joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f0fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x454ef0], 0xffffffff
mov dword [ebp + 8], eax
jne 0x42f134
push ebx
push edi
push 0x455d98
call fcn.004313cb
mov ebx, eax
test ebx, ebx
js 0x42f18c
xor ebx, ebx
jmp 0x42f18c
test eax, eax
je 0x42f18c
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [0x454ef0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42f172
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42f16c
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x42f17c
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jb 0x42f138
jmp 0x42f18c
push ebx
push 0x318
push str.logutil.cpp
call fcn.0043294e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x42f727
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4540d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [str.unknown]
mov eax, 0x104
push eax
mov dword [ebp - 0x424], eax
xor ebx, ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x418], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x42f78b
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00427e30
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00435c53
test eax, eax
jns 0x42f7b5
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x42f7d9
lea eax, [ebp - 0x414]
mov byte [eax], bl
inc eax
dec esi
jne 0x42f7d3
push ebx
lea eax, [ebp - 0x418]
push eax
call fcn.00437e46
push dword [ebp - 0x418]
push str._Logging_started:__ls_
push 2
pop esi
push esi
call fcn.0042f6a2
mov eax, dword [ebp - 0x420]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x41c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
push str.Executable:__ls_v_d._d._d._d
push esi
call fcn.0042f6a2
lea eax, [ebp - 0x414]
push eax
push str.Computer__:__ls
push esi
call fcn.0042f6a2
mov eax, dword [0x454ef4]
add esp, 0x34
sub eax, ebx
ret
je 0x42f872
dec eax
je 0x42f86a
dec eax
je 0x42f862
dec eax
je 0x42f85a
dec eax
jne 0x42f878
mov edi, dword [str.debug]
jmp 0x42f878
mov edi, dword [str.verbose]
jmp 0x42f878
mov edi, dword [str.standard]
jmp 0x42f878
mov edi, dword [str.warning]
jmp 0x42f878
mov edi, dword [str.none]
push edi
push str.____logging_level:__hs____
push esi
call fcn.0042f6a2
add esp, 0xc
cmp dword [ebp - 0x418], ebx
pop edi
pop esi
pop ebx
je 0x42f89d
push dword [ebp - 0x418]
call fcn.004301e8
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00427eaa
leave
ret
Function at 0x401460
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x134], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40149d
mov eax, 0
jmp 0x401526
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401513
lea eax, [ebp - 0x134]
add eax, 0x24
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
test al, al
je 0x4014f0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x12c]
jmp 0x401526
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401513
jmp 0x4014be
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 0
leave
ret
Function at 0x4020d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x40211b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402114
test esi, esi
je 0x402114
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020f0
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402300
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402428
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40238e
cmp eax, 4
jne 0x4023b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40239e
cmp edx, 4
je 0x40239e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402300
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x300f3277
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1cf31d3
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ce62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x958]
mov dword [esp + 0x20], 5
call fcn.00420a80
lea ecx, [esi + 0x948]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x908]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CListCtrl::CListCtrl
lea ecx, [esi + 0x8c8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CComboBox::CComboBox
push fcn.0041ba50
push 5
lea eax, [esi + 0x364]
push 0x114
push eax
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.00401360
push 5
lea ecx, [esi + 0x1c0]
push 0x54
push ecx
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 0xa
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov byte [esp + 0x20], 0x10
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x12
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x402cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45d590
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 2
lea eax, [esi + 0x5a8]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.004246b0
push sub.MFC42.DLL_CListBox::CListBox
push 1
lea ecx, [esi + 0x568]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.004246b0
push fcn.00401360
push 3
lea edx, [esi + 0x46c]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.0041ba50
push 2
lea eax, [esi + 0x244]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x402e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45d670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 2
lea eax, [esi + 0x7bc]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.004246b0
push sub.MFC42.DLL_CListBox::CListBox
push 4
lea ecx, [esi + 0x6bc]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.004246b0
push fcn.00401360
push 7
lea edx, [esi + 0x470]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.0041ba50
push 2
lea eax, [esi + 0x248]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45d750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 1
lea eax, [esi + 0x724]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.004246b0
push sub.MFC42.DLL_CListBox::CListBox
push 4
lea ecx, [esi + 0x624]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.004246b0
push fcn.00401360
push 6
lea edx, [esi + 0x42c]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.0041ba50
push 2
lea eax, [esi + 0x204]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45daa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x53c]
mov dword [esp + 0x20], 3
call sub.MFC42.DLL_CIPAddressCtrl::CIPAddressCtrl
lea ecx, [esi + 0x4fc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CIPAddressCtrl::CIPAddressCtrl
push fcn.00401360
push 3
lea eax, [esi + 0x3f8]
push 0x54
push eax
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.0041ba50
push 2
lea ecx, [esi + 0x1d0]
push 0x114
push ecx
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x404400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45dcf4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x950]
mov dword [esp + 0x20], 4
call fcn.00420a80
lea ecx, [esi + 0x90c]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CListCtrl::CListCtrl
lea ecx, [esi + 0x8c8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CComboBox::CComboBox
push fcn.0041ba50
push 5
lea eax, [esi + 0x364]
push 0x114
push eax
mov byte [esp + 0x30], 1
call fcn.004246b0
push fcn.00401360
push 5
lea ecx, [esi + 0x1c0]
push 0x54
push ecx
mov byte [esp + 0x30], 0
call fcn.004246b0
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 9
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xd
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0xf
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 6
mov ecx, ebx
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4639a0
mov ecx, edi
mov byte [esp + 0x20], 0x11
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x46398c
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x404940
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45dd13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
push sub.MFC42.DLL_CString::CString
push fcn.0042426c
push 6
lea eax, [esp + 0x14]
push 4
mov edi, ecx
push eax
call fcn.004247a4
mov esi, dword [esp + 0x30]
lea edx, [esp + 8]
mov dword [esp + 0x28], 0
mov ecx, dword [esi + 4]
push ecx
push 0x470840
push edx
call sub.MFC42.DLL_CString::Format
xor eax, eax
add esp, 0xc
mov al, byte [esi + 8]
mov ecx, dword [eax*4 + 0x470b28]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
xor edx, edx
lea ecx, [esp + 0x10]
mov dl, byte [esi + 9]
mov eax, dword [edx*4 + 0x470b48]
push eax
call sub.MFC42.DLL_CString::operator_1
xor ecx, ecx
mov cl, byte [esi + 0xa]
mov edx, dword [ecx*4 + 0x470b0c]
lea ecx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::operator_1
xor eax, eax
mov al, byte [esi + 0xb]
mov ecx, dword [eax*4 + 0x470b3c]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator_1
mov cl, byte [esi + 0xc]
lea eax, [esi + 0xc]
test cl, cl
jne 0x4049fd
mov eax, 0x470838
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push 6
add edi, 0x90c
push edx
push edi
call fcn.0041e780
push sub.MFC42.DLL_CString::CString
push 6
lea eax, [esp + 0x10]
push 4
push eax
mov dword [esp + 0x38], 0xffffffff
call fcn.004246b0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10