joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6781d7f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x90]
test eax, eax
jne 0x6781d809
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x6781d83d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [eax]
mov eax, dword [esi + 0x44]
push edx
mov edx, dword [esp + 0x18]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebp
pop ecx
ret 0xc
mov ebp, dword [esp + 0x14]
mov eax, dword [esi + 0x44]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push 0
push edx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6781d867
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
mov edi, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
cmp dword [edi], 0
jne 0x6781d88b
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, dword [esp + 0x1c]
mov dword [edi], eax
add esp, 4
mov dword [ebx], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx]
cmp ecx, eax
pop ebx
jae 0x6781d89f
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
mov edx, dword [edi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebp
pop ecx
ret 0xc

Function at 0x6781de80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov dword [esp + 8], ecx
push esi
mov ecx, dword [esp + 0x18]
push edi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x6781deac
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x6781dec0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x6781ded5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
jne 0x6781deeb
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
lea edx, [ebp + 1]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x6781df06
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, ebp
mov edi, ebx
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov byte [ebx + ebp], 0
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPPropExchangeXMLNode::LoadFromString_char_const__
push ebx
mov esi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x6781df40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x67980d98
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6781e099
test al, 0x10
jne 0x6781e099
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPPropExchangeXMLNode::CreateDocumentInstance_void_
test eax, eax
je 0x6781e099
xor ebx, ebx
push edi
lea ecx, [esp + 0x18]
mov word [esp + 0x18], bx
call sub.MFC42.DLL_COleVariant::operator_4
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x44]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x18]
test eax, eax
jne 0x6781dfc3
push 0x80004003
call fcn.6797f0c0
lea edx, [esp + 0x44]
mov eax, dword [esi + 0x44]
push edx
sub esp, 0x10
mov ecx, dword [eax]
mov edx, esp
push eax
mov dword [edx], edi
mov edi, dword [esp + 0x48]
mov dword [edx + 4], ebx
mov dword [edx + 8], ebp
mov dword [edx + 0xc], edi
call dword [ecx + 0xe8]
mov edi, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor ebp, ebp
cmp edi, ebp
jl 0x6781e092
cmp word [esp + 0x44], bp
je 0x6781e092
mov eax, dword [esi + 0x44]
cmp eax, ebp
je 0x6781e080
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x67a726c0
push eax
call dword [ecx]
mov ebx, eax
cmp ebx, ebp
jge 0x6781e06a
mov eax, dword [esi + 0x48]
cmp eax, ebp
je 0x6781e03b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x48], ebp
cmp ebx, ebp
jge 0x6781e050
cmp ebx, 0x80004002
je 0x6781e050
push ebx
call fcn.6797f0c0
mov eax, dword [esi + 0x4c]
cmp eax, ebp
je 0x6781e060
mov dword [esi + 0x4c], ebp
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x38], ebp
mov eax, 1
jmp 0x6781e09b
mov eax, dword [esi + 0x48]
mov edi, dword [esp + 0x10]
cmp eax, ebp
je 0x6781e07b
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x48], edi
jmp 0x6781e03e
mov eax, dword [esi + 0x48]
cmp eax, ebp
je 0x6781e050
mov dword [esi + 0x48], ebp
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x6781e050
mov ecx, esi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPShellSettings::destructor_void_
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 4
Function at 0x6781fe40
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x67981183
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPPropExchangeIniFile::vftable
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], 1
test eax, eax
jne 0x6781fe8a
mov eax, dword [esi + 0x48]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x6781fe8a
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x6781fe8a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 0x48]
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x44]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call sym.MfcHlpr520.dll_public_virtual:_void___thiscall_CMHPPropExchange::destructor_void_
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x6781fec0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x34]
test eax, eax
jne 0x6781ffda
mov eax, dword [ebp + 0x44]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x6781ffda
mov ecx, ebp
call sym.MfcHlpr520.dll_public_virtual:_void___thiscall_CMHPPropExchange::EmptySection_void_
mov ecx, dword [ebp + 0x44]
mov esi, 0x1f40
push esi
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
call sub.MFC42.DLL_operatornew
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
add esp, 4
mov ebx, eax
mov eax, dword [ebp + 0x48]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x6781ffd1
lea ecx, [esi - 2]
cmp eax, ecx
jne 0x6781ff2d
push ebx
add esi, esi
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x6781ff31
test ebx, ebx
jne 0x6781ff59
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
mov eax, dword [ebp + 0x48]
push eax
push esi
push ebx
call edi
test eax, eax
jne 0x6781ff19
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
je 0x6781ffd1
jmp 0x6781ff77
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
ja 0x6781ffb3
mov esi, dword [ebp + 0x44]
mov edi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x6781ffb3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x6781ffa0
cmp byte [edx + eax], 0x5c
jne 0x6781ffb3
mov ecx, dword [ebp + 0x48]
push ecx
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
lea edx, [edx + eax + 1]
xor eax, eax
mov edi, edx
mov dword [esp + 0x14], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ecx
jne 0x6781ff73
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x67820080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x678200ff
mov eax, dword [esi + 0x48]
lea edi, [esi + 0x48]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x678200f8
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x678200bb
pop edi
pop esi
add esp, 0x208
ret
lea edx, [esp + 0x10c]
lea eax, [esp + 8]
push edx
push 0
push 0x67a72720
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x678200e2
pop edi
pop esi
add esp, 0x208
ret
lea ecx, [esp + 0x10c]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
mov dword [esi + 0x4c], 1
mov dword [esi + 0x38], 1
mov edx, dword [esi + 0x48]
xor eax, eax
pop edi
pop esi
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
add esp, 0x208
ret
Function at 0x67820320
Capabilities:
Copy file
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 0x48]
push edi
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x67820358
mov eax, dword [esi + 0x48]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x67820358
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 0x48]
push 0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
ret 4

Function at 0x67820f80
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push sym.MfcHlpr520.dll_protected:_static_int___stdcall_CMHPResourceManager::EnumResTypeProc_struct_HINSTANCE_____char___long_int_
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov ax, word [esp]
pop ecx
ret

Function at 0x67821390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 5
push edi
call sym.MfcHlpr520.dll_public:_struct_HINSTANCE______thiscall_CMHPResourceManager::FindResourceModule_char_const___char_const__
mov esi, eax
test esi, esi
jne 0x678213b7
push 5
push edi
call sub.MFC42.DLL_AfxFindResourceHandle
mov esi, eax
test esi, esi
jne 0x678213b7
pop edi
pop esi
ret 4
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x678213ca
pop edi
pop esi
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop edi
pop esi
ret 4
Function at 0x67821400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x67821415
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov edi, dword [esp + 0x18]
push 0x17
and edi, 0xffff
push edi
call sym.MfcHlpr520.dll_public:_struct_HINSTANCE______thiscall_CMHPResourceManager::FindResourceModule_char_const___char_const__
mov esi, eax
test esi, esi
jne 0x67821442
push 0x17
push edi
call sub.MFC42.DLL_AfxFindResourceHandle
mov esi, eax
test esi, esi
jne 0x67821442
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x17
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x67821459
pop edi
pop esi
pop ebp
pop ebx
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x6782146e
pop edi
pop esi
pop ebp
pop ebx
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x6782148c
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_CString::GetBuffer
mov edx, eax
test edx, edx
jne 0x678214a6
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, edi
xor eax, eax
mov ebp, ecx
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push 0xffffffffffffffff
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
mov edi, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
call sub.MFC42.DLL_CString::ReleaseBuffer
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebp
setg al
pop ebx
ret 8
Function at 0x678218e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
mov ecx, dword [esp + 0x1c]
push edi
call sub.MFC42.DLL_CString::Empty
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, edi
push 6
shr eax, 4
inc eax
and eax, 0xffff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x6782191d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x67821931
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x67821946
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x67821965
cmp esi, eax
jae 0x67821969
xor ecx, ecx
dec edi
mov cx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x67821955
cmp esi, eax
jb 0x67821973
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
xor ebx, ebx
mov bx, word [esi]
test ebx, ebx
jne 0x67821986
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x67821996
mov ebp, dword [eax + 4]
jmp 0x67821998
xor ebp, ebp
push 0
push 0
push 0
lea edi, [esi + 2]
push 0
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
mov esi, eax
push esi
call sub.MFC42.DLL_CString::GetBufferSetLength
push 0
push 0
push esi
push eax
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
push esi
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x67825480
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov edi, ecx
push 1
call esi
test ax, ax
jl 0x6782556f
push 2
call esi
test ax, ax
jl 0x6782556f
push 4
call esi
test ax, ax
jl 0x6782556f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi + 0x48]
xor ebp, ebp
test eax, eax
jle 0x6782556f
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx + ebp*4]
mov edx, dword [esi + 0x20]
push edx
call ebx
test eax, eax
je 0x67825563
mov eax, dword [esi + 0x20]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
lea ecx, [esi + 0xc]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x20], edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x24], ecx
mov cl, byte [esi + 8]
test cl, 1
je 0x67825525
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x67825531
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call sub.MFC42.DLL_CWnd::ClientToScreen
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x67825563
test byte [esi + 8], 1
jne 0x67825579
lea edx, [esp + 0x10]
mov ecx, edi
push edx
push 0
call sym.MfcHlpr520.dll_protected:_long_int___thiscall_CMHPToolTipContextToolTip::OnWindowFromPoint_unsigned_int__long_int_
cmp eax, dword [esi + 0x20]
je 0x67825579
mov eax, dword [edi + 0x48]
inc ebp
cmp ebp, eax
jl 0x678254d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x67826850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67981830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebp
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x30]
call fcn.6797db2c
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPClientRect::constructor_class_CWnd_const__
mov edx, dword [esp + 0xc]
sub esp, 0x10
mov ecx, esp
mov eax, dword [esi]
lea edi, [esi + 0x5c]
mov dword [ecx], edx
mov edx, dword [esp + 0x20]
push edi
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
call dword [eax + 0xc8]
mov ecx, dword [esi + 0x58]
call sym.MfcHlpr520.dll_public:_unsigned_long_int___thiscall_CMHPToolTipContext::GetTipTextColor_void_const
push 1
lea ecx, [esp + 0x30]
mov ebp, eax
call sub.MFC42.DLL_CDC::SetBkMode
push ebp
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CDC::SetTextColor
mov edx, dword [esi + 0x58]
lea eax, [esp + 0x2c]
add edx, 0x98
lea ecx, [esp + 0x1c]
push edx
push eax
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPFontDC::constructor_class_CDC___class_CFont__
mov ecx, dword [esp + 0xc]
sub esp, 0x10
mov eax, esp
mov edx, dword [esi]
push edi
mov byte [esp + 0x9c], 1
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call dword [edx + 0xc4]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x88], 0
call sym.MfcHlpr520.dll_public_virtual:_void___thiscall_CMHPFontDC::destructor_void_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], 0xffffffff
call sub.MFC42.DLL_CPaintDC::CPaintDC
mov ecx, dword [esp + 0x80]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x80
ret
Function at 0x67827920
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x67981a3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.6797d7b4
lea ebp, [esi + 0x98]
xor eax, eax
mov dword [esp + 0x170], eax
mov dword [ebp + 4], eax
mov dword [ebp], 0x67995c9c
lea ebx, [esi + 0xa0]
mov dword [ebx + 4], eax
mov dword [ebx], 0x67995c9c
push eax
mov byte [esp + 0x174], 2
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPToolTipContext::vftable
mov dword [esi + 0x60], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov ecx, 0xb
sar eax, 1
mov dword [esi + 0x3c], eax
xor eax, eax
lea edi, [esi + 0x64]
rep stosd dword es:[edi], eax
call sym.MfcHlpr520.dll_class_CMHPSystemVersion____stdcall_MHPSystemVersion_void_
mov ecx, eax
call sym.MfcHlpr520.dll_public:_unsigned_long_int___thiscall_CMHPSystemVersion::GetComCtlVersion_void_const
push 0
mov dword [esi + 0x34], eax
push 0
push 0
lea eax, [esi + 0x44]
or edi, 0xffffffff
push 0
push eax
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x38], 1
mov dword [esi + 0x40], 2
call dword [sym.imp.USER32.dll_SetRect]
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x154
push 0x29
mov dword [esp + 0x24], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectA]
lea edx, [esp + 0xf0]
push edx
mov dword [esp + 0x104], 0x190
call edi
push eax
mov ecx, ebp
call sub.MFC42.DLL_CGdiObject::Attach
lea eax, [esp + 0xf0]
mov dword [esp + 0x100], 0x2bc
push eax
call edi
push eax
mov ecx, ebx
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [esp + 0x168]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x67835dd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
push ebp
mov ecx, dword [esi + 0xe8]
push eax
call sym.MfcHlpr520.dll_public:_class_CMHPControl____thiscall_CMHPControls::HitTest_class_CPoint_const
mov ebx, eax
mov eax, dword [esi + 0xbc]
cmp eax, 0xffffffff
je 0x67835e37
cmp dword [esi + 0xec], 5
jne 0x67835e37
cmp dword [esi + 0xe4], 1
jne 0x67835e37
test ebx, ebx
je 0x67835e16
cmp dword [ebx + 0x84], eax
je 0x67835e37
cmp eax, dword [esi + 0xb8]
jne 0x67835e2c
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 0xcc]
push 0
push 0xffffffffffffffff
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::SetPopuped_int__int_
test ebx, ebx
mov ecx, esi
je 0x67835f21
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::IsCustomizeMode_void_const
test eax, eax
jne 0x67835eef
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x134]
test eax, eax
je 0x67835eef
push esi
push sym.MfcHlpr520.dll_struct_CRuntimeClass_CMHPToolBar::classCMHPToolBar
call sub.MFC42.DLL_AfxDynamicDownCast
add esp, 8
test eax, eax
je 0x67835eef
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x67835eef
mov ecx, esi
call sym.MfcHlpr520.dll_public:_class_CMHPCommandBars____thiscall_CMHPCommandBar::GetCommandBars_void_const
mov edi, eax
test edi, edi
je 0x67835eef
mov eax, dword [edi + 0x60]
test eax, eax
je 0x67835eef
mov ecx, dword [edi + 0x74]
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x67835eef
push 1
mov ecx, edi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPCommandBars::SetQuickCustomizeMode_int_
push 0
push 0xffffffffffffffff
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::SetPopuped_int__int_
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 0xcc]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx]
push ebp
push ecx
mov ecx, ebx
call dword [eax + 0x10c]
push 0
mov ecx, edi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPCommandBars::SetQuickCustomizeMode_int_
mov edx, dword [edi]
push 0
mov ecx, edi
call dword [edx + 0x5c]
mov ecx, edi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPCommandBars::ClosePopups_void_const
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::IsCustomizeMode_void_const
test eax, eax
je 0x67835f08
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x134]
test eax, eax
je 0x67835f26
mov eax, dword [esp + 0x18]
mov edx, dword [ebx]
push ebp
push eax
push 0
mov ecx, ebx
call dword [edx + 0xd8]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
call sub.MFC42.DLL_CWnd::Default
pop edi
pop esi
pop ebp
pop ebx
ret 0xc