joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6033d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004dd8e0
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CRealMediaSourceFilter.14.0
mov dword [esi + 0xc], vtable.CRealMediaSourceFilter.13.0
mov dword [esi + 0x10], vtable.CRealMediaSourceFilter.12.0
mov dword [esi + 0x50], vtable.CRealMediaSourceFilter.11.0
mov dword [esi + 0x54], vtable.CRealMediaSourceFilter.10.0
mov dword [esi + 0x64], vtable.CRealMediaSourceFilter.9.0
mov dword [esi + 0x78], vtable.CRealMediaSourceFilter.8.0
mov dword [esi + 0x90], vtable.CRealMediaSourceFilter.7.0
mov dword [esi + 0xd8], vtable.CRealMediaSourceFilter.6.0
mov dword [esi + 0xdc], vtable.CRealMediaSourceFilter.5.0
mov dword [esi + 0xe0], vtable.CRealMediaSourceFilter.4.0
mov dword [esi + 0xe4], vtable.CRealMediaSourceFilter.3.0
mov dword [esi + 0xe8], vtable.CRealMediaSourceFilter.2.0
mov dword [esi + 0xec], vtable.CRealMediaSourceFilter.1.0
mov dword [esi + 0xf0], vtable.CRealMediaSourceFilter.0
mov edx, dword [0x62c970]
mov dword [esi + 0x28], edx
mov eax, dword [0x62c974]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x62c978]
mov dword [esi + 0x30], ecx
mov edx, dword [0x62c97c]
mov dword [esi + 0x34], edx
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x4dddd7
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov dword [esi + 0x1bc], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x4f6250
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
lea ecx, [eax + esi]
xor eax, eax
cmp esi, edx
jae 0x4f627d
sub edx, esi
mov esi, edx
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x6c9210]
add ecx, 1
sub esi, 1
jne 0x4f6260
pop esi
ret
Function at 0x4f7336
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x6f1550]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
or ebx, 0xffffffff
cmp eax, ebx
push edi
mov edi, dword [esp + 0x54]
je 0x4f734e
push eax
call ebp
mov dword [esi + 0x1c], ebx
push edi
lea ecx, [esp + 0x1c]
call fcn.00418ef0
mov eax, dword [eax]
xor edi, edi
push edi
push 0x8000001
push 3
push edi
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f7395
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x4f7463
push edi
lea ecx, [esp + 0x20]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f745a
cmp dword [esp + 0x20], 0x46464952
jne 0x4f745a
cmp dword [esp + 0x28], 0x41584443
jne 0x4f745a
mov eax, dword [esp + 0x48]
add eax, 0x24
cmp dword [esp + 0x24], eax
jne 0x4f745a
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
push edi
mov dword [esp + 0x14], eax
sub eax, 0x2c
push 0x930
sbb ecx, edi
push ecx
push eax
call fcn.005bf9a0
imul eax, eax, 0x914
cdq
mov ecx, esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.004f67b0
test al, al
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
jne 0x4f7440
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
push edx
jmp 0x4f745e
pop edi
mov dword [esi + 0x34], ebx
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005bf6a4
add esp, 0x40
ret 4
mov eax, dword [esi + 0x1c]
push eax
call ebp
mov dword [esi + 0x1c], ebx
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.005bf6a4
add esp, 0x40
ret 4
Function at 0x4f8bc0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, byte [ecx]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
movzx ebp, byte [esi + 0x55]
push edi
movzx edi, byte [esi + 0x54]
xor edi, eax
movzx eax, byte [ecx + 1]
xor ebp, eax
mov eax, dword [esi + 0x56]
xor eax, dword [ecx + 2]
lea edx, [esi + 0x800]
lea ecx, [eax + eax + 8]
and eax, 7
add esi, 0x80
or edi, 0x100
sub ecx, eax
xor ebx, ebx
cmp esi, edx
mov dword [esp + 0x14], edx
je 0x4f8c77
lea ebx, [ebx]
movzx eax, byte [edi + 0x6c98b0]
movzx edx, byte [ebp + 0x6c97b0]
xor edx, eax
mov eax, edi
shr eax, 1
mov ebp, eax
mov eax, ecx
shr eax, 3
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 8
xor eax, ecx
and edi, 1
shr eax, 5
shl edi, 8
xor edi, edx
movzx edx, byte [edx + 0x6c9bb0]
and eax, 0xff
shl ecx, 8
or ecx, eax
movzx eax, byte [eax + 0x6c9ab0]
add edx, ebx
lea ebx, [edx + eax]
movzx eax, byte [esi]
mov dl, byte [eax + str.3s_ckv_6n.f]
xor dl, bl
mov byte [esi], dl
add esi, 1
shr ebx, 8
cmp esi, dword [esp + 0x14]
jne 0x4f8c10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4f92e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
movzx ecx, byte [eax + 2]
xor edx, edx
mov dh, byte [eax]
add dword [esp + 8], 1
push ebx
push ebp
push esi
push edi
movzx edi, byte [eax + 3]
mov dl, byte [eax + 1]
movzx eax, byte [eax + 4]
mov esi, ecx
and esi, 0xfffffffc
shl edi, 9
shl edx, 8
or edx, esi
or edx, 4
add edx, edx
and ecx, 7
or edi, eax
or edx, ecx
or edi, 0x100
mov esi, edx
xor bl, bl
xor ebp, ebp
mov byte [esp + 0x13], 0
mov eax, esi
shr eax, 0x18
mov ecx, esi
shr ecx, 0x15
xor al, cl
mov edx, esi
shr edx, 0x14
xor al, dl
mov ecx, esi
shr ecx, 0xc
xor al, cl
and al, 1
movzx edx, al
add esi, esi
or esi, edx
mov edx, edi
shr edx, 0x10
mov ecx, edi
shr ecx, 2
xor dl, cl
and dl, 1
movzx ecx, dl
add edi, edi
or edi, ecx
test dl, dl
sete dl
test al, al
sete al
add dl, al
add dl, bl
mov cl, dl
shr cl, 1
and cl, 1
mov bl, cl
and dl, 1
mov ecx, ebp
shl dl, cl
add ebp, 1
or byte [esp + 0x13], dl
cmp ebp, 8
jl 0x4f9327
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
sub eax, 1
mov dword [esp + 0x18], eax
mov byte [eax], dl
mov eax, dword [esp + 0x1c]
sub eax, 1
test eax, eax
mov dword [esp + 0x1c], eax
jg 0x4f9320
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4f9d50
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
push 0
push 0x800
push ecx
push eax
mov dword [edx], 0x800
call fcn.005bf9a0
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov al, 1
add esp, 8
ret
Function at 0x4f9d90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
imul esi, ebx
push 0
push 0
push esi
push ebp
mov edi, eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, eax
jne 0x4f9ddc
mov ecx, dword [esp + 0x18]
imul edi, ebx
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f9ddc
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x507580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x144]
call edx
mov eax, dword [esi + 0x70]
test eax, eax
je 0x50762b
mov edx, dword [esi + 0x74]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
fld dword [esi + 0x78]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push ecx
fstp dword [esp]
push eax
call edx
fld dword [esi + 0x7c]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push ecx
fstp dword [esp]
push eax
call edx
fld dword [esi + 0x80]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ecx
fstp dword [esp]
push eax
call edx
fld dword [esi + 0x84]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push ecx
fstp dword [esp]
push eax
call edx
movzx edx, byte [esi + 0x8a]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
movzx edx, byte [esi + 0x88]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
movzx edx, byte [esi + 0x89]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov al, 1
pop esi
ret
Function at 0x5186e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lea ecx, [eax + ecx - 1]
cmp eax, ecx
jae 0x5186ff
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x5186e8
ret

Function at 0x520fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x607f80
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov edi, dword [ecx + 0x54]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x40], 0x80004001
je 0x5210e8
xor eax, eax
cmp edi, ebx
setne al
cmp eax, ebx
je 0x521101
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
mov dword [esp + 0x38], ebx
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0x18]
lea eax, [esi + 0xc]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esp + 0x88], ebx
call edx
test eax, eax
jge 0x521051
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov dword [esp + 0x80], 0xffffffff
je 0x5210e0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x5210e0
mov ecx, dword [esp + 0x38]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x3c], eax
je 0x521078
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x3c]
push edx
push 0x6340a0
push ecx
call eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
cmp eax, ebx
mov byte [esp + 0x80], 1
je 0x5210b2
mov ecx, dword [eax]
fld qword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
sub esp, 8
fstp qword [esp]
push eax
call edx
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
call fcn.0051f040
mov ecx, dword [esp + 0x38]
cmp esi, eax
mov eax, dword [esp + 0x3c]
jne 0x5210b2
mov dword [esp + 0x40], edx
cmp eax, ebx
mov byte [esp + 0x80], bl
je 0x5210c9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x38]
cmp ecx, ebx
mov dword [esp + 0x80], 0xffffffff
je 0x5210e0
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
cmp edi, ebx
jne 0x520ff7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00401480
int3

Function at 0x523f30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x824]
mov eax, dword [esi + 0x820]
sub ecx, 1
cmp eax, ecx
jge 0x523f4f
add eax, 1
mov dword [esi + 0x820], eax
mov edx, dword [esi + 0x820]
mov eax, dword [esi + edx*4 + 0x84c]
push 0
push 0
push 0
push eax
call fcn.005c8c4d
mov eax, dword [esi + 0x818]
mov edx, dword [esi + 0x820]
mov ecx, 0x800
sub ecx, eax
push ecx
add eax, esi
push eax
mov eax, dword [esi + edx*4 + 0x84c]
push eax
call fcn.005c8acd
add esp, 0x1c
pop esi
ret
Function at 0x524000
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x800]
cmp dword [edi], edi
jb 0x52407e
mov edi, edi
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push 0x800
push esi
push ecx
call fcn.005c8acd
add esp, 0xc
cmp eax, 0x800
mov dword [esi + 0x818], eax
jae 0x524040
mov ecx, esi
call fcn.00523f30
cmp dword [esi + 0x83c], 0
je 0x52406a
test byte [esi + 0x14], 0x10
je 0x52406a
mov edx, dword [esi + 0x844]
mov eax, dword [esi + 0x840]
mov ecx, dword [esi + 0x848]
push edx
push eax
push esi
call ecx
and byte [esi + 0x14], 0xef
add dword [edi], 0xfffff800
add dword [esi + 0x804], 0xfffff800
cmp dword [edi], edi
jae 0x524010
mov ecx, dword [edi]
movzx eax, byte [ecx]
add ecx, 1
mov dword [edi], ecx
pop edi
pop esi
ret

Function at 0x525970
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x820]
mov ecx, dword [esi + eax*4 + 0x84c]
push 0x800
push esi
push ecx
call fcn.005c8acd
add esp, 0xc
cmp eax, 0x800
mov dword [esi + 0x818], eax
jae 0x5259a3
mov ecx, esi
call fcn.00523f30
cmp dword [esi + 0x83c], 0
je 0x5259cd
test byte [esi + 0x14], 0x10
je 0x5259cd
mov edx, dword [esi + 0x844]
mov eax, dword [esi + 0x840]
mov ecx, dword [esi + 0x848]
push edx
push eax
push esi
call ecx
and byte [esi + 0x14], 0xef
cmp dword [esi + 0x830], 0
mov dword [esi + 0x800], esi
je 0x5259e6
add dword [esi + 0x804], 0xfffff800
pop esi
ret
Function at 0x529ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6085fc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push eax
lea edi, [esi + 0x54]
push edi
push ecx
push edx
mov ecx, esi
call fcn.00485370
push edi
mov dword [esp + 0x20], 0
mov dword [esi], vtable.CAsyncReader.0
mov dword [esi + 0xc], vtable.CAsyncReader.3.0
mov dword [esi + 0x10], vtable.CAsyncReader.2.0
mov dword [esi + 0x50], vtable.CAsyncReader.1.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [esp + 0x2c]
lea ebx, [esi + 0x6c]
push eax
mov ecx, ebx
mov byte [esp + 0x20], 1
call fcn.00542240
mov ecx, dword [esp + 0x30]
push edi
push ebx
push esi
push ecx
lea ecx, [esi + 0xf0]
mov byte [esp + 0x2c], 2
call fcn.00529e40
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x1c], 3
call fcn.00486290
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14

Function at 0x52a110
Capabilities:
Encode data using xor

Disassembly:
push esi
movzx esi, word [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 0x20
jb 0x52a19a
push ebp
mov ebp, edi
shr ebp, 5
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.0052a050
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
movzx edx, ch
movzx ecx, word [edx*2 + 0x6346c0]
shl esi, 8
xor ecx, esi
mov edx, eax
shr edx, 8
xor edx, ecx
movzx edx, dh
movzx edx, word [edx*2 + 0x6346c0]
shl ecx, 8
xor edx, ecx
mov ecx, eax
xor ecx, edx
movzx ecx, ch
movzx ecx, word [ecx*2 + 0x6346c0]
shl edx, 8
xor ecx, edx
mov edx, ecx
shr edx, 8
xor edx, eax
and edx, 0xff
movzx esi, word [edx*2 + 0x6346c0]
shl ecx, 8
add esp, 8
xor esi, ecx
sub edi, 0x20
sub ebp, 1
jne 0x52a126
pop ebp
mov eax, edi
shr eax, 3
sub eax, 1
je 0x52a1fe
sub eax, 1
je 0x52a1d6
sub eax, 1
jne 0x52a229
lea eax, [esp + 0xc]
push 8
push eax
call fcn.0052a050
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x6346c0]
shl esi, 8
add esp, 8
xor esi, edx
lea eax, [esp + 0xc]
push 8
push eax
call fcn.0052a050
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x6346c0]
shl esi, 8
add esp, 8
xor esi, edx
lea eax, [esp + 0xc]
push 8
push eax
call fcn.0052a050
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x6346c0]
shl esi, 8
add esp, 8
xor esi, edx
and edi, 7
test edi, edi
je 0x52a259
lea ecx, [ecx]
lea eax, [esp + 0xc]
push 1
push eax
sub edi, 1
call fcn.0052a050
mov ecx, esi
shr ecx, 0xf
xor eax, ecx
add esp, 8
add esi, esi
test al, 1
je 0x52a255
xor esi, 0x8005
test edi, edi
jne 0x52a230
pop edi
mov ax, si
pop esi
ret
Function at 0x5427d0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x80], 0
jne 0x54281f
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x5425d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x80], eax
jne 0x54281f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x542821
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x55b8c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6088f8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
add edi, 0xfffffff0
push edi
mov dword [esp + 0x18], 0
mov dword [esi], eax
mov dword [esi + 4], 0
call fcn.00403f80
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], 0
mov eax, 1
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
add esp, 4
mov dword [esp + 0x14], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x55b982
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x28
Function at 0x55bf60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6089b8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x38]
call fcn.0055b420
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0x84], 0
call edx
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x48]
add ecx, eax
push ecx
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov ebx, dword [edi + 0x24]
test ebx, ebx
mov esi, eax
je 0x55c02e
mov eax, ebx
mov ebx, dword [ebx]
add eax, 8
push eax
lea ecx, [esp + 0x3c]
call fcn.0055b9a0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, edi
call fcn.0055b130
mov ecx, dword [esp + 0x14]
and ecx, 3
cmp cl, 3
je 0x55c02a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
sub ecx, dword [esp + 0x18]
push ebp
sub eax, edx
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
mov edx, dword [esp + 0x28]
push edx
push 0
push eax
push esi
call dword [sym.imp.USER32.dll_DeferWindowPos]
mov esi, eax
test ebx, ebx
jne 0x55bfc3
mov ebp, dword [edi + 0x40]
test ebp, ebp
je 0x55c0b0
mov eax, ebp
mov ebp, dword [ebp]
add eax, 8
push eax
lea ecx, [esp + 0x3c]
call fcn.0055b9a0
mov edx, dword [edi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call edx
test eax, eax
je 0x55c0ac
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, edi
call fcn.0055b130
mov ecx, dword [esp + 0x14]
and ecx, 3
cmp cl, 3
je 0x55c0ac
push dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
sub eax, edx
push eax
sub ecx, ebx
push ecx
push edx
mov edx, dword [esp + 0x48]
push ebx
push 0
push edx
push esi
call dword [sym.imp.USER32.dll_DeferWindowPos]
mov esi, eax
test ebp, ebp
jne 0x55c035
push esi
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x80], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x55c0e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x55d380
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x608bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esp + 0x30], 0
je 0x55d45f
cmp dword [esi + 0x60], 0
jne 0x55d492
push esi
lea ecx, [esp + 0x10]
mov dword [esi + 0x60], 1
call fcn.005a4dac
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov dword [esp + 0x2c], 0
call edi
push eax
lea ecx, [esi + 0x64]
call fcn.005a4d19
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x54]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esi + 0x84]
call fcn.005a4fe0
mov edx, dword [esp + 0x10]
push edx
call edi
push eax
lea ecx, [esi + 0x74]
call fcn.005a4d19
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x54]
push 0
push 1
push 1
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esi + 0x8c]
call fcn.005a4fe0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005a4e00
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
cmp dword [esi + 0x60], 0
je 0x55d492
lea ecx, [esi + 0x64]
mov dword [esi + 0x60], 0
call fcn.005a4d7d
lea ecx, [esi + 0x84]
call fcn.005a5033
lea ecx, [esi + 0x74]
call fcn.005a4d7d
lea ecx, [esi + 0x8c]
call fcn.005a5033
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x55d4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x608bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x4c]
xor edi, edi
cmp eax, edi
mov dword [esi + 0x5c], eax
je 0x55d5af
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
neg eax
push eax
neg ecx
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], vtable.CRgn.0
push 2
push 3
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x50], edi
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push eax
lea ecx, [esp + 0x10]
call fcn.005a4fe0
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.005a5009
mov ecx, dword [esi + 0x20]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0xc], vtable.CGdiObject.0
call fcn.005a5033
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret 4
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
push eax
mov eax, dword [esi + 0x20]
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret 4