joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476800
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x579487
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 1
call sub.MFC42.DLL_CString::CString_4
mov eax, 0x20
xor ecx, ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x4c], 2
lea edi, [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
sub esp, 8
fild qword [esp + 0x20]
lea edx, [esp + 0x14]
fmul qword [0x58e548]
fstp qword [esp]
push str.Total_Physical_Memory:__9.0f_KB_r_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
sub esp, 8
fild qword [esp + 0x20]
lea edx, [esp + 0x14]
fmul qword [0x58e548]
fstp qword [esp]
push str.Available_Physical_Memory:__9.0f_KB_r_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xc]
fild qword [esp + 0x18]
fmul qword [0x58e548]
fstp qword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push str.Total_Virtual_Memory:__9.0f_KB_r_n
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_2
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x14], 1
mov byte [esp + 0x48], 1
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x476ce0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push eax
mov ebx, ecx
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebx + 0x78]
call sub.MFC42.DLL_CWnd::ScreenToClient
cmp dword [esp + 0x2c], 2
jne 0x476dbc
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
mov dword [esp + 0x28], eax
jle 0x476dbc
push esi
lea esi, [eax + 1]
push edi
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebx + 0x78]
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov esi, eax
mov eax, dword [ebx + 0x78]
push 0
push 0
mov eax, dword [eax + 0x20]
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [esi]
push eax
call sub.MFC42.DLL_CGdiObject::FromHandle
push eax
mov ecx, esi
call dword [ebp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov ebp, eax
mov eax, dword [esi + 8]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ebp
lea eax, [edx + ecx - 1]
mov ecx, esi
mov dword [esp + 0x28], eax
mov edx, dword [esi]
call dword [edx + 0x30]
mov ecx, dword [ebx + 0x78]
mov eax, dword [esi + 4]
push eax
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov ecx, eax
pop ebp
pop ebx
mov dword [ecx], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 0xc], edx
add esp, 0x18
ret 0xc
Function at 0x479980
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5797a8
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
test esi, esi
push edi
jne 0x4799a6
xor eax, eax
jmp 0x4799a9
mov eax, dword [esi + 0x20]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 0x20
jne 0x4799cb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x418
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
or edi, 0xffffffff
push ecx
mov ebx, eax
mov dword [esi + 0xbc], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [0x67400c], edi
xor edi, edi
test ebx, ebx
jle 0x479abe
mov ebp, dword [sym.imp.USER32.dll_PtInRect]
push edi
mov ecx, esi
call fcn.00479090
test eax, eax
jne 0x479a4a
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push edi
mov ecx, esi
call dword [edx + 0xe8]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
call ebp
test eax, eax
jne 0x479a51
inc edi
cmp edi, ebx
jl 0x479a19
jmp 0x479ab5
push edi
mov ecx, esi
call fcn.0047a920
test eax, eax
jne 0x479a70
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push esi
lea ecx, [esp + 0x2c]
mov dword [0x67400c], edi
call sub.MFC42.DLL_CClientDC::CClientDC
xor ecx, ecx
xor eax, eax
push ecx
mov edx, 2
push ecx
push ecx
mov edi, edx
push eax
mov dword [esp + 0x54], ecx
push ecx
push edi
lea ecx, [esp + 0x30]
push edx
push ecx
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CDC::DrawDragRect
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0xffffffff
call fcn.004eaedc
mov eax, dword [0x67400c]
test eax, eax
jge 0x479ad3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov edi, dword [sym.imp.USER32.dll_CreateCursor]
push 0x58ecf8
push 0x58ec78
push 0x20
push 0x20
push 2
push 4
push 0
call edi
push 0x58edf8
push 0x58ed78
push 0x20
push 0x20
push 2
push 4
push 0
mov dword [0x69adfc], eax
call edi
mov dword [0x69ae00], eax
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetFocus
mov eax, dword [0x69adfc]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x69adf8], eax
lea ecx, [esp + 0x10]
mov eax, 1
push ecx
mov dword [0x69ae08], eax
mov dword [0x69ae04], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0x69adf0
push esi
mov ecx, esi
mov dword [0x69adf0], edx
mov dword [0x69adf4], eax
mov dword [0x69ae0c], esi
call fcn.0047a7e0
mov ecx, dword [esp + 0x3c]
mov eax, dword [0x69ae04]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x47ada0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57988e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x100]
call fcn.004eaa50
mov ecx, dword [ebp + 8]
or edi, 0xffffffff
mov dword [esi + 0x114], ecx
mov ecx, 1
xor eax, eax
mov dword [esi + 0x24], ecx
mov ebx, 0x7fefffff
mov dword [esi + 0x10], ecx
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov ecx, esi
mov dword [esp + 0x18], eax
mov dword [esi], 0x58efe0
mov byte [esi + 0x23], al
mov dword [esi + 0x3c], 0xffefffff
mov dword [esi + 0x34], ebx
mov dword [esi + 0x28], 6
mov dword [esi + 8], eax
mov byte [esi + 0xc], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.0047af00
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], ebx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47c090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x579ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
lea esi, [ecx + 0xe4]
push 5
push 2
push eax
mov ecx, esi
call fcn.00430260
push ecx
mov dword [esp + 0x34], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 5
push 1
push ecx
mov ecx, esi
call fcn.00430260
mov eax, dword [0x69ac40]
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 0
push eax
push edx
mov ecx, esi
mov byte [esp + 0x54], 1
call fcn.004302f0
push ecx
mov byte [esp + 0x3c], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 5
push 0x411
push ecx
mov ecx, esi
call fcn.00430260
push ecx
mov ecx, esi
mov edx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 5
push 0x467
push edx
mov byte [esp + 0x5c], 3
call fcn.00430260
push 0
push 0
push 5
push 4
lea eax, [esp + 0x30]
push 0
mov byte [esp + 0x54], 4
push eax
mov ecx, esi
call fcn.004301d0
mov ecx, eax
mov byte [esp + 0x40], 6
call fcn.004344a0
mov ecx, eax
mov byte [esp + 0x3c], 7
call fcn.004344a0
mov ecx, eax
mov byte [esp + 0x38], 8
call fcn.004344a0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00434380
push 0
push 0
push 5
push 4
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, esi
mov byte [esp + 0x50], 9
call fcn.004301d0
mov ecx, eax
mov byte [esp + 0x38], 0xb
call fcn.00434400
mov ecx, eax
mov byte [esp + 0x34], 0xd
call fcn.004344a0
mov ecx, eax
mov byte [esp + 0x30], 0xf
call fcn.004344a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00434380
push ecx
mov ecx, esi
mov edx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 0
push 0x461
push edx
mov byte [esp + 0x50], 0x10
call fcn.00430260
push 0
push 5
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
mov byte [esp + 0x44], 0x11
call fcn.00433e80
mov ecx, eax
mov byte [esp + 0x34], 0x13
call fcn.004344a0
mov byte [esp + 0x30], 0x14
mov ecx, eax
call fcn.00434400
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 0xf
call fcn.004343d0
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0xe
call fcn.004343d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004343d0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x47f060
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x579fcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
mov esi, ecx
push edi
push 0
xor bl, bl
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x64]
push ecx
mov ecx, dword [esi + 0x28]
mov edx, dword [eax + 0x60]
mov eax, dword [esi + 0x2c]
push edx
mov edx, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x14]
push eax
push ecx
push edx
lea ecx, [esp + 0x3c]
call fcn.0047f4b0
mov cl, byte [esi + 8]
mov al, byte [esi + 0xa]
mov dl, byte [esi + 9]
mov byte [esp + 0xfd], cl
lea ecx, [esp + 0x18]
mov dword [esp + 0x128], 0
mov byte [esp + 0xfc], al
mov byte [esp + 0xfe], dl
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 1
jne 0x47f1a2
mov edx, dword [esp + 0x108]
mov ecx, dword [esi + 0x18]
xor eax, eax
test edx, edx
setne al
cmp ecx, eax
je 0x47f109
mov dword [esi + 0x18], eax
mov byte [esi + 0xd], 1
mov bl, 1
mov edx, dword [esp + 0x110]
mov ecx, dword [esi + 0x20]
xor eax, eax
test edx, edx
setne al
cmp ecx, eax
je 0x47f128
mov dword [esi + 0x20], eax
mov byte [esi + 0xf], 1
or bl, 1
mov eax, dword [esp + 0x10c]
mov ecx, dword [esi + 0x1c]
neg eax
sbb eax, eax
and al, 0xfe
inc eax
cmp ecx, eax
je 0x47f147
mov dword [esi + 0x1c], eax
mov byte [esi + 0xe], 1
or bl, 1
fld qword [esi + 0x28]
fcomp qword [esp + 0x100]
fnstsw ax
test ah, 0x40
jne 0x47f173
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x10], 1
or bl, 1
mov ecx, dword [esi + 0x30]
fld qword [ecx + 0x60]
fcomp qword [esp + 0x118]
fnstsw ax
test ah, 0x40
jne 0x47f1a2
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], eax
mov byte [esi + 0x11], 1
or bl, 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x78]
neg esi
sbb esi, esi
mov dword [esp + 0x128], 1
and esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x64]
mov dword [esp + 0x14], edi
mov dword [edi], method.CObject.virtual_0
mov eax, dword [edi + 4]
mov byte [esp + 0x128], 3
test eax, eax
je 0x47f210
mov ecx, dword [edi + 8]
mov edx, ecx
dec ecx
test edx, edx
je 0x47f204
inc ecx
push ebp
lea ebp, [eax + 8]
mov dword [esp + 0x10], ecx
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
add ebp, 0x20
dec eax
mov dword [esp + 0x10], eax
jne 0x47f1ee
pop ebp
mov eax, dword [edi + 4]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esi + 8]
mov dword [edi], vtable.CObject.0
mov byte [esp + 0x128], 1
call fcn.0047abd0
lea ecx, [esp + 0x18]
mov dword [esp + 0x128], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x120]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x4808f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x57a2eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
pop edi
je 0x48097e
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
push str.RocscienceUpdateTemp
lea ecx, [esp + 4]
mov dword [esp + 0x114], 0
call fcn.004ea978
lea edx, [esp]
push edx
call fcn.004809a0
add esp, 4
lea ecx, [esp]
mov dword [esp + 0x110], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret

Function at 0x4809a0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x57a318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [esp + 0x3c]
push str..
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_operator_4
mov edx, dword [esp]
push 0
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
mov dword [esp + 0xc], eax
je 0x480aa7
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__unlink]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x480a9c
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
call dword [eax + 0x40]
test eax, eax
je 0x480a7d
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFilePath
lea edx, [esp + 0x48]
mov byte [esp + 0x40], 2
push edx
call fcn.004809a0
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x48]
jmp 0x480a97
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
test edi, edi
jne 0x480a0d
pop edi
pop esi
pop ebp
lea ecx, [esp]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.004eb52a
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x480db0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareRocscienceDipsSettings
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x480e2a
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push str.CurDir
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x480e1f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll__chdir]
add esp, 4
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x11c
ret
Function at 0x483c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57a940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.004633a0
push OleUIInsertObjectA
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00463440
mov ebx, dword [esp + 0x30]
push 0xf003f
mov eax, ebx
and eax, 0xff
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SoftwareRocscienceDips
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004635d0
test eax, eax
je 0x483d83
push 0x68a260
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString_2
test bl, bl
mov byte [esp + 0x28], 1
je 0x483d3f
mov ebx, dword [esi + 0x56c]
xor eax, eax
test ebx, ebx
sete al
push eax
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
call fcn.00463b30
jmp 0x483d75
push 1
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
call fcn.00463a60
test eax, eax
je 0x483d6b
mov dword [esi + 0x56c], 0
jmp 0x483d75
mov dword [esi + 0x56c], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004633d0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4

Function at 0x48d220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57b59f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x20]
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea eax, [esp + 0x10]
push str._d_t_d_t_d_n
push eax
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x48e900
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x57b6fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
push ebx
push esi
mov esi, dword [esp + 0x170]
push str.Unused
mov ecx, esi
call fcn.004ea8a0
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00481cf0
push str..dio
lea edx, [esp + 0xc]
push eax
push edx
mov dword [esp + 0x170], 0
call sub.MFC42.DLL_operator_4
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
lea eax, [esp + 0x1c]
push eax
push ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x48ea6c
mov ecx, dword [esp + 0x16c]
push edi
mov edi, 1
cmp ecx, edi
jl 0x48ea64
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__stricmp]
cmp edi, 1
jle 0x48e9c8
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x48ea5f
cmp dword [esp + 0x174], edi
jne 0x48ea4f
lea ecx, [esp + 0x50]
push ecx
mov ecx, esi
call fcn.004ea8a0
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Right
mov eax, dword [esp + 0x18]
push 0x68e178
push eax
mov byte [esp + 0x174], 3
call ebp
add esp, 8
test eax, eax
jne 0x48ea3c
mov ecx, dword [esi]
lea edx, [esp + 0x20]
mov eax, dword [ecx - 8]
mov ecx, esi
add eax, 0xfffffffc
push eax
push edx
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, esi
mov byte [esp + 0x170], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x16c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov bl, 1
mov byte [esp + 0x16c], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x174]
inc edi
cmp edi, eax
jle 0x48e9ab
mov eax, dword [esp + 0x14]
pop ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
lea ecx, [esp + 8]
mov dword [esp + 0x164], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x15c]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x160
ret 8