joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6700
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
cmp ebx, 0x112
ja 0x4e6846
je 0x4e67a5
mov eax, ebx
sub eax, 2
je 0x4e6769
sub eax, 3
je 0x4e672e
sub eax, 0x42
jne 0x4e674e
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x12c]
jne 0x4e674e
push 0
push 0x2fbf
push 0x113
push dword [esi - 0x60]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.004b1cb0
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [esi + 0x130], 0
je 0x4e674e
lea ecx, [esi - 0x80]
call fcn.004b0de0
test eax, eax
jne 0x4e6782
xor ecx, ecx
jmp 0x4e6785
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
cmp eax, ecx
jne 0x4e674e
push dword [esi + 0x130]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x130], 0
jmp 0x4e674e
lea edi, [esi - 0x80]
mov ecx, edi
call fcn.00493240
test eax, eax
je 0x4e674e
push 0x48aa90
mov ecx, 0x613dd4
call fcn.0053f091
test eax, eax
je 0x4e6931
cmp dword [eax + 4], 0
jg 0x4e674e
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4e674e
mov ecx, edi
call fcn.004b0ec0
test eax, eax
jne 0x4e674e
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x4e674e
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x4e674e
mov eax, dword [edi]
mov ecx, edi
push 0x12
call dword [eax + 0x220]
test eax, eax
jne 0x4e683a
mov ecx, edi
call fcn.004b0bf0
test eax, eax
je 0x4e683a
push 0
push edi
mov ecx, eax
call fcn.0048d020
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14
cmp ebx, 0x220
jb 0x4e674e
cmp ebx, 0x222
jbe 0x4e6739
cmp ebx, 0x230
jne 0x4e674e
mov eax, dword [esi - 0x80]
lea ecx, [esi - 0x80]
call dword [eax + 0x188]
lea ecx, [esi - 0x80]
test eax, eax
je 0x4e6908
call fcn.004b0ec0
test eax, eax
je 0x4e68b0
lea ecx, [esi - 0x80]
call fcn.004b0de0
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
test dword [esi + 0x54], 0x400
mov ebx, dword [ebp + 0x10]
jne 0x4e68dd
mov eax, dword [ebx]
test eax, eax
jne 0x4e68d4
cmp dword [esi + 0x130], eax
je 0x4e68dd
test eax, eax
jne 0x4e68d4
mov eax, dword [esi + 0x130]
push eax
lea ecx, [esi - 0x80]
call fcn.004e74c0
lea ecx, [esi - 0x80]
call fcn.004b0de0
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
lea ecx, [esi - 0x80]
call fcn.004e6970
pop edi
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x14
call fcn.004b0de0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
jne 0x4e674e
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
call fcn.00525b88
int3
Function at 0x4e9870
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
mov eax, dword [edi + 4]
je 0x4e98aa
test eax, eax
jne 0x4e98bc
push esi
call fcn.005322aa
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x4e96a0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop esi
mov dword [edi + 4], eax
pop edi
pop ebp
ret 4
test eax, eax
je 0x4e98bc
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [edi + 4], 0
pop edi
pop ebp
ret 4
Function at 0x4ed210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60b4e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jne 0x4ed35f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0xc0]
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x160]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x84]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x15c]
push 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ed2dc
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4ed2bc
sub eax, dword [ebp - 0x18]
cdq
idiv dword [esi + 0x14c]
lea ecx, [eax + 1]
mov eax, dword [esi + 0x13c]
cmp eax, ecx
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jl 0x4ed2dc
sub eax, dword [ebp - 0x20]
cdq
idiv dword [esi + 0x150]
lea edi, [eax + 1]
mov eax, dword [esi + 0x140]
cmp eax, edi
cmovl edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x15c]
jne 0x4ed30c
cmp edi, dword [esi + 0x160]
jne 0x4ed30c
push 0
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004ed380
jmp 0x4ed35f
push 1
push dword [esi + 0x148]
mov ecx, esi
mov dword [esi + 0x15c], eax
push dword [esi + 0x144]
mov dword [esi + 0x160], edi
call fcn.004ed380
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0x164], 1
mov eax, dword [ecx]
call dword [eax + 0x1a4]
push dword [ebp - 8]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0xc]
mov dword [esi + 0x164], 0
call dword [eax + 0x104]
push dword [ebp + 8]
mov ecx, esi
call fcn.0049b610
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055a658
mov esp, ebp
pop ebp
ret 4

Function at 0x4f0070
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x4f0080
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4f15d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 8], 0
je 0x4f1649
mov edi, dword [ebp + 8]
cmp edi, 0x26
je 0x4f15f7
cmp edi, 0x28
je 0x4f15f7
cmp edi, 0x22
je 0x4f15f7
cmp edi, 0x21
jne 0x4f1649
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4f1649
push 5
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 8]
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x4f1649
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f1cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x4f1d1b
mov esi, dword [ebp + 8]
cmp esi, 0x2e
je 0x4f1ce2
cmp esi, 8
je 0x4f1ce2
xor eax, eax
jmp 0x4f1ce7
mov eax, 1
mov dword [edi + 0x170], eax
mov eax, dword [edi + 0x144]
test eax, eax
je 0x4f1d04
cmp dword [eax + 0x80], 0
jne 0x4f1e80
cmp esi, 9
jne 0x4f1d24
cmp dword [edi + 0x194], 0
je 0x4f1d1b
test byte [edi + 0x174], 8
jne 0x4f1d79
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
cmp esi, 0xd
je 0x4f1d1b
cmp esi, 0x1b
jne 0x4f1d79
mov ecx, dword [edi + 0x138]
mov eax, dword [ecx]
call dword [eax + 0x1a8]
push dword [edi + 0x150]
mov ecx, edi
call fcn.004f2e70
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.004f31a0
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x4f1dbd
cmp dword [eax + 0x20], 0
je 0x4f1dbd
push 0x12
call ebx
test ax, ax
jns 0x4f1dbd
push 0x11
call ebx
test ax, ax
js 0x4f1dbd
mov ecx, dword [edi + 0xc0]
call fcn.004b0bf0
test eax, eax
je 0x4f1dbd
movzx ecx, si
push ecx
mov ecx, eax
call fcn.0048bde0
test eax, eax
jne 0x4f1e56
cmp esi, 0x73
jne 0x4f1e33
push 0x12
call ebx
test ax, ax
jns 0x4f1e46
mov ecx, dword [edi + 0x194]
test ecx, ecx
je 0x4f1de2
push dword [ebp + 0xc]
push esi
call fcn.004f15d0
test eax, eax
jne 0x4f1e56
cmp dword [edi + 0x144], 0
je 0x4f1e08
cmp esi, 0x26
je 0x4f1dff
cmp esi, 0x28
je 0x4f1dff
cmp esi, 0x22
je 0x4f1dff
cmp esi, 0x21
jne 0x4f1e62
push 0x12
call ebx
test ax, ax
js 0x4f1e62
mov ecx, edi
call fcn.004f1670
test eax, eax
je 0x4f1e62
mov ecx, dword [edi + 0x138]
mov edx, dword [ebp + 0xc]
push edx
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x258]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
cmp esi, 0x26
je 0x4f1e3d
cmp esi, 0x28
jne 0x4f1dcb
push 0x12
call ebx
test ax, ax
jns 0x4f1dcb
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
push 0
call dword [eax + 0xd4]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, dword [edi + 0x144]
test ecx, ecx
je 0x4f1e80
cmp dword [ecx + 0x20], 0
je 0x4f1e80
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.004acea0
test eax, eax
jne 0x4f1e56
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 8
Function at 0x4f2bc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x240]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x144], 0
je 0x4f2c19
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4f2cfd
mov eax, dword [ebp + 0xc]
cmp eax, 0x26
je 0x4f2c0e
cmp eax, 0x28
je 0x4f2c0e
cmp eax, 0x21
je 0x4f2c0e
cmp eax, 0x22
jne 0x4f2cfd
push dword [ebp + 0x10]
push eax
push 0x100
jmp 0x4f2c7f
mov edi, dword [ebp + 0xc]
cmp edi, 0x73
jne 0x4f2cde
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f2cfd
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
push 1
push 0x102
push 0x102
push dword [esi + 0x20]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4f2c86
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x102
mov ecx, esi
call fcn.005285ba
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x240]
cmp dword [ebp - 4], eax
je 0x4f2cd0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
mov edi, dword [ebx + 0x144]
test edi, edi
je 0x4f2cd0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4f2cd0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x26
je 0x4f2cec
cmp edi, 0x28
jne 0x4f2c36
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f2c36
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f5f30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59add0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x60b4e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.004a8e60
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00535924
mov esi, dword [ebp + 0x18]
mov ecx, edi
sub esi, dword [ebp + 0x10]
push 0x34
call fcn.004a8e60
push eax
mov eax, dword [ebp + 0x1c]
push 1
push esi
mov esi, dword [ebp - 0x24]
dec eax
push eax
push dword [ebp + 0x10]
mov ecx, esi
call fcn.005358c4
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00484ad0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.004a8e60
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405aab
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f603b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00484e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055a658
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4f7f30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x74]
test eax, eax
je case.0x4f7fad.10
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x4f7f85
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x8c]
test eax, eax
je 0x4f7f85
mov eax, dword [ebp + 8]
cmp eax, 0xd
je 0x4f7f6b
cmp eax, 0x20
jne case.0x4f7fad.10
mov ecx, dword [esi + 0xc0]
push 0
push dword [esi + 0x40]
call fcn.004b3290
mov eax, 1
pop esi
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc0]
call fcn.00486190
mov eax, dword [ebp + 8]
add esp, 8
add eax, 0xfffffff7
cmp eax, 0x1f
ja case.0x4f7fad.10
movzx eax, byte [eax + 0x4f8184]
jmp dword [eax*4 + 0x4f8158]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.004f7090
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
jmp 0x4f7fb6
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7400
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7400
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7140
cmp eax, 0xffffffff
jne 0x4f7fbf
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push eax
push dword [esi + 0x40]
call fcn.00496a00
cmp eax, dword [esi + 0x40]
jne case.0x4f7fad.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.004f7090
cmp eax, 0xffffffff
je case.0x4f7fad.10
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7270
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7270
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.004f7140
cmp eax, 0xffffffff
jne 0x4f7fbf
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push 1
push dword [esi + 0x40]
call fcn.00496a00
cmp eax, dword [esi + 0x40]
jne case.0x4f7fad.10
push 1
jmp 0x4f804b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x1bc]
test ax, ax
js 0x4f8122
push 1
push ecx
mov ecx, esi
call fcn.004f7090
cmp eax, dword [esi + 0x1bc]
jle case.0x4f7fad.10
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.004f7090
cmp eax, dword [esi + 0x1bc]
jge case.0x4f7fad.10
push eax
mov ecx, esi
call fcn.004f8dd0
mov eax, 1
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4fb250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x60]
test edi, edi
je 0x4fb2e6
mov eax, dword [ebp + 8]
shr eax, 8
push ebx
mov ebx, dword [edi + 0x34]
cmp al, 2
jne 0x4fb2e5
test ebx, ebx
je 0x4fb2e5
push dword [ebp + 0x10]
lea eax, [edi + 4]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4fb29a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp dword [eax + 0x14], 0
jne 0x4fb29a
mov ecx, dword [ebx + 0x2c]
jmp 0x4fb2be
mov eax, dword [edi + 0x34]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x40]
cmp dword [eax + 0x58], 0
cmovne edx, dword [ebp + 0x10]
add edx, dword [edi + 0x1c]
cmp edx, ecx
jl 0x4fb2be
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov ecx, edx
cmp edx, eax
cmovge ecx, eax
push ecx
mov ecx, esi
call fcn.004fabb0
cmp dword [ebp + 8], 0x202
je 0x4fb2dc
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4fb2e5
push 0
mov ecx, esi
call fcn.004faa60
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x502670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b7c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x60b4e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xaa0055
mov dword [ebp - 0x1c], 0xaa0055
mov dword [ebp - 0x18], 0xaa0055
mov dword [ebp - 0x14], 0xaa0055
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], vtable.CBitmap.0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [ebp - 0x34]
call fcn.00532cd3
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CBrush.0
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00532cd3
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0053339d
mov esi, dword [ebx]
mov ecx, edi
push 0xf
mov dword [ebp - 0x3c], eax
call fcn.004a8e60
push eax
mov ecx, ebx
call dword [esi + 0x2c]
mov esi, dword [ebp - 0x24]
mov ecx, edi
push 0x14
mov ebx, eax
mov esi, dword [esi]
call fcn.004a8e60
mov ecx, dword [ebp - 0x24]
push eax
call dword [esi + 0x30]
mov edi, eax
mov eax, dword [ebp - 0x38]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov esi, dword [eax]
sub ecx, edx
push ecx
mov ecx, dword [eax + 8]
sub ecx, esi
push ecx
push edx
push esi
mov esi, dword [ebp - 0x24]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_PatBlt]
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.0053339d
mov eax, dword [esi]
mov ecx, esi
push ebx
call dword [eax + 0x2c]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x30]
lea ecx, [ebp - 0x2c]
call fcn.00532e43
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CBrush.0
call fcn.0040cc0b
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.CBitmap.0
call fcn.0040cc0b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055a658
mov esp, ebp
pop ebp
ret 8
Function at 0x50c140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59add0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x60b4e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.004a8e60
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00535924
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push 0xc5c5c5
sub eax, ecx
push 1
push eax
mov eax, dword [ebp + 0x1c]
dec eax
push eax
push ecx
mov ecx, esi
call fcn.005358c4
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00484ad0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.004a8e60
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405aab
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x50c243
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00484e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055a658
mov esp, ebp
pop ebp
ret 0x18
Function at 0x510ae0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x510cd9
mov edi, dword [esi + 4]
test edi, edi
je 0x510cd9
push edi
mov dword [ebp + 8], 0
call fcn.005130d0
test eax, eax
je 0x510b83
mov ecx, edi
call fcn.004c2860
test eax, eax
je 0x510cd9
cvtsi2ss xmm0, dword [esi]
mov ebx, dword [eax + 0x14]
movss dword [ebp + 0xc], xmm0
call fcn.00512e20
mov edi, eax
mov edx, dword [edi + 0x38]
test edx, edx
jne 0x510b4e
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ca22c
push dword [edi]
call eax
mov dword [edi + 0x38], eax
mov edx, eax
fld dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push 0
push ecx
movzx ecx, bl
shl ecx, 8
movzx eax, bx
shr eax, 8
or ecx, eax
mov eax, ebx
shr eax, 0x10
and ebx, 0xff000000
shl ecx, 8
movzx eax, al
or ecx, eax
or ecx, ebx
fstp dword [esp]
push ecx
call edx
jmp 0x510bd8
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.00510700
mov ebx, eax
test ebx, ebx
je 0x510bd8
cvtsi2ss xmm0, dword [esi]
movss dword [ebp + 0xc], xmm0
call fcn.00512e20
mov edi, eax
mov eax, dword [edi + 0x3c]
test eax, eax
jne 0x510bbc
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ca23c
push dword [edi]
call eax
mov dword [edi + 0x3c], eax
fld dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push ecx
fstp dword [esp]
push ebx
call eax
push ebx
call fcn.00512e20
push eax
call fcn.00512d30
cmp dword [ebp + 8], 0
je 0x510cd9
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x510c2d
call fcn.00488520
mov ecx, dword [esi + 8]
cmp eax, 1
jne 0x510c10
push 0
call fcn.00488490
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
lea eax, [ebp - 8]
fst dword [ebp - 8]
fstp dword [ebp - 4]
push 2
jmp 0x510c1e
call fcn.00488520
mov ecx, dword [esi + 8]
push eax
call fcn.00488530
push eax
push dword [ebp + 8]
call fcn.00512e20
push eax
call fcn.00512d90
mov edi, dword [esi + 0x14]
test edi, edi
je 0x510c64
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00512e20
mov ebx, eax
mov eax, dword [ebx + 0xb0]
test eax, eax
jne 0x510c5e
push 0x5ca340
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb0], eax
push edi
push dword [ebp + 0xc]
call eax
mov edi, dword [esi + 0xc]
test edi, edi
je 0x510c9b
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00512e20
mov ebx, eax
mov eax, dword [ebx + 0xb4]
test eax, eax
jne 0x510c95
push 0x5ca354
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb4], eax
push edi
push dword [ebp + 0xc]
call eax
mov esi, dword [esi + 0x10]
test esi, esi
je 0x510ccd
mov ebx, dword [ebp + 8]
call fcn.00512e20
mov edi, eax
mov eax, dword [edi + 0xb8]
test eax, eax
jne 0x510cc9
push 0x5ca368
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xb8], eax
push esi
push ebx
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8