joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502520
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x60]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x5025cf
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 0x34]
shr eax, 8
cmp al, 2
jne 0x5025cf
test edi, edi
je 0x5025cf
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ebx
lea ecx, [esi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x50257b
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x50257b
mov eax, dword [edi + 0x2c]
jmp 0x5025a0
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x58]
test ecx, ecx
mov ecx, ebx
jne 0x502589
mov ecx, ebp
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x50259e
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x5025a0
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.00502450
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x5025c6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5025cf
push 0
mov ecx, esi
call fcn.005023d0
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x506340
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004acc20
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004adc80
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 9
jne 0x506408
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esi + 0xf8]
jl 0x5063bd
test eax, eax
je 0x506381
mov eax, dword [eax + 0x14]
inc eax
jmp 0x506383
xor eax, eax
mov edx, dword [esi + 0xd8]
mov ecx, dword [esi + 0x104]
cmp eax, edx
jl 0x5063aa
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, ecx
jne 0x5063b0
xor eax, eax
push eax
mov ecx, esi
call fcn.005062c0
pop edi
pop esi
ret 0xc
test eax, eax
je 0x5063c6
mov eax, dword [eax + 0x14]
jmp 0x5063cc
mov eax, dword [esi + 0xd8]
dec eax
test eax, eax
jge 0x5063e9
mov eax, dword [esi + 0x104]
test eax, eax
je 0x5063f4
dec eax
mov ecx, esi
push eax
call fcn.005062c0
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jne 0x5063fb
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, 0x25
jne 0x50645d
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x506521
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x506521
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
test ecx, ecx
lea eax, [ecx - 1]
jg 0x50643a
lea eax, [edi - 1]
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x506450
mov eax, ecx
push eax
mov ecx, esi
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, 0x27
jne 0x5064b4
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x506521
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x506521
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
dec edi
cmp ecx, edi
jge 0x50648f
lea eax, [ecx + 1]
jmp 0x506491
xor eax, eax
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x5064a7
mov eax, ecx
push eax
mov ecx, esi
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, 0x28
jne 0x5064e8
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x5064c9
mov eax, dword [eax + 0x14]
inc eax
jmp 0x5064cb
xor eax, eax
mov ecx, dword [esi + 0xd8]
xor edx, edx
cmp eax, ecx
mov ecx, esi
setge dl
dec edx
and edx, eax
push edx
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, 0x26
jne 0x506513
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x5064ff
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jge 0x506506
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.005062c0
pop edi
pop esi
ret 0xc
cmp eax, 0x10
je 0x506521
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
ret 0xc
Function at 0x508880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60dfc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, vtable.CRgn.0
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call esi
push eax
lea ecx, [esp + 0x10]
call fcn.005e7cfd
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
push 0xfffffffffffffffc
lea edx, [esp + 0x18]
push 0xfffffffffffffffc
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x14]
push eax
call esi
push eax
lea ecx, [esp + 8]
call fcn.005e7cfd
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.005e7cfd
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
neg eax
mov edx, dword [esp + 0x10]
push 3
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, vtable.CGdiObject.0
mov dword [esp + 4], esi
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.005e7d54
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call fcn.005e7d54
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x50e3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60e3be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005e2b00
xor edi, edi
mov eax, 0xa
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], 0x656788
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x64caa0
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov dword [esi + 0x80], eax
mov dword [esi], method.COleControlContainer.virtual_0
mov dword [esi + 0x7c], 1
mov dword [edx], ecx
xor eax, eax
push esi
push 4
mov dword [edx + 4], ecx
mov byte [esp + 0x1c], 2
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea ecx, [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx]
call dword [edx + 0xc4]
mov ecx, dword [esi + 0x80]
mov dword [esi + 0x20], eax
push esi
push 2
mov eax, dword [ecx]
call dword [eax + 0xc4]
cmp eax, edi
je 0x50e48b
lea ecx, [eax - 0x1c]
jmp 0x50e48d
xor ecx, ecx
mov edx, dword [esi + 0x80]
mov dword [esi + 0x1c], ecx
mov eax, dword [edx + 0x80]
mov edx, dword [esi + 0x20]
push eax
push 1
push edx
call fcn.0051ae50
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x510400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x60e588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x64caa0
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xa
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push edi
mov eax, dword [ecx]
mov dword [esp + 0x3c], edi
call dword [eax + 0xc]
cmp dword [esp + 0x1c], edi
jne 0x510481
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 1
cmp eax, edi
je 0x510584
mov eax, dword [eax]
cmp eax, edi
jne 0x510476
jmp 0x510584
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x510491
add eax, 0xffffffe4
jmp 0x510493
xor eax, eax
push eax
mov ecx, ebp
call fcn.00510280
cmp eax, edi
mov dword [esp + 0x40], eax
je 0x51056a
cmp dword [eax + 8], edi
je 0x51056a
mov ecx, dword [esp + 0x3c]
mov esi, dword [ecx + 0x78]
cmp esi, edi
je 0x510501
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x5104cb
lea ebx, [eax - 0x3c]
jmp 0x5104cd
xor ebx, ebx
lea ecx, [ebx + 0x3c]
call fcn.0056fea0
cmp eax, edi
je 0x5104f8
add eax, 0xffffffe4
cmp eax, edi
je 0x5104f8
push eax
mov ecx, ebp
call fcn.00510280
cmp eax, edi
je 0x5104f8
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + 8]
je 0x51051d
cmp esi, edi
jne 0x5104bb
mov ebx, 0x64caa0
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 4
cmp eax, edi
je 0x510584
mov eax, dword [eax]
cmp eax, edi
jne 0x510515
jmp 0x510584
lea ecx, [esp + 0x10]
push 2
push ecx
push ebx
mov ecx, ebp
call fcn.00510390
mov dword [esp + 0x10], 0x64caa0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
cmp eax, edi
je 0x51054a
mov eax, dword [eax]
cmp eax, edi
jne 0x510544
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005ddd00
mov eax, 1
jmp 0x51059f
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 2
cmp eax, edi
je 0x510584
mov eax, dword [eax]
cmp eax, edi
jne 0x51057e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.005ddd00
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x512230
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x5122b7
lea edi, [esi + 0xcc]
push 0x11
mov ecx, edi
call fcn.0056fee0
test eax, eax
jne 0x5122b7
mov ecx, edi
call fcn.00516890
mov edi, dword [eax + 0xec]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call fcn.00511430
test eax, eax
je 0x512283
add eax, 0x3c
jmp 0x512285
xor eax, eax
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov ecx, edi
call fcn.005083f0
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x51fa8a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x60efa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esi + 0xe0]
mov ecx, eax
mov eax, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
je 0x51fad0
mov eax, ebp
sub eax, edi
jmp 0x51fad2
sub eax, ebx
sub eax, edx
mov edx, dword [esi + 0x214]
dec eax
test ecx, ecx
je 0x51fae7
push 0
push eax
push 0
push edx
jmp 0x51faed
push eax
push 0
push edx
push 0
lea ecx, [esp + 0x28]
call fcn.005f4d00
mov eax, dword [esi + 0x20]
test eax, eax
je 0x51fb13
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
mov eax, dword [ecx + 0x148]
test eax, eax
jne 0x51fb1b
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x51fb40
mov eax, dword [esp + 0x4c]
push 0xf
sub eax, ebx
mov ecx, esi
mov ebp, eax
call fcn.0051d120
mov edx, dword [esp + 0x20]
push eax
add edx, 2
push ebp
push edx
jmp 0x51fb55
push 0xf
mov ecx, esi
sub ebp, edi
call fcn.0051d120
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push ebp
push ebx
push edi
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.005f4ac5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x51fb6f
lea ebx, [ecx + 0x3c]
jmp 0x51fb71
xor ebx, ebx
lea edx, [esp + 0x3c]
push edx
call fcn.00517c70
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x3c], 0
sub esp, 0x10
mov eax, esp
push ebx
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.005e3750
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18
Function at 0x534b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60ff70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, 0xaa
mov ecx, 0x55
xor esi, esi
mov word [esp + 0x20], cx
mov word [esp + 0x22], ax
mov word [esp + 0x24], cx
mov word [esp + 0x26], ax
mov word [esp + 0x28], cx
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], vtable.CBitmap.0
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.005e7cfd
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], vtable.CBrush.0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
mov byte [esp + 0x38], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.005e7cfd
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005e72f3
mov ebp, dword [esi]
push 0xf
mov ecx, edi
mov ebx, eax
call fcn.0049c0a0
push eax
mov ecx, esi
call dword [ebp + 0x2c]
mov edx, dword [esi]
push 0x14
mov ecx, edi
mov ebp, eax
mov dword [esp + 0x44], edx
call fcn.0049c0a0
mov edx, dword [esp + 0x40]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edx
sub eax, edi
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call fcn.005e72f3
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0x10]
call fcn.005e7d54
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.005e7d54
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 3
call fcn.005e7d54
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x54bed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x610b08
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [ebp + 8], 0
call fcn.005e7d54
mov esi, dword [esp + 0x48]
test esi, esi
je 0x54bf77
push edi
mov edi, dword [esp + 0x48]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
pop edi
je 0x54bf77
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x54bf77
cmp ebx, 0xa
jb 0x54bf77
push 0
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.005ef8ff
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
mov dword [esp + 0x40], 0
call fcn.0054bf90
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.005ef978
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8
Function at 0x54cbf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x610c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
mov edx, dword [esp + 0x80]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x84]
push 5
mov eax, dword [esi + 0x78]
push 3
mov ebx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x18]
lea eax, [esp + 0x34]
add ebp, edx
push eax
sub edi, ebx
mov dword [esp + 0x1c], ebp
call fcn.004ad5c0
mov ecx, dword [eax]
add esp, 0xc
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x5c]
mov ebx, dword [eax + 4]
push esi
call fcn.005e7a55
lea edx, [esi + 0x7c]
lea eax, [esp + 0x5c]
push edx
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x80], 0
call fcn.004ac0a0
push str.XXXXXXXXXX
lea ecx, [esp + 0x88]
mov byte [esp + 0x7c], 1
call fcn.005e37be
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x84]
call fcn.005e3750
mov edx, dword [esp + 0x20]
lea eax, [edx + ebx]
mov ebx, dword [esi + 0x6c]
dec ebx
mov dword [esp + 0x28], eax
test ebx, ebx
jl 0x54cd8c
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [0x7815b4]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x84], ecx
lea edx, [esp + 0x84]
mov ecx, ebp
push edx
mov byte [esp + 0x7c], 2
call fcn.005e05b7
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x2c]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jg 0x54cd22
mov eax, ecx
mov ecx, dword [esp + 0x34]
mov edx, edi
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
sub edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], edx
test ebp, ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ecx
je 0x54cd4f
mov ebp, dword [ebp + 0x1c]
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x3c]
push edx
push ebp
push eax
call fcn.005e18af
mov ecx, dword [esi + 0x78]
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x78], 1
mov edx, dword [ecx + 0x14]
lea ecx, [esp + 0x84]
add edx, ebp
sub edi, edx
call fcn.005e3750
dec ebx
jns 0x54ccd1
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x78], 0
mov dword [esi + 0xc0], ecx
lea ecx, [esp + 0x4c]
mov dword [esi + 0xc4], eax
call fcn.004ac100
lea ecx, [esp + 0x5c]
mov dword [esp + 0x78], 0xffffffff
call fcn.005e7ac7
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc
Function at 0x553a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6113f0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
mov dword [edi], 0
call fcn.005f9649
mov ebp, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [ebp], eax
mov al, byte [esi + 0x60]
test al, 1
je 0x553ac2
mov eax, dword [esi + 0x68]
test eax, eax
je 0x553ac2
push eax
lea ecx, [esp + 0x10]
call fcn.005e54f6
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call fcn.005e55d4
mov dword [edi], eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0xc]
jmp 0x553b5f
call fcn.005f9649
mov eax, dword [eax + 0xc]
test eax, eax
mov dword [ebp], eax
jne 0x553ae5
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov ecx, dword [esi + 0x68]
push 5
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x553b0a
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov edx, dword [ebp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [edi], eax
jne 0x553b2f
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [esp + 0x1c]
call fcn.005e54f6
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.005e55d4
mov dword [edi], eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.005e55c6
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x554e20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61147b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
push 0x796570
lea ecx, [esi + 0x2c]
mov dword [esp + 0xc], esi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
call fcn.005e37be
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.005557f0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x70], 0x65ae5c
mov dword [esi + 0x74], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov dword [esi], 0x65ae48
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x554ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6114b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x65ae48
mov dword [esp + 0x14], 2
call fcn.00554f60
lea eax, [esi + 0x70]
mov dword [esp + 8], eax
mov dword [eax], method.CCommandLineInfo.virtual_0
mov eax, dword [eax + 4]
mov byte [esp + 0x14], 3
test eax, eax
je 0x554f24
push eax
call fcn.005decb5
add esp, 4
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.00555870
lea ecx, [esi + 0x2c]
mov dword [esp + 0x14], 0xffffffff
call fcn.005e3750
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret