joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9090
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x50
cmp word [ecx + 0x6d8], 0
push ebx
push ebp
push esi
lea esi, [ecx + 0x6d8]
push edi
jne 0x4f90b1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
push 0
push esi
call fcn.0043bab0
add esp, 8
test eax, eax
jne 0x4f90c8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 0
push 0x20
push 3
push 0
push 1
push SysReAllocStringLen
push esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f91f2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4f9112
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
lea edi, [ebp + 2]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
je 0x4f9148
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, 0x18
jbe 0x4f91f2
mov ecx, 6
mov esi, ebx
lea edi, [esp + 0x1c]
add eax, 0xffffffe8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x24]
mov ebp, esi
imul ebp, dword [esp + 0x28]
cmp ebp, eax
ja 0x4f91f2
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDC]
mov edx, eax
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x48], eax
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x40], ecx
push eax
lea ecx, [esp + 0x40]
push 0
push ecx
neg esi
push edx
mov dword [esp + 0x4c], 0x28
mov dword [esp + 0x54], esi
mov word [esp + 0x58], 1
mov word [esp + 0x5a], 0x20
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
lea esi, [ebx + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x14], eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x4fc840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4fc84b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4fc94e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x519880]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x519880]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x519880]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x519880]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x519880]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x519880]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x519880]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x519880]
xor eax, edx
inc ecx
dec edi
jne 0x4fc866
pop edi
test esi, esi
je 0x4fc970
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x519880]
xor eax, edx
inc ecx
dec esi
jne 0x4fc952
pop esi
pop ebx
not eax
ret

Function at 0x4fd330
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4fd371
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4fd366
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4fd384
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4fe350
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4fe3e9
cmp dword [edi + 4], 0xffffffff
jne 0x4fe3e9
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x52886c
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
add esp, 8
cmp esi, 1
jne 0x4fe3af
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4fe3af
pop edi
pop esi
mov eax, 0x2000000
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push ebx
call fcn.004fd0a0
add esp, 0x10
test eax, eax
jne 0x4fe3d2
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
push eax
call fcn.004fd630
add esp, 4
mov dword [edi], eax
mov eax, dword [0x5df0c8]
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebx
pop ecx
ret 0xc

Function at 0x4fe870
Capabilities:
Create directory

Disassembly:
sub esp, 0x410
push edi
mov edi, dword [esp + 0x41c]
test edi, edi
je 0x4fe916
mov ax, word [edi]
test ax, ax
je 0x4fe916
push ebx
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x4fe8a4
cmp ax, 0x5c
jne 0x4fe8a6
mov esi, ecx
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4fe898
mov ebx, dword [esp + 0x420]
cmp esi, edi
je 0x4fe8e3
sub esi, edi
lea eax, [esp + 0xc]
sar esi, 1
push esi
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea ecx, [esp + 0x18]
mov word [esp + esi*2 + 0x18], 0
push ecx
push ebx
call fcn.004fe870
add esp, 0x14
lea edx, [esp + 0x214]
push ebx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [esp + 0x21c]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x10
lea ecx, [esp + 0x214]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebx
pop edi
add esp, 0x410
ret
Function at 0x4fefc0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51277b
push eax
mov eax, 0x1260
mov dword fs:[0], esp
call fcn.0050c9c0
push esi
mov esi, dword [esp + 0x1274]
push edi
push 0x557b20
mov edi, ecx
push esi
call fcn.0043bfa0
add esp, 8
test eax, eax
je 0x4ff122
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.0043bfe0
add esp, 0x10
test eax, eax
je 0x4ff0bb
lea ecx, [esp + 0x220]
push 0x546468
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4ff072
lea edx, [esp + 0x220]
push 0x824
push edx
push 1
push esi
call fcn.0043bfe0
add esp, 0x10
cmp word [esp + 0x220], 0
jne 0x4ff072
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.0043bfe0
add esp, 0x10
lea ecx, [esp + 0x220]
push ecx
push 0x528430
push 0x824
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [edi + 0x1046], 0
push edi
call fcn.004b6920
mov ecx, dword [esp + 0x126c]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x126c
ret 4
lea ecx, [esp + 8]
call fcn.004a74b0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1278], 0
call fcn.004a7580
mov esi, eax
test esi, esi
je 0x4ff109
push esi
lea ecx, [esp + 0xc]
call fcn.004a7680
test eax, eax
je 0x4ff0ff
push 0x824
push edi
push esi
lea ecx, [esp + 0x14]
call fcn.004a76c0
push esi
lea ecx, [esp + 0xc]
call fcn.004a75f0
lea ecx, [esp + 8]
mov dword [esp + 0x1270], 0xffffffff
call fcn.004a7500
jmp 0x4ff097
push 0x52a904
push esi
call fcn.0043bfa0
add esp, 8
test eax, eax
push esi
je 0x4ff07a
push 0x824
push edi
push 0x559900
push 0x54f9c8
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4ff097
Function at 0x5002c0
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [ecx + 0x2c]
test ecx, ecx
je 0x5002cc
jmp 0x500cf0
ret

Function at 0x501090
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x512902
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
lea ebp, [esi + 0x24]
lea ebx, [esi + 0x28]
mov dword [esi], 0x519cfc
mov dword [esi + 0x2c], 0x519cdc
mov dword [ebp], 0x519cf8
mov dword [ebx], 0x519ce0
mov dword [esi + 0x34], 0x519ccc
mov dword [esi + 0x38], 0x519cc4
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 0x64
push eax
mov dword [esp + 0x30], 7
call edi
mov ecx, dword [esi + 4]
push 0x65
push ecx
call edi
mov edx, dword [esi + 4]
push 0x66
push edx
call edi
mov ecx, dword [esi + 0x285c]
test ecx, ecx
je 0x50112f
call fcn.00508d90
mov ecx, dword [esi + 0x285c]
test ecx, ecx
je 0x501125
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x285c], 0
lea ecx, [esi + 0x28c8]
mov byte [esp + 0x28], 6
call fcn.004ddb50
lea ecx, [esi + 0x2860]
mov byte [esp + 0x28], 5
call fcn.004ff9d0
lea ecx, [esi + 0xf2c]
mov byte [esp + 0x28], 4
call fcn.004f33d0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x28], 3
call fcn.004f33d0
mov ecx, esi
lea eax, [esi + 0x2c]
neg ecx
sbb ecx, ecx
mov byte [esp + 0x28], 2
and ecx, eax
call fcn.004fa2b0
mov ecx, esi
mov byte [esp + 0x28], 1
neg ecx
sbb ecx, ecx
and ecx, ebx
call fcn.004e27a0
mov ecx, esi
mov byte [esp + 0x28], 0
neg ecx
sbb ecx, ecx
and ecx, ebp
call fcn.004ed050
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.004ff1a0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x505085
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
lea edx, [esp + 0xc]
or ebx, 0xffffffff
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x18], ebx
call fcn.005058e0
cmp dword [esp + 0xc], ebx
je 0x50511f
mov eax, dword [esi + 0x2924]
test eax, eax
jne 0x50510b
mov eax, dword [esi + 0x2848]
cmp dword [eax], 0
je 0x50510b
cmp dword [esi + 0x2920], ebx
je 0x50510b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x50510b
mov eax, dword [esi + 0x2928]
test eax, eax
jne 0x505179
push 1
mov ecx, esi
call fcn.00507290
test eax, eax
je 0x5050ff
mov dword [esi + 0x292c], 1
jmp 0x505179
mov dword [esi + 0x292c], 0
jmp 0x505179
mov ecx, dword [esi + 0x284c]
test ecx, ecx
je 0x505179
mov edx, dword [ecx]
push 0
push 2
call dword [edx]
jmp 0x505179
mov ecx, dword [esi + 0x2930]
test ecx, ecx
je 0x50514c
cmp eax, 3
jne 0x50514c
mov ecx, dword [esi + 0x284c]
mov dword [esi + 0x2930], 0
test ecx, ecx
je 0x505179
mov eax, dword [ecx]
push 1
push 1
call dword [eax]
jmp 0x505179
mov ecx, dword [esi + 0x284c]
test ecx, ecx
je 0x50515e
mov edx, dword [ecx]
push 0
push 1
call dword [edx]
call fcn.0041f410
mov eax, dword [eax + 4]
push 0
push 0x7534
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi + 0x2920], ebx
mov dword [esi + 0x2928], 0
pop esi
pop ebx
ret 4

Function at 0x505194
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
lea edx, [esp + 8]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push edi
push edx
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x292c], 0
mov dword [esp + 0x18], 0xffffffff
call fcn.005058e0
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x5051de
mov dword [esi + 0x2924], 1
jmp 0x5051e8
mov dword [esi + 0x2924], 0
cmp edi, 3
jne 0x5051fc
mov dword [esi + 0x2930], 1
pop edi
pop esi
ret 4
mov eax, dword [esi + 0x2848]
cmp dword [eax], 0
je 0x505216
mov ecx, dword [esp + 0xc]
pop edi
mov dword [esi + 0x2920], ecx
pop esi
ret 4
mov dword [esi + 0x2920], 0xffffffff
pop edi
pop esi
ret 4
Function at 0x505dc0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, ecx
push edi
push eax
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea edi, [esi + 0xf2c]
test edi, edi
je 0x505de8
lea eax, [esi + 0xf30]
jmp 0x505dea
xor eax, eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x505ea4
mov edx, dword [esi + 0x2848]
mov eax, dword [edx + 0x24]
test eax, eax
je 0x505e78
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
test edi, edi
je 0x505e1c
lea edx, [esi + 0xf30]
jmp 0x505e1e
xor edx, edx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
push 1
sub ebx, ecx
mov edx, dword [edx + 4]
push ebx
mov ebx, dword [esi + 0x2be8]
push eax
push ecx
mov ecx, dword [esp + 0x24]
sub ecx, ebx
sub ecx, eax
push ecx
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
test edi, edi
pop ebx
je 0x505e64
lea eax, [esi + 0xf30]
push 5
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
push 5
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
test edi, edi
je 0x505e97
mov ecx, dword [esi + 0xf34]
lea eax, [esi + 0xf30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
push eax
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x505eb0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push edi
mov edi, ecx
push eax
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [edi + 0x2b9c]
xor eax, eax
test ecx, ecx
je 0x505eda
call fcn.0044f5c0
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x14]
lea esi, [edi + 0x3c]
sub edx, eax
test esi, esi
mov dword [esp + 0xc], edx
je 0x505ef0
lea eax, [edi + 0x40]
jmp 0x505ef2
xor eax, eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x505f96
mov eax, dword [edi + 0x2848]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x505f70
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x2c]
test esi, esi
je 0x505f21
lea edx, [edi + 0x40]
jmp 0x505f23
xor edx, edx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
push 1
sub ebx, ecx
push ebx
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [edx + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
test esi, esi
pop ebx
je 0x505f5c
mov edx, dword [edi + 0x44]
lea eax, [edi + 0x40]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
push 5
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
test esi, esi
je 0x505f89
lea eax, [edi + 0x40]
push 0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
push eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x50b520
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.0050b800
test eax, eax
jne 0x50b658
mov ecx, ebx
call fcn.0050aac0
mov ecx, dword [ebx + 4]
push eax
call fcn.00507930
test eax, eax
jne 0x50b658
mov ecx, dword [ebx + 4]
call fcn.00506010
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x10
push 0x10
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
sub esp, 0x10
mov dword [esp + 0x20], eax
mov ecx, esp
xor eax, eax
push esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, 0x10
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, ebx
call fcn.0050ab90
mov eax, dword [ebx + 0x64]
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], edx
test eax, eax
mov dword [esp + 0x20], edx
je 0x50b5ce
lea eax, [ebx + 0x48]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x50b5da
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.0050a8f0
mov ecx, dword [esp + 0x18]
mov eax, dword [0x5df128]
add ecx, eax
mov eax, dword [esp + 0x20]
sub eax, ecx
push 0xcc0020
sub eax, 0x10
push 0
cdq
sub eax, edx
mov edx, dword [0x5df120]
sar eax, 1
add ecx, eax
push 0
push esi
push 0x10
lea eax, [ecx + 0x10]
push 0x10
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
add eax, edx
push ecx
push eax
push edi
lea edx, [eax + 0x10]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebx + 4]
push edi
call fcn.00506010
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x50bb08
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519df0
push 0x50ca2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x50bb8e
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x50bb66
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x50bb94
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x50bb5e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x50bb5e
mov al, 1
jmp 0x50bb60
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x50bbf3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x5df150]
test esi, esi
je 0x50bc17
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x50bbfb
pop esi
pop ecx
ret

Function at 0x50bc1a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5df15c], eax
je 0x50bc30
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x5df16c]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x50bc7d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x50bc6e
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x50bc6e
push eax
call fcn.0050bce4
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.0050c98e
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x50bc3f
mov dword [0x5df16c], ebx
call fcn.0050bcbd
mov esi, dword [0x5df168]
cmp esi, ebx
je 0x50bcaa
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.0050c98e
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x50bc92
pop edi
mov dword [0x5df168], ebx
mov dword [0x5df15c], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x50bf67
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x5df160]
push esi
test eax, eax
push edi
jne 0x50bfd1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x50bfcf
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x50bf93
push 8
pop edi
jmp 0x50bfae
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x50bfbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.0050c98e
pop ecx
and dword [0x5df164], 0
mov dword [0x5df160], edi
mov eax, edi
jmp 0x50bfd1
mov dword [esi + 4], edi
mov eax, dword [0x5df168]
mov dword [esi], eax
mov dword [0x5df168], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x50c28e
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x50c2b2
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x50c2b5
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x50c2c8
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x50c2cf
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x5df154]
mov ecx, dword [0x5df150]
test eax, eax
jne 0x50c2e9
test ecx, ecx
je 0x50c2fe
mov eax, ecx
mov dword [0x5df154], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x50c2fe
cmp edx, dword [ebp + 8]
jb 0x50c2fe
cmp edx, dword [ebp - 4]
jbe 0x50c457
mov eax, ecx
test ecx, ecx
mov dword [0x5df154], eax
je 0x50c32e
test eax, eax
je 0x50c322
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x50c322
cmp ecx, dword [ebp + 8]
jb 0x50c322
cmp ecx, dword [ebp - 4]
jbe 0x50c457
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x5df154], eax
jne 0x50c30d
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x50c396
cmp edi, 0x70000000
jb 0x50c353
cmp edi, 0x80000000
ja 0x50c353
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x50c396
cmp dword [ebp - 0x10], ebx
jne 0x50c36e
cmp dword [ebp - 0x14], ebx
jae 0x50c37e
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x50c33e
jmp 0x50c396
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5df154], eax
jne 0x50c40d
cmp esi, dword [ebp - 4]
jae 0x50c47e
cmp esi, 0x70000000
jb 0x50c3b4
cmp esi, 0x80000000
ja 0x50c3b4
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x50c47e
cmp dword [ebp - 0x10], ebx
jne 0x50c402
cmp dword [ebp - 0x14], ebx
jb 0x50c402
mov ecx, esi
and ecx, 0xffff
je 0x50c3ea
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5df154], eax
jne 0x50c40d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x50c396
mov dword [eax], 0x52727464
mov eax, dword [0x5df154]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x5df154]
mov edx, dword [0x5df150]
mov dword [eax + 4], edx
mov eax, dword [0x5df154]
mov dword [0x5df150], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x50c43f
mov eax, dword [0x5df154]
mov dword [eax + 8], ecx
mov eax, dword [0x5df154]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x50c47e
cmp esi, dword [ebp - 4]
ja 0x50c47e
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x50c480
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret