joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b1f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x500dfc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x1c]
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
xor edi, edi
mov eax, 0x511ce0
mov dword [esp + 0x18], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CWordArray::CWordArray
or eax, 0xffffffff
mov byte [esp + 0x18], 3
mov dword [esi + 0x10], eax
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], edi
cmp eax, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
jl 0x49b279
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x64], edi
cmp eax, edi
mov dword [esi + 0x68], edi
je 0x49b293
mov al, byte [eax]
mov ecx, ebx
push eax
call sub.MFC42.DLL_CString::operator_1
jmp 0x49b29f
push str.Not_SET
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x49c930
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x6400
call fcn.004f7110
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x19c]
test eax, eax
je 0x49c954
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov edi, dword [esp + 0x6414]
push 0x52c744
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp + 0x19c], eax
test eax, eax
jne 0x49c981
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6400
ret 4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp + 0xa0]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.0049c180
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0x435
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov ecx, ebp
call fcn.0049c840
test eax, eax
je 0x49c9ed
mov ebp, dword [ebp + 0x19c]
test ebp, ebp
je 0x49c9de
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6400
ret 4
mov edx, dword [ebp + 0x19c]
push 0
push 0
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov eax, dword [ebp + 0x19c]
lea ecx, [esp + 0x10]
push eax
push 0x63fe
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov ebx, eax
lea edx, [esp + 0x20]
push 0xa
push edx
mov byte [esp + ebx + 0x28], 0
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x49ca61
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 1
sub eax, ecx
mov ecx, dword [ebp + 0x19c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov byte [esi + 1], 0
push 0
lea edx, [esp + 0x14]
push 1
push edx
mov ecx, ebp
call fcn.0049c1f0
cmp ebx, 0x63fe
jge 0x49ca01
mov eax, dword [ebp + 0x19c]
lea ecx, [esp + 0x10]
push eax
push 0x63fe
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
lea edx, [esp + 0x10]
mov ecx, ebp
mov byte [esp + eax + 0x10], 0
push 0
push 1
push edx
call fcn.0049c1f0
mov eax, dword [ebp + 0x19c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [0x53aa00]
add esp, 4
test eax, eax
je 0x49cad6
mov ecx, ebp
call fcn.0049d360
mov ecx, dword [0x53a914]
push eax
call fcn.00437150
mov ecx, ebp
call fcn.0049c7c0
push 0
mov ecx, ebp
call fcn.0049cb30
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0xb9
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp + 0x1d0]
pop edi
mov dword [ebp + 0x1a0], edx
mov dword [ebp + 0x1cc], 0
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x6400
ret 4
Function at 0x49ce50
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x500fac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x204
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call sub.MFC42.DLL_CWnd::GetWindowTextLengthA
mov esi, eax
cmp esi, 1
mov dword [esp + 0x14], esi
jge 0x49cea3
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x49d05f
push 0xffffffffffffffff
push 0
push 0xe745
call sub.MFC42.DLL_AfxMessageBox_1
jmp 0x49d05f
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xb8
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x49cecf
mov eax, dword [esp + 0x228]
test eax, eax
jne 0x49cecf
mov eax, 1
jmp 0x49d061
mov eax, dword [esp + 0x224]
test eax, eax
je 0x49cef1
push 0xffffffffffffffff
push 1
push 0xe746
call sub.MFC42.DLL_AfxMessageBox_1
cmp eax, 1
jne 0x49d05f
lea ecx, [esi + 2]
push ecx
call sub.MFC42.DLL_operatornew
mov ebp, eax
mov edi, 0x538d28
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc esi
mov edi, ecx
push esi
push ebp
mov ecx, ebx
call sub.MFC42.DLL_CWnd::GetWindowTextA_1
cmp edi, 1
jl 0x49cf2e
mov eax, dword [esp + 0x228]
test eax, eax
je 0x49cfef
push 0
push str.NC_files_.nc_.nc__.pcAll_.__.
push 4
push str..nc
push 0x52c638
push 0
lea ecx, [esp + 0x30]
call fcn.004d62d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x21c], 0
call sub.MFC42.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x49d034
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
push edx
call sub.MFC42.DLL_CFileDialog::GetPathName
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 0x538d28
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x220], 1
mov eax, ecx
mov esi, edi
mov edi, 0x538d28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x53a914]
call fcn.0043a250
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc8]
mov dword [esp + 0x21c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004f635e
push 0x52be1c
push 0x538d28
call dword [sym.imp.MSVCRT.dll_fopen]
mov ecx, dword [esp + 0x1c]
mov esi, eax
push esi
push ecx
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edx, dword [ebx + 0x20]
add esp, 0x1c
push 0
push 0
push 0xb9
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x49d061
lea ecx, [esp + 0xc8]
mov dword [esp + 0x21c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004f635e
xor eax, eax
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x210
ret 8
Function at 0x49e2b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x501138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
push 0
push 0
push 0x46293e59
lea esi, [edi + 8]
push 0x39a08cea
push 0x46293e59
push 0x39a08cea
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.004d5c00
push 0
push 0
push 0xc6293e59
push 0x39a08cea
push 0xc6293e59
push 0x39a08cea
lea ecx, [esi + 0x18]
call fcn.004d5c00
lea esi, [edi + 0x3c]
mov dword [esp + 0x1c], esi
lea ebx, [esi + 4]
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 8]
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], ecx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0xc]
mov byte [esp + 0x28], 1
mov dword [esp + 0x10], ecx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x10]
mov byte [esp + 0x28], 2
mov dword [esp + 0x14], ecx
call sub.MFC42.DLL_CString::CString_3
add esi, 0x14
mov byte [esp + 0x28], 3
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
push 2
mov ecx, ebx
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0xc]
push 4
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x10]
push 5
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x14]
push 6
call sub.MFC42.DLL_CString::operator_1
push 0x15
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], 5
test esi, esi
mov dword [edi], 0
jne 0x49e3c3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49e41d
mov ebx, dword [ebp + 0x10]
cmp ebx, 1
je 0x49e3f7
cmp ebx, 2
je 0x49e3f7
push 0x2c
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x28], 7
je 0x49e419
mov ecx, dword [ebp + 0xc]
push 0xa
push ecx
push esi
mov ecx, eax
call fcn.004cf9d0
jmp 0x49e41b
push 0x2c
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x28], 6
je 0x49e419
push ebx
push esi
mov ecx, eax
call fcn.004cf900
jmp 0x49e41b
xor eax, eax
mov dword [edi], eax
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a8f40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x501a1b
push eax
mov eax, dword [0x5363dc]
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
xor esi, esi
cmp eax, esi
je 0x4a8f84
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 8]
mov ecx, 0x53a920
push eax
mov dword [esp + 0x120], esi
call fcn.004d39c0
push str.plotter.ini
lea ecx, [esp + 0xc]
call fcn.004f668e
mov ecx, dword [esp + 8]
push 0x52c834
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x4a8ff7
lea ecx, [esp + 8]
mov dword [esp + 0x11c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strchr]
push edi
push ebx
push 0xfe
lea edx, [esp + 0x24]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
lea ecx, [esp + 0x2c]
add esp, 0x10
lea eax, [esp + 0x1c]
test ecx, ecx
mov byte [esp + edi + 0x1c], 0
je 0x4a9038
push 0x5b
push eax
call ebp
add esp, 8
test eax, eax
je 0x4a9038
inc esi
inc eax
jne 0x4a9028
cmp edi, 0xfe
je 0x4a8fff
lea edx, [esi + esi*8]
shl edx, 3
sub edx, esi
shl edx, 2
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x4a90ae
lea ebp, [esi - 1]
test ebp, ebp
jl 0x4a90b0
lea edx, [eax + 0xc0]
inc ebp
mov byte [edx + 0xa], 0
mov byte [edx], 0
mov byte [edx - 0x64], 0
mov byte [edx - 0xc0], 0
mov byte [edx + 0x46], 0
mov byte [edx + 0x3c], 0
mov byte [edx + 0x28], 0
mov byte [edx + 0x1e], 0
mov byte [edx + 0x14], 0
lea edi, [edx - 0x8c]
mov ecx, 0xa
xor eax, eax
add edx, 0x11c
dec ebp
rep stosd dword es:[edi], eax
jne 0x4a906a
mov eax, dword [esp + 0x14]
jmp 0x4a90b0
xor eax, eax
push 0
push 0
push ebx
mov dword [0x5363dc], eax
mov dword [0x5363d8], esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test esi, esi
jle 0x4a9141
mov edi, dword [sym.imp.MSVCRT.dll_fscanf]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
jmp 0x4a90e3
mov ebp, dword [esp + 0x18]
xor esi, esi
mov eax, dword [0x5363dc]
push esi
lea ecx, [eax + ebp]
call fcn.004a9180
push eax
push 0x52ad10
push ebx
call edi
add esp, 0xc
inc esi
cmp esi, 9
jl 0x4a90e5
lea esi, [ebp + 0x34]
mov ebp, 0xa
mov ecx, dword [0x5363dc]
lea edx, [esi + ecx]
push edx
push 0x52a58c
push ebx
call edi
add esp, 0xc
add esi, 4
dec ebp
jne 0x4a910d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 0x11c
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jne 0x4a90df
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x118
ret
Function at 0x4ad060
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x501df4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
push edi
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], esi
call sub.MFC42.DLL_CFileDialog::CFileDialog
lea edi, [esi + 0x200]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.004f636a
mov dword [edi], 0x508478
lea edi, [esi + 0x240]
mov byte [esp + 0x1c], 1
mov ecx, edi
call fcn.004f636a
mov dword [edi], 0x508478
lea edi, [esi + 0x280]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.004f636a
mov dword [edi], 0x508478
lea edi, [esi + 0x2c0]
mov byte [esp + 0x1c], 3
mov ecx, edi
call fcn.004f636a
mov dword [edi], 0x508478
lea edi, [esi + 0x300]
mov byte [esp + 0x1c], 4
mov ecx, edi
call fcn.004f636a
mov dword [edi], 0x508478
lea edi, [esi + 0x340]
mov byte [esp + 0x1c], 5
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x344]
mov byte [esp + 0x1c], 6
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ebp, [esi + 0x348]
mov byte [esp + 0x1c], 7
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x34c]
mov byte [esp + 0x1c], 8
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x350]
mov byte [esp + 0x1c], 9
call sub.MFC42.DLL_CString::CString_3
push 0x5323f0
mov ecx, edi
mov byte [esp + 0x20], 0xa
mov dword [esi], 0x512e68
call sub.MFC42.DLL_CString::operator_2
push 0x5323f0
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_2
push 0x5323f0
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_2
push 0x5323f0
lea ecx, [esi + 0x34c]
call sub.MFC42.DLL_CString::operator_2
push 0x5323f0
lea ecx, [esi + 0x350]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esi + 0x94]
mov ecx, dword [esp + 0x14]
and eax, 0xfff7ffff
mov dword [esi + 0xa8], 0x112
or al, 0x40
pop edi
mov dword [esi + 0x94], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4ad670
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
mov ebx, ecx
jne 0x4ad68d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x13
push ebx
call edi
add esp, 0x10
cmp eax, 1
je 0x4ad6af
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push esi
lea ebp, [ebx + 0x64]
push 1
push 4
push ebp
mov byte [ebx + 0x13], 0
call edi
add esp, 0x10
cmp eax, 1
je 0x4ad6d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov byte [ebx + 0x68], 0
mov eax, str.TURN
mov dl, byte [ebp]
mov cl, dl
cmp dl, byte [eax]
jne 0x4ad700
test cl, cl
je 0x4ad6fc
mov dl, byte [ebp + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x4ad700
add ebp, 2
add eax, 2
test cl, cl
jne 0x4ad6db
xor eax, eax
jmp 0x4ad705
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad715
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push esi
push 1
lea eax, [esp + 0x18]
push 2
push eax
call edi
push esi
push 1
lea ecx, [esp + 0x2c]
push 4
push ecx
call edi
mov edx, dword [esp + 0x34]
inc edx
push edx
call sub.MFC42.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x38]
push esi
push 1
push eax
push ebp
call edi
mov ecx, dword [esp + 0x48]
add esp, 0x34
mov byte [ecx + ebp], 0
push ebp
lea ecx, [ebx + 0x90]
call sub.MFC42.DLL_CString::operator_2
test ebp, ebp
je 0x4ad769
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
push 1
lea edx, [esp + 0x18]
push 2
push edx
call edi
push esi
push 1
lea eax, [esp + 0x34]
push 1
push eax
mov byte [esp + 0x3c], 0xff
call edi
add esp, 0x20
cmp eax, 1
je 0x4ad79a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push esi
push 1
lea ecx, [ebx + 0x6a]
push 0x10
push ecx
call edi
add esp, 0x10
cmp eax, 1
je 0x4ad7b9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push esi
push 1
lea edx, [ebx + 0x7a]
push 0x10
push edx
call edi
add esp, 0x10
cmp eax, 1
je 0x4ad7d8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push esi
push 1
lea eax, [esp + 0x18]
push 2
push eax
call edi
push esi
push 1
lea ecx, [esp + 0x2c]
push 4
push ecx
call edi
mov edx, dword [esp + 0x34]
inc edx
push edx
call sub.MFC42.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x38]
push esi
push 1
push eax
push ebp
call edi
mov ecx, dword [esp + 0x48]
add esp, 0x34
mov byte [ecx + ebp], 0
push ebp
lea ecx, [ebx + 0x8c]
call sub.MFC42.DLL_CString::operator_2
test ebp, ebp
je 0x4ad82c
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
push 1
lea edx, [esp + 0x18]
push 2
push edx
call edi
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4adb40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x4adb4b
ret 4
push eax
push 1
lea eax, [esp + 0xc]
push 1
push eax
mov byte [esp + 0x14], 0x1a
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
ret 4

Function at 0x4adb70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea eax, [esp + 0x14]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x4adb97
pop edi
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, eax
je 0x4adbaa
pop edi
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push esi
push 1
push edx
push eax
call edi
add esp, 0x10
dec eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 0x10

Function at 0x4adbd0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x4adbf7
pop edi
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push esi
push 1
push ecx
push edx
call edi
add esp, 0x10
dec eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 0x10

Function at 0x4af030
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x22c
lea eax, [esp + 0x2c]
push eax
call fcn.004aef50
mov eax, dword [esp + 0x230]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x130]
push 0xff
push edx
push str.0_0_0
push str.Window_Placement
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x158]
push str._u__u__u___ld__ld___ld__ld___ld__ld__ld__ld
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x34
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x238]
call sub.MFC42.DLL_CWnd::SetWindowPlacement
add esp, 0x22c
ret 8
Function at 0x4af5d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50214b
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax - 8], 1
jl 0x4af6ab
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x124]
add esi, 0xc
lea ecx, [esp + 0x14]
push esi
push 0xff
push ecx
push str.0_0_0
push edx
push eax
mov dword [esp + 0x134], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push str._f__f__f
push ecx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [esp + 0x13c]
add esp, 0x14
test eax, eax
je 0x4af675
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x4af686
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 0x130]
test eax, eax
je 0x4af697
mov edx, dword [esp + 0x10]
mov dword [eax], edx
lea ecx, [esp + 4]
mov dword [esp + 0x11c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x114]
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 0x10

Function at 0x4af6d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50216b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax - 8], 1
jge 0x4af714
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 4]
mov edx, dword [ebp + 8]
add esi, 0xc
lea ecx, [esp + 0x20]
push esi
push 0xff
push ecx
push str.0_0_0
push edx
push eax
mov dword [esp + 0x140], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x20]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push str._lf__lf__lf
push ecx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x4af78f
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4af7a3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4af7b7
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x128], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x120]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10