cmp cx, dx
jne 0x56aa6e
push ebp
push esi
push edi
mov ecx, 0xa
mov esi, str.softwaremicrosoftwindowscurrentversion_
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
and eax, 0xffff0000
movsw word es:[edi], word [esi]
mov ebp, eax
movsb byte es:[edi], byte [esi]
mov eax, str.MSTCIPH
cmp ebp, 0x5010000
jae 0x56a98f
mov eax, str.TINTLGNT
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x56a991
lea edi, [esp + 0x20]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x56a9a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x2c]
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x56aa3c
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Keyboard_Mapping
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x56aa31
mov al, byte [esp + 0x14]
cmp ebp, 0x5000000
ja 0x56aa19
cmp al, 0x22
je 0x56aa2f
cmp al, 0x23
je 0x56aa2f
cmp ebp, 0x5010000
je 0x56aa29
cmp ebp, 0x5020000
jne 0x56aa31
sub al, 0x22
cmp al, 2
ja 0x56aa31
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.006108ae
add esp, 0x118
ret
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.006108ae
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
mov al, bl
pop ebx
xor ecx, esp
call fcn.006108ae
add esp, 0x118
ret
Function at 0x56ac50
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x18
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x747a04], eax
cmp dword [0x74828c], eax
je 0x56ad9a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 8
lea ecx, [esp + 0x14]
push ecx
movzx edx, ax
push 0x1004
push edx
mov dword [0x74828c], eax
call esi
lea edx, [esp + 0x10]
call fcn.0056abc0
mov dword [0x748248], eax
cmp dword [0x6ebbe4], eax
je 0x56ad99
push 0x747964
mov dword [0x6ebbe4], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
movzx ecx, word [0x747a04]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
je 0x56ad03
sub eax, 0xd
je 0x56acf0
sub eax, 1
jne case.default.0x56ad15
mov byte [0x74653e], al
mov dword [0x746538], 0x6ebbc6
jmp 0x56ad7c
mov byte [0x74653e], 1
mov dword [0x746538], 0x6ebbcc
jmp 0x56ad7c
mov eax, ecx
shr eax, 0xa
dec eax
mov byte [0x74653e], 1
cmp eax, 4
ja case.default.0x56ad15
jmp dword [eax*4 + 0x56adac]
mov byte [0x74653e], 0
mov dword [0x746538], 0x6ebbba
jmp 0x56ad7c
mov dword [0x746538], 0x6ebbc0
jmp 0x56ad7c
push 0xa
lea edx, [esp + 8]
push edx
push 3
push ecx
mov dword [0x746538], 0x6ebbb4
call esi
movsx ax, byte [esp + 4]
mov ecx, dword [0x746538]
mov word [ecx], ax
movsx dx, byte [esp + 5]
movzx eax, dx
push eax
call fcn.0061701a
mov ecx, dword [0x746538]
add esp, 4
mov word [ecx + 2], ax
cmp dword [0x748244], 0x4e8
je 0x56ad99
mov edx, dword [0x748248]
mov dword [0x748244], edx
call fcn.0056a170
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.006108ae
add esp, 0x18
ret
Function at 0x56bd10
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x10c
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x108], eax
cmp byte [0x748230], 0
mov eax, dword [esp + 0x110]
push edi
mov edi, ecx
jne 0x56bee3
cmp byte [0x748274], 0
mov dword [0x747a08], eax
jne 0x56bd77
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x56bd77
push 0x748270
push 0x68a7f4
push 1
push 0
push 0x6a3608
mov byte [0x748274], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x747970
mov dword [0x747970], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x105
lea eax, [esp + 8]
push eax
mov byte [0x748231], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x56be5d
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x56bdb0
mov ecx, dword [str.imm32.dll]
mov edx, dword [0x68aa44]
mov dword [eax], ecx
mov cx, word [0x68aa48]
mov dword [eax + 4], edx
mov dl, byte [0x68aa4a]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x747960], eax
test eax, eax
je 0x56be56
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
mov ecx, dword [0x747960]
push str.ImmUnlockIMC
push ecx
mov dword [0x747a20], eax
call esi
mov edx, dword [0x747960]
push str.ImmLockIMCC
push edx
mov dword [0x747a1c], eax
call esi
mov dword [0x747a18], eax
mov eax, dword [0x747960]
push str.ImmUnlockIMCC
push eax
call esi
mov ecx, dword [0x747960]
push str.ImmDisableTextFrameService
push ecx
mov dword [0x747a14], eax
call esi
pop esi
test eax, eax
je 0x56be5d
push 0xffffffffffffffff
call eax
jmp 0x56be5d
mov byte [0x748231], 1
mov edx, dword [0x747a08]
push edx
mov byte [0x748230], 1
call sub.IMM32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
mov eax, dword [0x747a08]
push eax
call sub.IMM32.dll_ImmReleaseContext
call fcn.0056ac50
call fcn.0056b690
push 2
call fcn.0056b6c0
add esp, 4
call fcn.0056bbc0
test eax, eax
setne cl
mov byte [0x748233], cl
call fcn.0056adc0
cmp byte [0x748233], 0
je 0x56bee3
mov edx, dword [0x747a04]
and edx, 0x3ff
cmp edx, 4
jne 0x56bed2
call fcn.0056b1b0
mov byte [0x748235], 1
test eax, eax
jne 0x56bed9
mov byte [0x748235], 0
push 0
call fcn.0056b880
add esp, 4
mov ecx, dword [esp + 0x10c]
pop edi
xor ecx, esp
mov al, 1
call fcn.006108ae
add esp, 0x10c
ret 4

Function at 0x56c1e0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x804
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
push 0x800
mov esi, ecx
lea ecx, [esp + 8]
push ecx
push 0x800
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
shr eax, 1
test eax, eax
jle 0x56c226
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0056c110
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.006108ae
add esp, 0x804
ret 4
Function at 0x56c780
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x6654eb
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
mov ebp, ecx
cmp byte [ebp + 0x2c], 0
je 0x56c8a1
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x56c8a1
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x56c801
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00416f50
push esi
mov dword [esp + 0x83c], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x56c843
cmp dword [esp + 0x28], 0x10
jb 0x56c8a1
mov eax, dword [esp + 0x14]
push eax
jmp 0x56c899
mov ecx, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x56c856
lea ecx, [esp + 0x14]
push 0x400
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [0x748248]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.0056c110
mov ecx, dword [0x746534]
test ecx, ecx
je 0x56c88e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x28], esi
jb 0x56c8a1
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00610458
add esp, 4
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.006108ae
add esp, 0x82c
ret

Function at 0x56c8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665528
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0056c390
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.0056c670
cmp dword [esp + 0x24], 0x10
jb 0x56c96a
mov edx, dword [esp + 0x10]
push edx
call fcn.00610458
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006108ae
add esp, 0x30
ret 0x1c
Function at 0x572a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6659f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00566d80
xor eax, eax
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.00572980
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x572a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6659f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esp + 0x14], 1
call fcn.005729b0
cmp dword [esi + 0x34], 0x10
jb 0x572add
mov eax, dword [esi + 0x20]
push eax
call fcn.00610458
add esp, 4
xor eax, eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov ecx, esi
mov byte [esi + 0x20], al
mov dword [esp + 0x14], 0xffffffff
call fcn.00566da0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x572b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x668a08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.00567460
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CGraphicImage.0
call fcn.00572a20
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x78], ecx
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x572ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6660b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImage.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00572a90
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.005673d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x572ee0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x572ef7
xor al, al
pop esi
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov al, 1
pop esi
ret 4
Function at 0x574c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665b13
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.00567460
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CAttributeData.0
call fcn.00577e00
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.00577e00
fldz
fstp dword [esi + 0x30]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x57aac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665de3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 1
call fcn.00577e00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x57f540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6660b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.00567460
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CGraphicText.0
call fcn.0057f300
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x57f5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6660b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicText.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0057ee80
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.005673d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x57faf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x666170
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, 7
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], esi
mov word [esp + 0x48], cx
xor edx, edx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], dx
mov ebp, dword [esp + 0x78]
xor bl, bl
cmp ebp, esi
mov byte [esp + 0x6c], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
jle 0x57fc1c
mov eax, dword [esp + 0x20]
lea edi, [eax + esi*2]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
mov eax, ebp
sub eax, esi
push eax
push edi
call fcn.0057f930
add esp, 0x10
cmp eax, 2
jne 0x57fb9e
mov bl, 1
mov dword [esp + 0x14], esi
jmp 0x57fbfa
cmp eax, 5
jne 0x57fba7
xor bl, bl
jmp 0x57fbfa
test eax, eax
je 0x57fbce
cmp eax, 1
je 0x57fbce
cmp eax, 3
jne 0x57fbbf
mov dword [esp + 0x18], 1
jmp 0x57fbfa
cmp eax, 4
jne 0x57fbfa
mov dword [esp + 0x18], 0
jmp 0x57fbfa
cmp dword [esp + 0x18], 0
jne 0x57fbfa
test bl, bl
jne 0x57fbdd
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x7c]
cmp ecx, dword [esp + 0x1c]
jle 0x57fc66
movzx edx, word [edi]
inc dword [esp + 0x1c]
push edx
push 1
lea ecx, [esp + 0x4c]
call fcn.0055ed40
add esi, dword [esp + 0x24]
cmp esi, ebp
jl 0x57fb72
cmp dword [esp + 0x40], 8
jb 0x57fc1a
mov eax, dword [esp + 0x2c]
push eax
call fcn.00610458
add esp, 4
xor esi, esi
xor ecx, ecx
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], cx
mov dword [esp + 0x40], 7
jb 0x57fc43
mov edx, dword [esp + 0x48]
push edx
call fcn.00610458
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.006108ae
add esp, 0x5c
ret
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x57fc7e
mov eax, dword [esp + 0x2c]
push eax
call fcn.00610458
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x5c], esi
mov dword [esp + 0x3c], 0
jmp 0x57fc27
Function at 0x584790
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x584837
cmp byte [edi], 0
je 0x584837
mov eax, edi
lea edx, [eax + 1]
jmp 0x5847b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5847b0
sub eax, edx
cmp eax, 3
jb 0x5847c7
cmp byte [edi + 1], 0x3a
jne 0x5847c7
add edi, 3
mov eax, edi
mov dword [esp + 8], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5847d0
push ebp
sub eax, edx
lea ebp, [eax + 1]
push esi
push ebp
call fcn.0060f23e
add esp, 4
cmp byte [edi], 0
mov esi, eax
je 0x58482c
push ebx
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov al, byte [eax]
cmp al, 0x2f
je 0x5847ff
cmp al, 0x5c
jne 0x58481c
push ebp
push 0
push esi
call fcn.0060fff0
push ebx
push edi
push esi
call fcn.00613220
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x14]
inc eax
inc ebx
cmp byte [eax], 0
mov dword [esp + 0x14], eax
jne 0x5847f1
pop ebx
push esi
call fcn.00613489
add esp, 4
pop esi
pop ebp
pop edi
ret