joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c980
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004df670
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004e0660
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 9
jne 0x52ca48
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esi + 0xf8]
jl 0x52c9fd
test eax, eax
je 0x52c9c1
mov eax, dword [eax + 0x14]
inc eax
jmp 0x52c9c3
xor eax, eax
mov edx, dword [esi + 0xd8]
mov ecx, dword [esi + 0x104]
cmp eax, edx
jl 0x52c9ea
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, ecx
jne 0x52c9f0
xor eax, eax
push eax
mov ecx, esi
call fcn.0052c900
pop edi
pop esi
ret 0xc
test eax, eax
je 0x52ca06
mov eax, dword [eax + 0x14]
jmp 0x52ca0c
mov eax, dword [esi + 0xd8]
dec eax
test eax, eax
jge 0x52ca29
mov eax, dword [esi + 0x104]
test eax, eax
je 0x52ca34
dec eax
mov ecx, esi
push eax
call fcn.0052c900
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jne 0x52ca3b
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, 0x25
jne 0x52ca9d
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x52cb61
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x52cb61
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
test ecx, ecx
lea eax, [ecx - 1]
jg 0x52ca7a
lea eax, [edi - 1]
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x52ca90
mov eax, ecx
push eax
mov ecx, esi
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, 0x27
jne 0x52caf4
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x52cb61
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x52cb61
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
dec edi
cmp ecx, edi
jge 0x52cacf
lea eax, [ecx + 1]
jmp 0x52cad1
xor eax, eax
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x52cae7
mov eax, ecx
push eax
mov ecx, esi
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, 0x28
jne 0x52cb28
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x52cb09
mov eax, dword [eax + 0x14]
inc eax
jmp 0x52cb0b
xor eax, eax
mov ecx, dword [esi + 0xd8]
xor edx, edx
cmp eax, ecx
mov ecx, esi
setge dl
dec edx
and edx, eax
push edx
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, 0x26
jne 0x52cb53
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x52cb3f
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jge 0x52cb46
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.0052c900
pop edi
pop esi
ret 0xc
cmp eax, 0x10
je 0x52cb61
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
ret 0xc
Function at 0x52ed70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6262b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, vtable.CRgn.0
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call esi
push eax
lea ecx, [esp + 0x10]
call fcn.005fc571
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
push 0xfffffffffffffffc
lea edx, [esp + 0x18]
push 0xfffffffffffffffc
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x14]
push eax
call esi
push eax
lea ecx, [esp + 8]
call fcn.005fc571
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.005fc571
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
neg eax
mov edx, dword [esp + 0x10]
push 3
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, vtable.CGdiObject.0
mov dword [esp + 4], esi
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.005fc5c8
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call fcn.005fc5c8
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x5347f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6266ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005f71db
xor edi, edi
mov eax, 0xa
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], 0x66fad8
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x669050
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov dword [esi + 0x80], eax
mov dword [esi], method.COleControlContainer.virtual_0
mov dword [esi + 0x7c], 1
mov dword [edx], ecx
xor eax, eax
push esi
push 4
mov dword [edx + 4], ecx
mov byte [esp + 0x1c], 2
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea ecx, [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx]
call dword [edx + 0xc4]
mov ecx, dword [esi + 0x80]
mov dword [esi + 0x20], eax
push esi
push 2
mov eax, dword [ecx]
call dword [eax + 0xc4]
cmp eax, edi
je 0x5348bb
lea ecx, [eax - 0x1c]
jmp 0x5348bd
xor ecx, ecx
mov edx, dword [esi + 0x80]
mov dword [esi + 0x1c], ecx
mov eax, dword [edx + 0x80]
mov edx, dword [esi + 0x20]
push eax
push 1
push edx
call fcn.00541280
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x536830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x626878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x669050
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xa
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push edi
mov eax, dword [ecx]
mov dword [esp + 0x3c], edi
call dword [eax + 0xc]
cmp dword [esp + 0x1c], edi
jne 0x5368b1
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 1
cmp eax, edi
je 0x5369b4
mov eax, dword [eax]
cmp eax, edi
jne 0x5368a6
jmp 0x5369b4
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x5368c1
add eax, 0xffffffe4
jmp 0x5368c3
xor eax, eax
push eax
mov ecx, ebp
call fcn.005366b0
cmp eax, edi
mov dword [esp + 0x40], eax
je 0x53699a
cmp dword [eax + 8], edi
je 0x53699a
mov ecx, dword [esp + 0x3c]
mov esi, dword [ecx + 0x78]
cmp esi, edi
je 0x536931
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x5368fb
lea ebx, [eax - 0x3c]
jmp 0x5368fd
xor ebx, ebx
lea ecx, [ebx + 0x3c]
call fcn.0058b030
cmp eax, edi
je 0x536928
add eax, 0xffffffe4
cmp eax, edi
je 0x536928
push eax
mov ecx, ebp
call fcn.005366b0
cmp eax, edi
je 0x536928
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + 8]
je 0x53694d
cmp esi, edi
jne 0x5368eb
mov ebx, 0x669050
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 4
cmp eax, edi
je 0x5369b4
mov eax, dword [eax]
cmp eax, edi
jne 0x536945
jmp 0x5369b4
lea ecx, [esp + 0x10]
push 2
push ecx
push ebx
mov ecx, ebp
call fcn.005367c0
mov dword [esp + 0x10], 0x669050
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
cmp eax, edi
je 0x53697a
mov eax, dword [eax]
cmp eax, edi
jne 0x536974
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005f2039
mov eax, 1
jmp 0x5369cf
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 2
cmp eax, edi
je 0x5369b4
mov eax, dword [eax]
cmp eax, edi
jne 0x5369ae
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005f2039
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x5387c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x538847
lea edi, [esi + 0xcc]
push 0x11
mov ecx, edi
call fcn.0058b070
test eax, eax
jne 0x538847
mov ecx, edi
call fcn.0053ce60
mov edi, dword [eax + 0xec]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call fcn.005379c0
test eax, eax
je 0x538813
add eax, 0x3c
jmp 0x538815
xor eax, eax
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov ecx, edi
call fcn.0052e8e0
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x545efa
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x627298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esi + 0xe0]
mov ecx, eax
mov eax, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
je 0x545f40
mov eax, ebp
sub eax, edi
jmp 0x545f42
sub eax, ebx
sub eax, edx
mov edx, dword [esi + 0x214]
dec eax
test ecx, ecx
je 0x545f57
push 0
push eax
push 0
push edx
jmp 0x545f5d
push eax
push 0
push edx
push 0
lea ecx, [esp + 0x28]
call fcn.00607b7a
mov eax, dword [esi + 0x20]
test eax, eax
je 0x545f83
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
mov eax, dword [ecx + 0x148]
test eax, eax
jne 0x545f8b
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x545fb0
mov eax, dword [esp + 0x4c]
push 0xf
sub eax, ebx
mov ecx, esi
mov ebp, eax
call fcn.00543540
mov edx, dword [esp + 0x20]
push eax
add edx, 2
push ebp
push edx
jmp 0x545fc5
push 0xf
mov ecx, esi
sub ebp, edi
call fcn.00543540
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push ebp
push ebx
push edi
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.0060795c
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x545fdf
lea ebx, [ecx + 0x3c]
jmp 0x545fe1
xor ebx, ebx
lea edx, [esp + 0x3c]
push edx
call fcn.0053e220
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x3c], 0
sub esp, 0x10
mov eax, esp
push ebx
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.005f797c
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18
Function at 0x555340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x627f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, 0xaa
mov ecx, 0x55
xor esi, esi
mov word [esp + 0x20], cx
mov word [esp + 0x22], ax
mov word [esp + 0x24], cx
mov word [esp + 0x26], ax
mov word [esp + 0x28], cx
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], vtable.CBitmap.0
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.005fc571
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], vtable.CBrush.0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
mov byte [esp + 0x38], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.005fc571
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005fbab2
mov ebp, dword [esi]
push 0xf
mov ecx, edi
mov ebx, eax
call fcn.004d75f0
push eax
mov ecx, esi
call dword [ebp + 0x2c]
mov edx, dword [esi]
push 0x14
mov ecx, edi
mov ebp, eax
mov dword [esp + 0x44], edx
call fcn.004d75f0
mov edx, dword [esp + 0x40]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edx
sub eax, edi
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call fcn.005fbab2
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0x10]
call fcn.005fc5c8
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.005fc5c8
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 3
call fcn.005fc5c8
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x572fc0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
mov esi, ecx
jne 0x572fd7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [0x8c3228]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x5730c0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x573028
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 4]
mov edi, eax
test edi, edi
jne 0x573005
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x5730ae
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov ebx, dword [esp + 0x1c]
mov edx, dword [esi]
test ebx, ebx
push 0x2001f
push ebp
mov ecx, esi
jne 0x57306d
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x57304a
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x5730ae
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x57307d
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esp + 0x1c]
push ebx
push 1
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x5730ae
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x5730e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x628f46
push eax
mov eax, 0x1014
mov dword fs:[0], esp
call fcn.00481660
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [0x8c3228]
mov dword [esp + 0x1c], ebx
cmp dword [ecx - 8], ebx
jne 0x573209
mov ecx, dword [esp + 0x1038]
mov eax, dword [edi]
push 0x20019
push ecx
mov ecx, edi
call dword [eax + 8]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, ebx
mov dword [esp + 0x102c], ebx
jne 0x57314c
mov edx, dword [esp + 0x1040]
push edx
jmp 0x573244
mov eax, dword [0x86a874]
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x103c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
push esi
mov byte [esp + 0x1044], 1
call ebx
test eax, eax
mov dword [edi + 0x10], eax
je 0x5731b6
mov eax, dword [esp + 0x1040]
push eax
mov edi, dword [esp + 0x1038]
mov ecx, edi
call fcn.005f79ea
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], 0
call fcn.005f797c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x573254
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.005f7dac
push eax
lea eax, [esp + 0x24]
push eax
push 0
push ebp
push esi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov dword [edi + 0x10], eax
call fcn.005f7dfb
mov eax, dword [edi + 0x10]
test eax, eax
je 0x5731f4
mov ecx, dword [esp + 0x1040]
push ecx
jmp 0x573189
mov edi, dword [esp + 0x1034]
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.005f76f1
jmp 0x573197
mov eax, dword [esp + 0x1040]
mov byte [esp + 0x13], 0
cmp eax, ebx
jne 0x57321d
lea eax, [esp + 0x13]
mov edx, dword [esp + 0x103c]
push ecx
lea ecx, [esp + 0x28]
push 0x1000
push ecx
push eax
mov eax, dword [esp + 0x1048]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x24]
push ecx
mov esi, dword [esp + 0x1038]
mov ecx, esi
call fcn.005f79ea
mov eax, esi
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1020
ret 0x10
Function at 0x578d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x629798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push 1
lea ecx, [esp + 8]
call fcn.00576140
mov ecx, dword [esp + 0x48]
lea eax, [esp + 4]
push 0
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov edx, esp
mov dword [esp + 0x4c], 0
mov dword [edx], eax
mov eax, dword [esp + 0x5c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.00578f20
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.00575ae0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0x14

Function at 0x57a640
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x629aa8
push eax
mov eax, dword [0x8c3370]
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov esi, ecx
push eax
call fcn.00575d90
xor edi, edi
cmp eax, edi
je 0x57a6aa
cmp dword [eax + 0x14], 2
jne 0x57a6aa
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
lea ecx, [esi + 0x50]
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [ecx], edx
mov edx, dword [esp + 0x50]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x54]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x3c
ret 0x10
cmp dword [esi + 0x64], edi
je 0x57a6f3
mov eax, dword [esi + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.00578aa0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
sub eax, ecx
mov ecx, dword [esp + 0x50]
push eax
sub ecx, edx
mov dword [esp + 0x44], edi
push ecx
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0057a7b0
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0xffffffff
call fcn.00578ba0
cmp dword [esi + 0x70], edi
jne 0x57a710
cmp dword [esi + 0x74], edi
jne 0x57a710
lea edx, [esi + 0x50]
lea eax, [esp + 0x48]
push edx
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x57a74e
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
mov edx, dword [esi]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], 1
mov dword [eax], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
mov ecx, esi
mov dword [esi + 0x78], edi
call fcn.0057a100
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
lea edx, [esi + 0x50]
mov dword [esi + 0x70], edi
pop edi
pop esi
mov dword [edx], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x4c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x582560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x629bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
mov edx, dword [esp + 0x80]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x84]
push 5
mov eax, dword [esi + 0x78]
push 3
mov ebx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x18]
lea eax, [esp + 0x34]
add ebp, edx
push eax
sub edi, ebx
mov dword [esp + 0x1c], ebp
call fcn.004dffa0
mov ecx, dword [eax]
add esp, 0xc
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x5c]
mov ebx, dword [eax + 4]
push esi
call fcn.005fc2c9
lea edx, [esi + 0x7c]
lea eax, [esp + 0x5c]
push edx
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x80], 0
call fcn.004deaf0
push str.XXXXXXXXXX
lea ecx, [esp + 0x88]
mov byte [esp + 0x7c], 1
call fcn.005f79ea
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x84]
call fcn.005f797c
mov edx, dword [esp + 0x20]
lea eax, [edx + ebx]
mov ebx, dword [esi + 0x6c]
dec ebx
mov dword [esp + 0x28], eax
test ebx, ebx
jl 0x5826fc
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [0x86a874]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x84], ecx
lea edx, [esp + 0x84]
mov ecx, ebp
push edx
mov byte [esp + 0x7c], 2
call fcn.005f4861
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x2c]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jg 0x582692
mov eax, ecx
mov ecx, dword [esp + 0x34]
mov edx, edi
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
sub edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], edx
test ebp, ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ecx
je 0x5826bf
mov ebp, dword [ebp + 0x1c]
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x3c]
push edx
push ebp
push eax
call fcn.005f5b42
mov ecx, dword [esi + 0x78]
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x78], 1
mov edx, dword [ecx + 0x14]
lea ecx, [esp + 0x84]
add edx, ebp
sub edi, edx
call fcn.005f797c
dec ebx
jns 0x582641
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x78], 0
mov dword [esi + 0xc0], ecx
lea ecx, [esp + 0x4c]
mov dword [esi + 0xc4], eax
call fcn.004deb50
lea ecx, [esp + 0x5c]
mov dword [esp + 0x78], 0xffffffff
call fcn.005fc33b
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc