joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478c90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x218], eax
mov edx, 0x104
mov dword [eax], 0
mov eax, ecx
push edi
mov dword [ebp - 0x210], ebx
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x478cee
movzx eax, word [esi + ecx]
test ax, ax
je 0x478cee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x478cd0
lea eax, [ecx - 2]
test edx, edx
push 0x5f74c8
cmovne eax, ecx
xor ecx, ecx
push 0x104
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.00478a30
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x478d92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x478de6
mov eax, dword [ebp + 4]
push 0x5f7470
push 0xc9
push eax
call fcn.00477e10
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x478de6
mov eax, dword [ebp + 4]
push edi
push 0x5f7470
push 0x62
push eax
call fcn.00477e60
mov ecx, dword [ebp + 4]
push edi
push 0x5f7470
push 0x6b
push ecx
call fcn.00477e60
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push esi
call fcn.00476f00
mov edi, eax
add esp, 8
test edi, edi
jns 0x478dd2
mov eax, dword [ebp + 4]
push edi
push 0x5f7470
push 0xcf
push eax
call fcn.00477e60
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x478e08
jmp 0x478d5a
mov eax, dword [ebp - 0x210]
cdq
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x478e1b
mov ecx, dword [ebp - 0x218]
lea eax, [ebx*4]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 4]
push str.G:Projectscommoncore_winwil_resource.h
push 0x93e
push eax
call fcn.00479000
mov eax, dword [ebp + 4]
push str.G:Projectscommoncore_winwil_resource.h
push 0x93e
push eax
call fcn.00479000
int3
Function at 0x47ade0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5daed0
mov eax, dword fs:[0]
push eax
mov eax, 0x3044
call fcn.0059a8e0
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x47afe9
lea eax, [ebp - 0x3020]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x800
lea eax, [ebp - 0x2010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [ebp - 0x3038]
push eax
call fcn.0047b5d0
add esp, 4
mov esi, eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x47ae78
mov esi, dword [esi]
call fcn.0047ad40
cmp dword [eax + 0x2c], 8
lea ecx, [eax + 0x18]
jb 0x47ae88
mov ecx, dword [ecx]
movzx eax, word [ebp - 0x3014]
push eax
movzx eax, word [ebp - 0x3016]
push eax
movzx eax, word [ebp - 0x3018]
push eax
movzx eax, word [ebp - 0x301a]
push eax
movzx eax, word [ebp - 0x301e]
push eax
movzx eax, word [ebp - 0x3020]
push eax
push esi
push ecx
lea eax, [ebp - 0x2010]
push eax
push str._s__s__s__d__d__d__d._d._d.dmp
lea eax, [ebp - 0x3010]
push 0x800
push eax
call fcn.004729f0
add esp, 0x30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3038]
call fcn.00404866
lea eax, [ebp - 0x1010]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x3010]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x303c], eax
cmp eax, 0xffffffff
je 0x47afe9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push str.MiniDumpWriteDump
push edi
mov dword [ebp - 0x3050], eax
mov dword [ebp - 0x304c], ebx
mov dword [ebp - 0x3048], 0
mov dword [ebp - 0x3044], 0
mov dword [ebp - 0x3040], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x47afe9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x3044]
push ecx
push 0
lea ecx, [ebp - 0x3050]
push ecx
push 0
push dword [ebp - 0x303c]
push eax
push esi
call ebx
test eax, eax
je 0x47afe9
push dword [ebp - 0x303c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x669540]
test eax, eax
je 0x47afe5
lea ecx, [ebp - 0x1010]
push ecx
call eax
add esp, 4
mov al, 1
jmp 0x47afeb
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x47b500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernelbase
call edi
test eax, eax
je 0x47b529
push 0x5f7748
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x47b54a
push str.kernel32
call edi
test eax, eax
je 0x47b5c8
push 0x5f7748
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47b5c8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 7
push esi
call edi
test eax, eax
je 0x47b5c8
cmp byte [ebp + 8], 0
jne 0x47b59a
mov eax, dword [esi]
mov dword [0x669544], eax
movzx eax, word [esi + 4]
mov word [0x669548], ax
movzx eax, byte [esi + 6]
mov byte [0x66954a], al
mov eax, dword [0x5f7764]
mov dword [esi], eax
movzx eax, word [0x5f7768]
mov word [esi + 4], ax
movzx eax, byte [0x5f776a]
jmp 0x47b5b9
cmp byte [0x669544], 0
je 0x47b5bc
mov eax, dword [0x669544]
mov dword [esi], eax
mov ax, word [0x669548]
mov word [esi + 4], ax
mov al, byte [0x66954a]
mov byte [esi + 6], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 7
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47b5d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dafb7
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], 0
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx edi, ax
shr edi, 8
call dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
movzx eax, al
push eax
push str._d._d
lea eax, [ebp - 0x210]
push 0xff
push eax
call fcn.004729f0
lea eax, [ebp - 0x210]
add esp, 0x14
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b670
sub eax, edx
mov ecx, ebx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040656e
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x23c], 9
mov ecx, ebx
push 4
jne 0x47b6b0
push 0x5f7718
jmp 0x47b6b5
push 0x5f7724
call fcn.0040656e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x47db20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db1dd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
lea esi, [ecx + 2]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47db74
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004049aa
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], 0
lea ecx, [edx - 1]
cmp edx, ecx
jbe 0x47dd0c
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edi, 8
cmovae eax, ebx
cmp word [eax + ecx*2], 0x5c
jne 0x47dc47
cmp edx, ecx
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
cmovb ecx, edx
mov dword [ebp - 0x2c], 7
cmp edi, 8
push ecx
cmovae eax, ebx
lea ecx, [ebp - 0x40]
push eax
call fcn.004049aa
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47dc23
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47dc19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47dd11
push edx
push ecx
call fcn.00599f8e
add esp, 8
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
push 0
push str.RegEdit_RegEdit
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x47dca1
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x47dca1
push eax
push 0
push 0x100401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x47dca1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
cmp edi, 8
lea eax, [ebp - 0x28]
cmovae eax, ebx
push eax
call fcn.0047d860
mov edx, dword [ebp - 0x14]
add esp, 8
mov esi, eax
cmp edx, 8
jb 0x47dcee
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47dce4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47dd11
push edx
push ecx
call fcn.00599f8e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
call fcn.00404954
call fcn.005a1930
int3
Function at 0x484010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db430
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.0059a8e0
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
cmp dword [eax + 0x10], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x103c], ecx
mov dword [ebp - 0x1030], eax
jne 0x484074
push ebx
push esi
push edi
push ecx
call fcn.00484870
add esp, 0x10
jmp 0x484255
lea eax, [ebp - 0x1028]
push eax
call fcn.00484290
add esp, 4
cmp dword [ebp - 0x1018], 0
mov dword [ebp - 4], 0
je 0x484220
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x1029], 0
mov dword [ebp - 0x1034], esi
jb 0x4840b2
mov eax, dword [esi]
mov dword [ebp - 0x1034], eax
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x1038], edi
jb 0x4840c6
mov eax, dword [edi]
mov dword [ebp - 0x1038], eax
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x4840d0
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x1030]
cmp dword [ecx + 0x14], 8
jb 0x4840de
mov ecx, dword [ecx]
push dword [ebp - 0x1034]
cmp dword [ebp - 0x1014], 8
lea eax, [ebp - 0x1028]
push dword [ebp - 0x1038]
cmovae eax, dword [ebp - 0x1028]
push edx
push ecx
push eax
push str.__s___a___s___m___ssubject_sbody_s_
lea eax, [ebp - 0x1010]
push 0x800
push eax
call fcn.004729f0
add esp, 0x20
mov dword [ebp - 0x108c], 0
xor eax, eax
mov dword [ebp - 0x1088], 0
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x1084], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1080], 0
push eax
push 0
mov dword [ebp - 0x107c], 0
mov dword [ebp - 0x1078], 0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1070], 0
mov dword [ebp - 0x106c], 0
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], 0
mov dword [ebp - 0x1060], 0
mov dword [ebp - 0x105c], 0
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x1090], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
movzx ecx, byte [ebp - 0x1029]
test eax, eax
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x1030], ecx
jmp 0x48423d
push dword [ebp - 0x1030]
push ebx
push esi
push edi
push dword [ebp - 0x103c]
call fcn.00483bc0
add esp, 0x14
mov byte [ebp - 0x1030], al
lea ecx, [ebp - 0x1028]
mov dword [ebp - 4], 0xffffffff
call fcn.00404866
mov eax, dword [ebp - 0x1030]
test al, al
jne 0x48426a
push ebx
push esi
push edi
push dword [ebp - 0x103c]
call fcn.00484870
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x484b50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db552
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x218], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x214], eax
mov word [esi], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x218], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x484ce1
push ebx
call fcn.005649e3
mov edi, eax
add esp, 4
test edi, edi
je 0x484bfa
push ebx
push 0
push edi
call fcn.0059dbb0
add esp, 0xc
jmp 0x484bfc
xor edi, edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x218], 3
mov dword [ebp - 4], 1
test edi, edi
je 0x484ce1
push edi
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0
push dword [ebp - 0x214]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x214]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x210]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00484b20
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x220], 0
je 0x484cd8
mov edx, dword [ebp - 0x224]
test edx, edx
je 0x484cd8
mov ecx, edx
lea ebx, [ecx + 2]
jmp 0x484cc0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484cc0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004049aa
push edi
call fcn.005649de
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x4be9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5debe5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CFont.0
push 0x58
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push str.Marlett
push eax
push 0x60
push 0x50
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00574e60
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [edi]
mov ecx, edi
push ebx
push esi
mov dword [ebp - 0x30], eax
call dword [edx + 0x70]
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [esi]
push ebx
call dword [eax + 0x74]
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0xb0]
sub eax, 0x10
push eax
call fcn.00405ebd
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 0x80]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x88]
push 0x25
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x8c]
push ecx
mov dword [ebp - 0x14], eax
mov ecx, edi
push dword [esi - 0xc]
mov eax, dword [edi]
push esi
mov byte [ebp - 4], 1
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4beae8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x30]
call dword [eax + 0x28]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CFont.0
call fcn.00415fe6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret 8

Function at 0x4c6e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 8
je 0x4c6e7d
cmp esi, 0x21
jb 0x4c6e5c
cmp esi, 0x2e
jbe 0x4c6e7d
cmp esi, 0x43
je 0x4c6e70
cmp esi, 0x56
je 0x4c6e70
cmp esi, 0x58
je 0x4c6e70
cmp esi, 0x5a
jne 0x4c6eaf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4c6eaf
mov eax, dword [edi + 0x20]
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], esi
call fcn.0056ca68
test eax, eax
je 0x4c6eaf
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x52c060
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x52c259
mov edi, dword [esi + 4]
test edi, edi
je 0x52c259
push edi
mov dword [ebp + 8], 0
call fcn.0052e590
test eax, eax
je 0x52c103
mov ecx, edi
call fcn.004dcd30
test eax, eax
je 0x52c259
cvtsi2ss xmm0, dword [esi]
mov ebx, dword [eax + 0x14]
movss dword [ebp + 0xc], xmm0
call fcn.0052e360
mov edi, eax
mov edx, dword [edi + 0x38]
test edx, edx
jne 0x52c0ce
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x61558c
push dword [edi]
call eax
mov dword [edi + 0x38], eax
mov edx, eax
fld dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push 0
push ecx
movzx ecx, bl
shl ecx, 8
movzx eax, bx
shr eax, 8
or ecx, eax
mov eax, ebx
shr eax, 0x10
and ebx, 0xff000000
shl ecx, 8
movzx eax, al
or ecx, eax
or ecx, ebx
fstp dword [esp]
push ecx
call edx
jmp 0x52c158
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.0052bc80
mov ebx, eax
test ebx, ebx
je 0x52c158
cvtsi2ss xmm0, dword [esi]
movss dword [ebp + 0xc], xmm0
call fcn.0052e360
mov edi, eax
mov eax, dword [edi + 0x3c]
test eax, eax
jne 0x52c13c
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GdipCreatePen2
push dword [edi]
call eax
mov dword [edi + 0x3c], eax
fld dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push ecx
fstp dword [esp]
push ebx
call eax
push ebx
call fcn.0052e360
push eax
call fcn.0052e270
cmp dword [ebp + 8], 0
je 0x52c259
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x52c1ad
call fcn.004a23b0
mov ecx, dword [esi + 8]
cmp eax, 1
jne 0x52c190
push 0
call fcn.004a2320
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
lea eax, [ebp - 8]
fst dword [ebp - 8]
fstp dword [ebp - 4]
push 2
jmp 0x52c19e
call fcn.004a23b0
mov ecx, dword [esi + 8]
push eax
call fcn.004a23c0
push eax
push dword [ebp + 8]
call fcn.0052e360
push eax
call fcn.0052e2d0
mov edi, dword [esi + 0x14]
test edi, edi
je 0x52c1e4
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.0052e360
mov ebx, eax
mov eax, dword [ebx + 0xb0]
test eax, eax
jne 0x52c1de
push str.GdipSetPenLineJoin
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb0], eax
push edi
push dword [ebp + 0xc]
call eax
mov edi, dword [esi + 0xc]
test edi, edi
je 0x52c21b
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.0052e360
mov ebx, eax
mov eax, dword [ebx + 0xb4]
test eax, eax
jne 0x52c215
push str.GdipSetPenStartCap
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xb4], eax
push edi
push dword [ebp + 0xc]
call eax
mov esi, dword [esi + 0x10]
test esi, esi
je 0x52c24d
mov ebx, dword [ebp + 8]
call fcn.0052e360
mov edi, eax
mov eax, dword [edi + 0xb8]
test eax, eax
jne 0x52c249
push str.GdipSetPenEndCap
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xb8], eax
push esi
push ebx
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52e370
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.0052e360
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [eax + 4], 0
je 0x52e3e3
mov esi, dword [ebx + 4]
mov ebx, dword [ebx + 8]
call fcn.0052e360
cmp esi, ebx
je 0x52e3c7
mov ecx, dword [eax + 0x24]
mov dword [ebp - 8], eax
test ecx, ecx
jne 0x52e3bd
push str.GdipCreateFromHDC2
push dword [eax]
call edi
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov ecx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
call ecx
jmp 0x52e3e3
mov ebx, eax
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x52e3dc
push 0x615540
push dword [ebx]
call edi
mov dword [ebx + 0x28], eax
lea ecx, [ebp - 4]
push ecx
push esi
call eax
mov ebx, dword [ebp - 4]
test ebx, ebx
jne 0x52e3f3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0052e360
mov esi, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x52e40d
push str.GdipSetPageUnit
push dword [esi]
call edi
mov dword [esi + 0x18], eax
push 2
push ebx
call eax
mov ebx, dword [ebp - 4]
call fcn.0052e360
mov esi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x52e42f
push str.GdipSetSmoothingMode
push dword [esi]
call edi
mov dword [esi + 0x1c], eax
push 2
push ebx
call eax
mov ebx, dword [ebp - 4]
call fcn.0052e360
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x52e451
push str.GdipSetPixelOffsetMode
push dword [esi]
call edi
mov dword [esi + 0x14], eax
push 4
push ebx
call eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret