joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4195a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bf28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.00418870
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00533a60
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401320
movzx edx, al
test edx, edx
je 0x419617
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov eax, dword [ebp - 0x20]
jmp 0x4197a5
lea eax, [ebp - 0x24]
push eax
call fcn.00537910
add esp, 4
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
call fcn.00405840
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.00537d50
add esp, 8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00402a40
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov byte [ebp - 4], 3
push str..ini
mov edx, dword [ebp - 0x50]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00407f90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.00407f90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.00407f90
push str.share.ini
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 8
push str.globals.ini
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1c]
call fcn.00405840
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419730
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00407f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov eax, dword [ebp - 0x30]
jmp 0x4197a5
lea ecx, [ebp - 0x18]
call fcn.00405840
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.004189e0
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.004189e0
lea ecx, [ebp - 0x1c]
call fcn.00405840
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.004189e0
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00407f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554048
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00535e90
add esp, 4
cmp eax, 0xa00000
jbe 0x41c1b1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041be80
add esp, 0xc
jmp 0x41c26b
cmp dword [ebp + 0x10], 0
je 0x41c1cc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c1cc
xor eax, eax
jmp 0x41c26b
lea ecx, [ebp - 0x10]
call fcn.004058d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004139f0
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jge 0x41c20d
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403ea0
mov eax, dword [ebp - 0x14]
jmp 0x41c26b
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00417800
add esp, 8
test eax, eax
jne 0x41c241
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403ea0
mov eax, dword [ebp - 0x18]
jmp 0x41c26b
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
call fcn.00409940
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403ea0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41dc40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558f6b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
xor ebx, ebx
push ebx
mov dword [esi + 8], ecx
push ebx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.CWzResize.0
mov dword [esi + 4], eax
call fcn.0040fcd0
push ebx
push ebx
lea ecx, [esi + 0x14]
call fcn.0040fcd0
push ebx
push ebx
lea ecx, [esi + 0x1c]
call fcn.0040fcd0
push ebx
push ebx
lea ecx, [esi + 0x24]
call fcn.0040fcd0
push 0x574340
lea ecx, [esi + 0x2c]
call fcn.00402df0
lea edx, [esi + 0x30]
push edx
mov dword [esp + 0x1c], ebx
call fcn.0041e920
lea edi, [esi + 0x88]
mov ecx, edi
call fcn.004139f0
mov dword [edi], vtable.CArray_class_CWzResizeItem___class_CWzResizeItem___.0
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x41fde0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x558e99
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov dword [edi], vtable.CWizSkinManager.0
mov dword [esp + 0x2c], 3
call fcn.004202b0
call fcn.0041ff90
mov eax, dword [edi + 0x24]
neg eax
sbb eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.00401410
xor ebx, ebx
mov byte [esp + 0x2c], 4
cmp dword [esp + 0x14], ebx
je 0x41fe7c
lea esi, [edi + 0x18]
lea esp, [esp]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.0050aba2
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x41fe76
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp dword [esp + 0x14], ebx
jne 0x41fe50
lea ebp, [edi + 0x18]
mov ecx, ebp
call fcn.0050ab12
mov ecx, dword [edi + 0x34]
cmp ecx, ebx
je 0x41fe98
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x34], ebx
mov ecx, dword [edi + 0x38]
cmp ecx, ebx
je 0x41feaa
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x38], ebx
mov ecx, dword [edi + 0x3c]
cmp ecx, ebx
je 0x41febc
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0x3c], ebx
mov esi, dword [edi + 0x98]
cmp esi, ebx
je 0x41fedb
push esi
call fcn.0045e7d0
push esi
call fcn.004dcb13
add esp, 4
mov dword [edi + 0x98], ebx
call fcn.0045e3b0
call fcn.0045f4e0
mov esi, eax
cmp dword [esi + 0xa8], ebx
je 0x41fefa
call fcn.0045f670
mov dword [esi + 0xa8], ebx
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [edi + 0x44]
cmp ecx, ebx
je 0x41ff1d
cmp eax, ebx
je 0x41ff1d
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x41ff1d
push ecx
call eax
lea ecx, [esp + 0x18]
call fcn.00407f90
mov eax, dword [edi + 0x88]
lea esi, [edi + 0x84]
mov dword [esi], vtable.CArray_class_CWizSkinManagerColorFilter___class_CWizSkinManagerColorFilter__.0
cmp eax, ebx
je 0x41ff45
push eax
call fcn.004dcb13
add esp, 4
mov ecx, esi
call fcn.00416050
lea ecx, [edi + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add edi, 0x48
push edi
mov byte [esp + 0x30], bl
call fcn.00421400
mov ecx, ebp
mov dword [esp + 0x2c], 0xffffffff
call fcn.0050ab70
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x423f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5563f8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 8
mov ecx, esp
mov dword [esp + 0x10], esp
push 0
mov dword [esp + 0x20], 0
call fcn.00410030
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov eax, dword [esp + 0x38]
mov edx, dword [ecx + 0xe4]
mov dword [esp + 0x20], esp
push eax
push edx
xor ecx, ecx
call fcn.00429a80
cmp dword [esp + 0x30], 0
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x423ffc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x423ff1
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x423ffc
push eax
call edi
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x424007
push eax
call edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x18

Function at 0x424e00
Capabilities:
Check os version

Disassembly:
test byte [0x5c0bc8], 1
jne 0x424e39
or dword [0x5c0bc8], 1
push 0x114
push 0
push 0x5c0a90
call fcn.0050bed0
add esp, 0xc
push 0x5c0a90
mov dword [0x5c0a90], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x5c0aa0], 2
jb 0x424e54
cmp dword [0x5c0a94], 5
jb 0x424e54
mov eax, 1
movzx eax, al
ret
xor eax, eax
movzx eax, al
ret
Function at 0x424f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push edi
lea eax, [esp + 0x40]
push eax
push 0x18
push ecx
call esi
test eax, eax
je 0x4251d2
mov eax, dword [esp + 0x7c]
lea edx, [esp + 0x58]
push edx
push 0x18
push eax
call esi
test eax, eax
je 0x4251d2
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x28]
push ecx
push 0x18
push edx
call esi
test eax, eax
je 0x4251d2
mov bx, word [esp + 0x52]
cmp bx, word [esp + 0x6a]
jne 0x4251d2
mov di, word [esp + 0x50]
cmp di, word [esp + 0x68]
jne 0x4251d2
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x5c]
jne 0x4251d2
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x60]
jne 0x4251d2
cmp bx, word [esp + 0x3a]
jne 0x4251d2
cmp di, word [esp + 0x38]
jne 0x4251d2
mov eax, dword [esp + 0x2c]
cmp ecx, eax
jne 0x4251d2
mov esi, dword [esp + 0x30]
cmp edx, esi
jne 0x4251d2
cmp bx, 0x20
jne 0x4251d2
cmp di, 1
jne 0x4251d2
mov edi, dword [esp + 0x54]
test edi, edi
je 0x4251d2
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x4251d2
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x4251d2
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
test esi, esi
jle 0x4251c3
inc ebx
mov dword [esp + 0x18], ebx
xor ebp, ebp
test eax, eax
jle 0x4251a4
mov ecx, dword [esp + 0x7c]
mov edi, dword [esp + 0x18]
mov ebx, edx
sub ecx, edx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x20], ecx
jmp 0x4250db
mov ebx, dword [esp + 0x84]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x78], 0
je 0x4250f0
mov esi, dword [esp + 0x7c]
mov ecx, eax
sub ecx, ebp
lea ecx, [esi + ecx*4 - 4]
jmp 0x4250f2
add ecx, ebx
cmp dword [esp + 0x80], 0
je 0x425102
sub eax, ebp
lea ebx, [edx + eax*4 - 4]
movzx edx, byte [ecx + 3]
movzx esi, byte [ebx + 2]
mov eax, 0xff
sub eax, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx + 2]
add dword [esp + 0x84], 4
mov byte [edi + 1], al
movzx edx, byte [ecx + 3]
movzx esi, byte [ebx + 1]
mov eax, 0xff
sub eax, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx + 1]
mov esi, 0xff
mov byte [edi], al
movzx edx, byte [ecx + 3]
movzx eax, byte [ebx]
sub esi, edx
imul esi, eax
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, byte [ecx]
mov edx, dword [esp + 0x14]
mov byte [edi - 1], al
mov eax, dword [esp + 0x2c]
inc ebp
add edi, 4
cmp ebp, eax
jl 0x4250d0
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
add dword [esp + 0x7c], ecx
add dword [esp + 0x18], ecx
inc edi
add edx, ecx
cmp edi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jl 0x4250a5
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret 0x10
Function at 0x425960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4259e6
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xe
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x4259df
cmp dword [esp + 0xc], 0xe
jne 0x4259df
push 0
lea eax, [esp + 0x10]
push eax
push 0x28
lea ecx, [esp + 0x2c]
push ecx
push esi
call edi
test eax, eax
je 0x4259df
cmp dword [esp + 0xc], 0x28
jne 0x4259df
xor edx, edx
cmp word [esp + 0x2e], 0x20
push esi
sete dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x44
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret

Function at 0x4259f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push edi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x425ab5
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push edi
mov byte [esp + 0x18], 0x89
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], 0x4e
mov byte [esp + 0x1b], 0x47
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425aae
cmp dword [esp + 0xc], 4
jne 0x425aae
mov eax, dword [esp + 8]
push esi
cmp eax, dword [esp + 8]
je 0x425a7e
movzx esi, al
sub esi, 0x89
jne 0x425a94
movzx esi, ah
sub esi, 0x50
jne 0x425a94
movzx esi, byte [esp + 0xe]
sub esi, 0x4e
jne 0x425a94
movzx esi, byte [esp + 0xf]
sub esi, 0x47
jne 0x425a94
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
add esp, 0xc
ret
sar esi, 0x1f
push edi
or esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
add esp, 0xc
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x425c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 2
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x425c95
xor eax, eax
pop esi
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x425c91
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x425c91
xor ecx, ecx
cmp word [eax + 0xe], 0x20
push edi
sete cl
push esi
mov edi, ecx
call fcn.00403bc0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
ret
Function at 0x425f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x554c38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x425ff1
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x425ff1
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x425ff1
mov esi, dword [edi + 8]
imul esi, dword [edi + 4]
add esi, esi
add esi, esi
cmp word [edi + 0xe], 0x20
mov dword [esp + 0x18], 0
jne 0x42606f
mov ecx, dword [esp + 0x40]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edx, [esi + 0x28]
cmp eax, edx
jb 0x42606f
lea ecx, [esp + 0x20]
call fcn.004f4b7f
xor ebp, ebp
push ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebp
call fcn.00410b70
push 0x34
call fcn.00511344
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x426007
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f5108
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 0x28
push edi
push 0x28
push ebx
call fcn.0050bbc3
add esp, 0x10
push ebp
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [ebx + 0x14], esi
mov ecx, dword [esp + 0x34]
push ebx
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
test ebp, ebp
je 0x426051
mov eax, dword [esp + 0x14]
test eax, eax
je 0x426051
push esi
add edi, 0x28
push edi
push esi
push eax
call fcn.0050bbc3
add esp, 0x10
mov dword [esp + 0x18], ebp
push ebx
call fcn.00511267
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f5108
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.00403bc0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4283c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5563c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0x1c]
call fcn.00410030
mov edx, dword [eax]
mov ecx, dword [esi]
mov eax, dword [eax + 4]
cmp ecx, edx
jne 0x428414
cmp dword [esi + 4], eax
jne 0x428414
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
cmp edi, ecx
jne 0x428430
push ebx
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.0040fcd0
lea ecx, [esp + 8]
call fcn.004e6312
push 1
push 1
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0x21
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004e672c
mov eax, dword [esp + 0xc]
push ebx
push eax
call fcn.004e7391
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.0042b650
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.004e7391
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00424840
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004e685b
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x428b50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5558b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x10]
call fcn.00410030
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp dword [esp + 0x70], ecx
jne 0x428ba1
cmp dword [esp + 0x74], eax
jne 0x428ba1
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov edx, dword [esp + 0x54]
push edx
call fcn.004f5347
push eax
push 0
lea eax, [esp + 0x34]
push eax
call fcn.0043f7c0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
add eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
add eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x58]
add ecx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
add edx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
call fcn.00429980
mov ecx, dword [esp + 0x50]
push esi
call fcn.00410b40
push eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x24]
call fcn.00425620
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0043f8e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
Function at 0x428db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x557af0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x68]
lea ecx, [esp + 0x24]
call fcn.004139f0
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
add edx, ecx
push edx
mov edx, dword [esp + 0x74]
test eax, eax
jge 0x428e06
push edx
push ecx
add edx, eax
push edx
lea eax, [esp + 0x34]
push eax
jmp 0x428e10
add eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [esp + 0x24]
call fcn.0040fe70
push eax
lea ecx, [esp + 0x28]
call fcn.00415ef0
push eax
lea ecx, [esp + 0x1c]
call fcn.0040fcd0
lea ecx, [esp + 0x1c]
call fcn.0040e430
mov dword [esp + 0x60], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.00410b40
push eax
lea esi, [esp + 0x74]
call fcn.004251e0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
call fcn.004f535b
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea edx, [esp + 0x4c]
push edx
call fcn.0043f7c0
mov byte [esp + 0x60], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x44]
call fcn.00410170
push 0xff00ff
lea ecx, [esp + 0x38]
call fcn.004139f0
push eax
lea ecx, [esp + 0x4c]
call fcn.004fbc94
mov ecx, dword [esp + 0x78]
test ecx, ecx
jle 0x428ebc
xor eax, eax
jmp 0x428ec0
mov eax, ecx
neg eax
mov edx, dword [esp + 0x7c]
push 3
push 0
push 0
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x80]
push ecx
push 0
push eax
push edx
call dword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
jle 0x428f1e
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
cmp eax, 0xff00ff
jne 0x428f06
mov dword [ecx], 0
jmp 0x428f0d
or eax, 0xff000000
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
inc edx
add ecx, 4
cmp edx, eax
jl 0x428ef5
mov edi, dword [esp + 0x48]
test ebp, ebp
jne 0x428f2a
xor esi, esi
jmp 0x428f2d
mov esi, dword [ebp + 4]
call fcn.00429980
push edi
push esi
lea esi, [esp + 0x3c]
lea edi, [esp + 0x2c]
call fcn.00425620
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 0
call fcn.0043f8e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], 0xffffffff
call fcn.0040e1e0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x54
ret