joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475a30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
cmp esi, 8
mov edi, ecx
je 0x475a75
cmp esi, 0x21
jb 0x475a4a
cmp esi, 0x2e
jbe 0x475a75
cmp esi, 0x43
je 0x475a5e
cmp esi, 0x56
je 0x475a5e
cmp esi, 0x58
je 0x475a5e
cmp esi, 0x5a
jne 0x475a6b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x475a75
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x1c]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
call fcn.006219a7
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x1c
ret 8

Function at 0x475ca0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x475cb8
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov ebx, dword [esp + 0x28]
cmp ebx, 0x26
je 0x475cd0
cmp ebx, 0x28
je 0x475cd0
cmp ebx, 0x22
je 0x475cd0
cmp ebx, 0x21
jne 0x475cdd
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x475ce7
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [edi + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 1
push eax
call esi
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
neg eax
sbb eax, eax
pop esi
pop edi
pop ebx
neg eax
add esp, 0x1c
ret 8

Function at 0x47ae10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
lea ebx, [edi + 0x3c]
push ecx
mov ecx, ebx
call fcn.0043df90
mov edx, dword [esp + 0x18]
mov esi, eax
push edx
mov ecx, esi
call fcn.0043c5a0
mov ebp, dword [esp + 0x1c]
mov ecx, esi
push ebp
call fcn.0043c720
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x47ae5a
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 4]
test ebp, ebp
je 0x47ae67
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x47ae7f
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x47ae7f
push 0
mov ecx, ebx
call fcn.0043e250
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4817e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov edi, ecx
push 1
call esi
test ax, ax
jl 0x4818cf
push 2
call esi
test ax, ax
jl 0x4818cf
push 4
call esi
test ax, ax
jl 0x4818cf
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi + 0x44]
xor ebp, ebp
test eax, eax
jle 0x4818cf
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [edi + 0x40]
mov esi, dword [ecx + ebp*4]
mov edx, dword [esi + 0x20]
push edx
call ebx
test eax, eax
je 0x4818c3
mov eax, dword [esi + 0x20]
push eax
call fcn.0061e658
lea ecx, [esi + 0xc]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x20], edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x24], ecx
mov cl, byte [esi + 8]
test cl, 1
je 0x481885
mov eax, dword [eax + 0x1c]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x481891
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0062951c
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4818c3
test byte [esi + 8], 1
jne 0x4818d9
lea edx, [esp + 0x10]
mov ecx, edi
push edx
push 0
call fcn.004813a0
cmp eax, dword [esi + 0x20]
je 0x4818d9
mov eax, dword [edi + 0x44]
inc ebp
cmp ebp, eax
jl 0x481834
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x485ac0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x660308
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x485b93
call fcn.00485a70
mov ecx, dword [esi]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x485b93
mov eax, dword [esp + 0x18]
test eax, eax
je 0x485b93
mov eax, dword [esp + 0x14]
test eax, eax
je 0x485b93
lea ecx, [esp + 8]
call fcn.0061a90d
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 1
push 0
push 0x19
push edx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0
call fcn.0061a9d2
mov esi, dword [esi]
push esi
call fcn.00629d65
test eax, eax
je 0x485b51
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.0061a936
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x488a00
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x660588
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebp
push esi
mov esi, dword [esp + 0x44]
push edi
test esi, esi
jne 0x488a27
xor eax, eax
jmp 0x488a2a
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
je 0x488b7c
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0061e658
mov ebp, eax
test ebp, ebp
je 0x488a54
mov eax, dword [ebp + 0x1c]
push eax
call edi
test eax, eax
je 0x488b7c
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x488a75
mov eax, dword [edi + 4]
test eax, eax
je 0x488a75
mov ecx, edi
call fcn.00629dd1
push esi
lea ecx, [esp + 0x1c]
call fcn.00485c50
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.006294e0
mov edx, dword [ebp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00628a7e
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.006289dc
test esi, esi
mov dword [esp + 0x40], 0
jne 0x488ab6
xor eax, eax
jmp 0x488ab9
mov eax, dword [esi + 4]
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x30]
call fcn.00628a93
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
sub eax, ecx
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esi + 4]
sub ecx, ebx
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.00629d7a
lea ecx, [esp + 0x2c]
push edi
push ecx
lea ecx, [esp + 0x18]
call fcn.00486370
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub eax, edx
sub ecx, edi
test esi, esi
jne 0x488b1e
xor ebx, ebx
jmp 0x488b21
mov ebx, dword [esi + 4]
push 0xcc0020
push edx
mov edx, dword [esp + 0x38]
push edi
push ebx
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x10]
call fcn.00486410
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xffffffff
call fcn.00628b11
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0x48a0c0
Capabilities:
Get geographical location

Disassembly:
mov edx, dword [ecx]
sub esp, 8
lea eax, [esp]
push 4
push eax
push 0xd
call dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp]
push eax
call fcn.005fc392
neg eax
sbb eax, eax
neg eax
add esp, 0xc
ret
Function at 0x48fc90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [esp + 0x3c]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x48fd1a
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x44]
push 0
push ecx
lea edx, [esp + 0x10]
push 0xe
push edx
push esi
call edi
test eax, eax
je 0x48fd13
cmp dword [esp + 0x44], 0xe
jne 0x48fd13
lea eax, [esp + 0x44]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x28
push ecx
push esi
call edi
test eax, eax
je 0x48fd13
cmp dword [esp + 0x44], 0x28
jne 0x48fd13
xor edx, edx
cmp word [esp + 0x26], 0x20
push esi
sete dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x38
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x38
ret

Function at 0x48fd30
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebp
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x48fdc4
lea ecx, [esp + 4]
push 0
push ecx
lea edx, [esp + 0x10]
push 4
push edx
push ebp
mov byte [esp + 0x24], 0x89
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x26], 0x4e
mov byte [esp + 0x27], 0x47
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48fdbd
cmp dword [esp + 4], 4
jne 0x48fdbd
push ebx
push esi
push edi
mov ecx, 4
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x48fda7
sbb ebx, ebx
sbb ebx, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebx
sete al
pop ebp
add esp, 8
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
add esp, 8
ret

Function at 0x4900b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0x763c24
push eax
push esi
mov byte [esp + 0x10], 0x89
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], 0x4e
mov byte [esp + 0x13], 0x47
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4900e2
pop esi
pop ecx
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4900f1
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax]
lea ecx, [esp + 4]
xor eax, eax
mov esi, dword [ecx]
cmp edx, esi
pop esi
sete al
pop ecx
ret

Function at 0x490110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x490129
pop esi
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x490137
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x490144
pop esi
ret
xor ecx, ecx
cmp word [eax + 0xe], 0x20
pop esi
sete cl
mov eax, ecx
ret
Function at 0x490430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x660ae8
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x490477
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x490496
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4904b6
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ebx, dword [ebp + 8]
mov dword [esp + 0x34], 0
imul ebx, dword [ebp + 4]
shl ebx, 2
cmp word [ebp + 0xe], 0x20
jne 0x4905bb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x4905bb
lea ecx, [esp + 0x14]
call fcn.006289dc
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.00628a93
push 0x34
call fcn.005fbf90
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x490543
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00628b11
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, 0xa
mov esi, ebp
mov edi, edx
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
neg eax
mov dword [edx + 0x14], ebx
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x3c]
sbb eax, eax
push 0
push ecx
and eax, esi
push 0
push edx
push eax
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x49059d
mov edi, dword [esp + 0x38]
test edi, edi
je 0x49059d
mov ecx, ebx
lea esi, [ebp + 0x28]
mov edx, ecx
mov dword [esp + 0x34], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call fcn.005fc0ca
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00628b11
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x492f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x660d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 0x14]
call fcn.006289dc
xor ebx, ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.00628a93
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00492e40
add esp, 0x14
test eax, eax
jne 0x493019
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00628b11
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 8]
push ebp
neg eax
sbb eax, eax
push edi
and eax, edx
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, ebx
je 0x493067
cmp ebp, ebx
je 0x493067
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x49307c
push eax
call fcn.005fc0ca
add esp, 4
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x493091
push eax
call fcn.005fc0ca
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x49309f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00628b11
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4959f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
and edi, 0xffff
jne 0x495a05
pop edi
xor eax, eax
pop esi
ret 0x10
call fcn.0063f37c
mov esi, dword [eax + 0xc]
push 0xf1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x495a23
pop edi
pop esi
ret 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x495a34
pop edi
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x495a46
pop edi
pop esi
ret 0x10
xor eax, eax
push ebx
mov ax, word [esi + 6]
push ebp
shl eax, 2
push eax
call fcn.0061d6a5
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edi, edi
add esp, 4
mov dword [ebp], eax
mov dword [ebx], 0
cmp word [esi + 6], di
jbe 0x495aa6
mov ecx, esi
call fcn.00495ad0
cmp word [eax + edi*2], 0
je 0x495a9b
mov ecx, esi
call fcn.00495ad0
mov edx, dword [ebx]
xor ecx, ecx
mov cx, word [eax + edi*2]
mov eax, dword [ebp]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
xor ecx, ecx
inc edi
mov cx, word [esi + 6]
cmp edi, ecx
jl 0x495a73
mov edx, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 2]
xor ecx, ecx
mov cx, word [esi + 4]
pop ebp
pop ebx
mov dword [edx], eax
pop edi
mov dword [edx + 4], ecx
mov eax, 1
pop esi
ret 0x10
Function at 0x495f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x661020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x70]
push 0xe
push edi
mov dword [esp + 0x18], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x49606e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4960e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4960e1
xor ebx, ebx
cmp word [ebp + 4], bx
jbe 0x49604f
lea ecx, [esp + 0x14]
call fcn.004920f0
mov eax, ebx
xor edx, edx
and eax, 0xffff
mov dword [esp + 0x64], 0
lea ecx, [eax*8]
sub ecx, eax
mov dl, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
xor ecx, ecx
mov edi, edx
mov cl, byte [eax + 6]
mov esi, ecx
mov ecx, dword [esp + 0x78]
cmp ecx, esi
jne 0x495fe9
cmp dword [esp + 0x7c], edi
je 0x495ff5
test ecx, ecx
jne 0x496033
mov ecx, dword [esp + 0x7c]
test ecx, ecx
jne 0x496033
xor edx, edx
push 0
mov dx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00492780
test eax, eax
je 0x496059
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push esi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00495ca0
test eax, eax
je 0x496059
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004923f0
inc ebx
cmp bx, word [ebp + 4]
jb 0x495fa7
mov eax, 1
jmp 0x4960e1
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0xffffffff
call fcn.004923f0
xor eax, eax
jmp 0x4960e1
lea ecx, [esp + 0x38]
call fcn.004920f0
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
push 0
push ebx
push ebp
push edi
push esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 1
call fcn.00492780
test eax, eax
jne 0x4960af
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], 0xffffffff
call fcn.004923f0
xor eax, eax
jmp 0x4960e1
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebp
lea eax, [esp + 0x44]
push edx
push eax
call fcn.00495ca0
lea ecx, [esp + 0x38]
mov esi, eax
mov dword [esp + 0x64], 0xffffffff
call fcn.004923f0
mov eax, esi
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0x18
Function at 0x4961e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x661058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x1c], ecx
je 0x49620f
mov eax, dword [ebx + 4]
test eax, eax
jne 0x496216
xor eax, eax
jmp 0x496371
mov edi, dword [esp + 0x6c]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test edi, edi
jne 0x496235
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x496235
push eax
call esi
mov dword [esp + 0x6c], eax
mov edi, eax
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x496286
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x496286
test edi, edi
jle 0x496286
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, ebp
sub ecx, edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov ecx, dword [ebx + 4]
push ecx
call esi
xor edx, edx
cmp eax, edi
sete dl
xor ebx, ebx
mov dword [esp + 0x18], edx
test edi, edi
mov dword [esp + 0x14], ebx
jle 0x49636c
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4962d6
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4962d6
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x496350
cmp eax, 0xdeadbeaf
je 0x496350
mov edx, dword [esp + 0x64]
push 0
push ebx
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov esi, eax
test esi, esi
je 0x49620f
mov eax, dword [esp + 0x68]
test eax, eax
je 0x496301
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
jmp 0x496305
mov edi, dword [esp + 0x14]
push 1
push esi
lea ecx, [esp + 0x38]
call fcn.00492100
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ebp
push edx
push eax
lea ecx, [esp + 0x3c]
push edi
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x70], 0
call fcn.00495ca0
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.004923f0
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov edi, dword [esp + 0x6c]
inc ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jl 0x4962b1
mov eax, 1
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x18