joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539f30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f81b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
call fcn.005e49ec
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.005e4d06
test eax, eax
je 0x53a0db
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.005e4cc8
test eax, eax
je 0x53a0db
call fcn.005cacd5
test eax, eax
je 0x539f96
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x539f98
xor eax, eax
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x53a0db
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x53a0a9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.005c5655
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 2
movsx ax, byte [edi]
test ax, ax
je 0x53a09d
cmp ax, 0x7f
jbe 0x53a000
push eax
mov ecx, esi
call fcn.005c5397
movsx ax, byte [edi + 1]
inc edi
push eax
mov ecx, esi
call fcn.005c5397
inc edi
jmp 0x539fd4
cmp ax, 0x20
jae 0x53a00c
cmp ax, 0xd
jne 0x53a020
push eax
mov ecx, esi
call fcn.005c5397
push 0
mov ecx, esi
call fcn.005c5397
inc edi
jmp 0x539fd4
cmp ax, 9
jne 0x539ffd
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x53a069
push 0x1a35c84
lea ecx, [ebp - 0x14]
call fcn.005c5002
lea ecx, [ebp - 0x14]
push 0
push ecx
mov byte [ebp - 4], 3
call fcn.0053a1f0
add esp, 8
lea edx, [ebp - 0x14]
mov ecx, esi
push edx
call fcn.005c53ac
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.005c4f94
inc edi
jmp 0x539fd4
push 9
mov ecx, esi
call fcn.005c5397
push 0
mov ecx, esi
call fcn.005c5397
inc edi
jmp 0x539fd4
mov dword [ebp - 4], 0
call fcn.005c5693
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e4a19
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e4a19
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x543fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f92c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a30e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c210c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c211f
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
lea eax, [esp + 0x10]
push 0x19cf8a4
push eax
call fcn.005c1253
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c4d09
lea eax, [esp + 0x38]
push eax
call fcn.0053f080
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c4f94
mov ecx, dword [0x1a30e58]
mov dword [esp + 8], ecx
push 0xa2ea
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005cba8c
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c51c3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c4f94
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c4d09
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c4f94
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x544110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f9317
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a30e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c210c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c211f
mov eax, dword [eax + 0x10]
inc eax
push eax
lea eax, [esp + 0x10]
push 0x19cf8a4
push eax
call fcn.005c1253
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c4d09
lea eax, [esp + 0x38]
push eax
call fcn.0053ce80
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c4f94
mov ecx, dword [0x1a30e58]
mov dword [esp + 8], ecx
push 0xa2eb
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005cba8c
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c51c3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c4f94
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c4d09
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c4f94
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x544250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f9367
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a30e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c210c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c211f
mov eax, dword [eax + 0xc]
push eax
lea eax, [esp + 0x10]
push 0x19cf8a4
push eax
call fcn.005c1253
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c4d09
lea eax, [esp + 0x38]
push eax
call fcn.0053ce80
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c4f94
mov ecx, dword [0x1a30e58]
mov dword [esp + 8], ecx
push 0xa2ec
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005cba8c
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c51c3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c4f94
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c4d09
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c4f94
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x550620
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5fa4a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push esi
push 0x19cd558
mov ecx, 0x1a8e8cc
mov dword [esp + 0x1c], 0
call fcn.005c511d
mov esi, dword [esp + 0x434]
lea ecx, [esp + 8]
push esi
call fcn.005c5002
lea eax, [esp + 0xc]
mov ebx, 1
push 7
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], ebx
call fcn.005c0e33
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.005c54dd
mov ecx, dword [esp + 0xc]
push str.HTTP:__
push ecx
call fcn.004ae434
add esp, 8
test eax, eax
je 0x5506d3
push 0x1a36970
mov ecx, 0x1a8e8cc
call fcn.005c511d
mov esi, dword [esp + 0x430]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov dword [esp + 0x18], ebx
jmp 0x550842
push 0x2f
lea ecx, [esp + 0xc]
call fcn.005c0eab
mov edx, dword [esp + 8]
mov ecx, dword [edx - 8]
sub ecx, eax
lea eax, [esp + 0x10]
dec ecx
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.005c0db7
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x428], 3
mov eax, dword [ecx - 8]
test eax, eax
jne 0x550735
push 0x1a34f7c
mov ecx, 0x1a8e8cc
call fcn.005c511d
mov esi, dword [esp + 0x430]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov dword [esp + 0x18], ebx
jmp 0x550831
lea edx, [esp + 0x20]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x550765
mov esi, dword [esp + 0x430]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov dword [esp + 0x18], ebx
jmp 0x550831
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call fcn.005c5002
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 4
push ecx
lea ecx, [esp + 0x18]
call fcn.005c53ac
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005db896
mov ecx, dword [eax + 4]
call fcn.005caa2a
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
call fcn.005503d0
add esp, 0xc
mov byte [esp + 0x428], 5
call fcn.005db896
mov ecx, dword [eax + 4]
call fcn.005caa3f
mov edx, dword [esp + 0x1c]
mov eax, dword [edx - 8]
test eax, eax
je 0x5507f8
lea eax, [esp + 0x1c]
mov ecx, 0x1a8e8cc
push eax
call fcn.005c50cd
mov esi, dword [esp + 0x430]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
jmp 0x55080b
mov esi, dword [esp + 0x430]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005c4d09
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x428], 4
call fcn.005c4f94
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 3
call fcn.005c4f94
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 2
call fcn.005c4f94
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], bl
call fcn.005c4f94
lea ecx, [esp + 8]
mov byte [esp + 0x428], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x420]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x550a30
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5fa597
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
mov dword [esp + 0x10], 0
push 0x19cd558
mov ecx, 0x1a8e8cc
mov dword [esp + 0x438], 4
call fcn.005c511d
push 0x2f
lea ecx, [esp + 0x444]
call fcn.005c0eab
mov ecx, dword [esp + 0x440]
lea edx, [esp + 8]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
lea ecx, [esp + 0x448]
call fcn.005c0db7
mov eax, dword [esp + 8]
mov byte [esp + 0x434], 5
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x550adf
push 0x1a34f7c
mov ecx, 0x1a8e8cc
call fcn.005c511d
mov esi, dword [esp + 0x43c]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x550c68
lea ecx, [esp + 0x2c]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x550b14
mov esi, dword [esp + 0x43c]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x550c68
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
push edx
call fcn.005c5002
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x438], 6
call fcn.005c53ac
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005db896
mov ecx, dword [eax + 4]
call fcn.005caa2a
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.005c4d09
push ecx
lea eax, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x440], 7
call fcn.005c4d09
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x444], 8
call fcn.005c4d09
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x448], 9
call fcn.005c4d09
push ecx
lea edx, [esp + 0x454]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x44c], 0xa
call fcn.005c4d09
lea eax, [esp + 0x28]
mov byte [esp + 0x448], 6
push eax
call fcn.00550880
add esp, 0x18
mov byte [esp + 0x434], 0xb
call fcn.005db896
mov ecx, dword [eax + 4]
call fcn.005caa3f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
test eax, eax
je 0x550c2a
lea edx, [esp + 0x14]
mov ecx, 0x1a8e8cc
push edx
call fcn.005c50cd
mov esi, dword [esp + 0x43c]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
jmp 0x550c3d
mov esi, dword [esp + 0x43c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.005c4d09
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x434], 6
call fcn.005c4f94
lea ecx, [esp + 0xc]
mov byte [esp + 0x434], 5
call fcn.005c4f94
lea ecx, [esp + 8]
mov byte [esp + 0x434], 4
call fcn.005c4f94
lea ecx, [esp + 0x440]
mov byte [esp + 0x434], 3
call fcn.005c4f94
lea ecx, [esp + 0x444]
mov byte [esp + 0x434], 2
call fcn.005c4f94
lea ecx, [esp + 0x448]
mov byte [esp + 0x434], bl
call fcn.005c4f94
lea ecx, [esp + 0x44c]
mov byte [esp + 0x434], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x430
ret
Function at 0x550cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fa607
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x3c]
mov edi, 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], edi
call fcn.005c4d09
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
push ecx
lea ecx, [esp + 0x10]
call fcn.005c4d09
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.005c54dd
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x40]
push 7
push edx
lea ecx, [esp + 0x14]
mov dword [esi], 0
call fcn.005c0e33
mov eax, dword [eax]
push str.HTTP:__
push eax
call fcn.004ae434
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c4f94
test bl, bl
je 0x550dfa
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.00550620
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.005c50cd
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c4f94
mov eax, dword [0x1a8e8cc]
push 0x19cd558
push eax
call fcn.004ae434
add esp, 8
test eax, eax
je 0x550eeb
mov edx, dword [0x1a8e8cc]
push 0
push 0
push edx
call fcn.005d150e
mov esi, dword [esp + 0x38]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
mov dword [esp + 0x14], edi
jmp 0x550f01
lea eax, [esp + 0x40]
push 4
push eax
lea ecx, [esp + 0x14]
call fcn.005c0e33
mov eax, dword [eax]
push str.FTP:
push eax
call fcn.004ae434
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c4f94
test bl, bl
je 0x550eed
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x1a8e8c0
call fcn.005c4d09
push ecx
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x1a8e8c4
call fcn.005c4d09
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x1a8e8c8
call fcn.005c4d09
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 7
call fcn.005c4d09
lea eax, [esp + 0x50]
mov byte [esp + 0x40], 3
push eax
call fcn.00550a30
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 8
call fcn.005c50cd
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c4f94
mov eax, dword [0x1a8e8cc]
push 0x19cd558
push eax
call fcn.004ae434
add esp, 8
test eax, eax
je 0x550eeb
mov ecx, dword [0x1a8e8cc]
push 0
push 0
push ecx
call fcn.005d150e
mov esi, dword [esp + 0x38]
push 0x19cd558
mov ecx, esi
call fcn.005c5002
jmp 0x550efd
mov dword [esi], edi
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.005c4d09
mov dword [esp + 0x14], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.005c4f94
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.005c4f94
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005c4f94
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x554700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5faa28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0x20]
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
mov dword [esi], 0x19da53c
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 4], edi
je 0x554791
mov ecx, ebx
call fcn.00555060
cmp eax, edi
mov dword [esi + 0x2c], eax
jbe 0x554791
push edi
mov ecx, esi
call fcn.00555120
test eax, eax
je 0x554791
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebx + 0x28]
mov edx, dword [esi + 0x28]
push eax
push ecx
push edx
call fcn.004ae7f0
mov eax, dword [esi + 8]
add esp, 0xc
cmp word [eax], 0x4d42
jne 0x554791
mov ecx, dword [eax + 0xa]
mov edx, dword [esi + 0xc]
add ecx, eax
xor eax, eax
mov dword [esi + 0x1c], ecx
mov ax, word [edx + 0xe]
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x554d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5faab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
call fcn.005c5655
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, edi
mov byte [ebp - 4], 1
mov eax, dword [edi]
call dword [eax + 0x30]
push 0
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.00555120
test eax, eax
je 0x554de4
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [edi]
push eax
push ecx
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ecx
jne 0x554deb
call fcn.005c5693
mov eax, dword [esi + 8]
cmp word [eax], 0x4d42
jne 0x554df0
mov ecx, dword [eax + 0xa]
mov edx, dword [esi + 0xc]
add ecx, eax
xor eax, eax
mov dword [esi + 0x1c], ecx
mov ax, word [edx + 0xe]
mov dword [esi + 0x30], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
call fcn.005c5693
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x556af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fadec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x20], 0
call fcn.005c4d09
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.0052af70
mov eax, dword [0x1a30e58]
lea ecx, [esi + 0x19c]
mov dword [ecx], eax
mov edx, dword [0x1a30e58]
lea edi, [esi + 0x1a4]
mov dword [edi], edx
push 0x19cd558
mov byte [esp + 0x1c], 3
mov dword [esi], 0x19dadc8
call fcn.005c511d
push 0
call fcn.004b0b50
push eax
call fcn.004add02
add esp, 8
call fcn.004add0f
push 0x19cd558
mov ecx, edi
mov dword [esi + 0x1a0], eax
call fcn.005c511d
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], 0xffffffff
call fcn.005c4f94
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x1c
Function at 0x57b7cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5fe0c8
push eax
mov al, byte [0x1a8e978]
mov dword fs:[0], esp
sub esp, 0x14
test al, 1
push ebp
push esi
push edi
mov esi, ecx
jne 0x57b65e
mov dl, al
push 0x57b890
or dl, 1
mov byte [0x1a8e978], dl
call fcn.004af3ba
add esp, 4
mov al, byte [0x1a8e978]
test al, 2
jne 0x57b67f
mov dl, al
push 0x57b880
or dl, 2
mov byte [0x1a8e978], dl
call fcn.004af3ba
add esp, 4
mov eax, dword [0x1a30e58]
mov dword [esp + 0xc], eax
mov ecx, dword [0x1a8e968]
mov eax, dword [0x1a8e970]
test ecx, ecx
mov dword [esp + 0x28], 0
jne 0x57b719
test eax, eax
jne 0x57b719
mov edx, dword [0x1a8e96c]
test edx, edx
jne 0x57b719
mov edx, dword [0x1a8e974]
test edx, edx
jne 0x57b719
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.005c9e4c
mov edx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
push 0x1a8e968
push edx
mov edi, eax
call ebp
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call ebp
mov edx, dword [0x1a8e96c]
mov ecx, dword [0x1a8e968]
mov eax, dword [0x1a8e970]
mov dword [0x1a8e95c], edx
mov edx, dword [0x1a8e974]
mov dword [0x1a8e958], ecx
mov dword [0x1a8e964], edx
mov edx, dword [esp + 0x14]
mov dword [0x1a8e960], eax
mov dword [0x1a8e964], edx
mov edx, dword [esp + 0x34]
push 6
test edx, edx
je 0x57b7ab
mov edx, dword [0x1a8e974]
mov ebp, dword [0x1a8e96c]
sub edx, ebp
sub eax, ecx
push edx
push eax
push 0
push 0
push 0x1a8dd60
mov ecx, esi
call fcn.005ca12d
push 0xa240
lea ecx, [esp + 0x10]
call fcn.005cba8c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x34]
push eax
push 0x1a37fe8
push ecx
call fcn.005c529d
push 0x1a37fe4
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x34], 1
call fcn.005c5229
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.005c4f94
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
jmp 0x57b834
mov eax, dword [0x1a8e964]
mov edi, dword [0x1a8e95c]
mov ecx, dword [0x1a8e958]
sub eax, edi
push eax
mov eax, dword [0x1a8e960]
sub eax, ecx
mov ecx, esi
push eax
push 0
push 0
push 0x1a8dd60
call fcn.005ca12d
push 0xa240
lea ecx, [esp + 0x10]
call fcn.005cba8c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x34]
push eax
push 0x1a37fe8
push ecx
call fcn.005c529d
push 0x1a37fe0
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.005c5229
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.005c4f94
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
call fcn.005c4f94
mov ecx, esi
call fcn.005a84c0
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 3
call fcn.005c9f0b
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 8