joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bb60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x64
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x7c]
test edi, edi
jne 0x43bb78
mov edi, 0x538d28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x52a5a0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
mov eax, dword [esp + 0x88]
add esp, 8
xor esi, esi
test eax, eax
jne 0x43bc17
mov ebx, dword [sym.imp.MSVCRT.dll_fgets]
push edi
lea edx, [esp + 0x14]
push 0x64
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x43bc5a
mov ebp, dword [esp + 0x78]
inc esi
push edi
cmp ebp, esi
je 0x43bc02
lea eax, [esp + 0x14]
push 0x64
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x43bbd6
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebp, eax
lea ecx, [ebp + 0xa]
push ecx
call sub.MFC42.DLL_operatornew
push 0
push 0
push edi
mov esi, eax
call ebx
push edi
push ebp
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0x4e
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x38
test eax, eax
jne 0x43bc70
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
xor eax, eax
mov dword [esp + 0x80], 1
test ebp, ebp
mov dword [esp + 0x7c], eax
jle 0x43bccb
mov ebx, dword [sym.imp.MSVCRT.dll_sscanf]
mov cl, byte [eax + esi]
cmp cl, 0xd
jne 0x43bc9a
inc dword [esp + 0x80]
cmp cl, 0x4e
jne 0x43bcc2
movsx eax, byte [eax + esi + 1]
lea edx, [esp + 0x7c]
push edx
push 0x52a58c
push eax
call ebx
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x7c]
je 0x43bcc2
cmp eax, dword [esp + 0x78]
je 0x43bce7
inc eax
cmp eax, ebp
mov dword [esp + 0x7c], eax
jl 0x43bc8b
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x88]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc

Function at 0x43e010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fb728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0043d0d0
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], edi
call fcn.004d5be0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x50ad78
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43e0d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4fb748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
call fcn.0043d0d0
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
lea edi, [ebx + 0x10]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x28], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebx + 0x2c], edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, ebx
mov dword [ebx], 0x50ad78
call fcn.0043e420
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4470e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fbcbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x24], ecx
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x70], ebx
mov edi, 0x10
mov ecx, esi
call fcn.00448270
add esi, 4
dec edi
jne 0x44710d
mov eax, dword [esp + 0x78]
push 0x52a5a0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
cmp ebp, ebx
mov dword [esp + 0x20], ebp
je 0x4472bd
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push str._d__d_n
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.MSVCRT.dll_fscanf]
add esp, 0x10
cmp eax, 0xffffffff
je 0x4472b3
cmp dword [esp + 0x14], ebx
je 0x4472a1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx*4]
mov dword [esp + 0x2c], edi
cmp dword [edi], ebx
jne 0x4471b4
push 0x1c
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
cmp esi, ebx
mov byte [esp + 0x70], 1
je 0x4471ac
push 0xa
mov ecx, esi
call fcn.004f690a
mov dword [esi], 0x50b300
jmp 0x4471ae
xor esi, esi
mov byte [esp + 0x70], bl
mov dword [edi], esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jle 0x4472a1
lea edx, [esp + 0x34]
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x17]
push eax
push ecx
push str._c__d__s_n
push ebp
call dword [sym.imp.MSVCRT.dll_fscanf]
mov eax, dword [esp + 0x3c]
add esp, 0x14
cmp eax, ebx
jne 0x447210
mov edi, 0x5323f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xc
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
mov dword [esp + 0x30], ebp
cmp ebp, ebx
mov byte [esp + 0x70], 2
je 0x447276
mov al, byte [esp + 0x13]
lea edi, [esp + 0x34]
mov byte [ebp], al
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 4], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], ecx
inc ecx
push ecx
call sub.MFC42.DLL_operatornew
mov edx, eax
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [ebp + 4], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x447278
xor ebp, ebp
mov ecx, dword [esp + 0x2c]
push ebp
mov byte [esp + 0x74], bl
mov ecx, dword [ecx]
call sub.MFC42.DLL_CPtrList::AddTail
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x4471c4
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x10
mov dword [esp + 0x18], eax
jl 0x44713f
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 4
Function at 0x455aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push edi
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
push ecx
mov dword [esp + 0x30], esi
mov ecx, esp
mov dword [esp + 0x6c], esp
push 1
push edi
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.004d6390
mov eax, dword [esp + 0x1c]
mov ecx, edi
and ecx, 0xff
push edi
mov dword [esi + 0x58], ecx
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0
mov dword [esi], 0x50ba40
mov dword [esi + 0x404], eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, esi
mov dword [esi + 0xa4], 0
mov dword [esi + 0x2bc], 0
call fcn.00456050
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xe4], eax
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x2c

Function at 0x455abe
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push edi
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
push ecx
mov dword [esp + 0x30], esi
mov ecx, esp
mov dword [esp + 0x6c], esp
push 1
push edi
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.004d6390
mov eax, dword [esp + 0x1c]
mov ecx, edi
and ecx, 0xff
push edi
mov dword [esi + 0x58], ecx
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0
mov dword [esi], 0x50ba40
mov dword [esi + 0x404], eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, esi
mov dword [esi + 0xa4], 0
mov dword [esi + 0x2bc], 0
call fcn.00456050
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xe4], eax
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x2c
Function at 0x4595c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_3
mov bl, byte [esp + 0x34]
mov byte [esp + 0x20], 1
movsx eax, bl
add eax, 0xffffffb7
cmp eax, 0x10
ja case.0x459612.79
xor ecx, ecx
mov cl, byte [eax + 0x459734]
jmp dword [ecx*4 + 0x459718]
mov bl, 0x5a
jmp case.0x459612.79
mov bl, 0x58
jmp case.0x459612.79
mov bl, 0x4b
jmp case.0x459612.79
mov bl, 0x49
jmp case.0x459612.79
mov bl, 0x57
jmp case.0x459612.79
mov bl, 0x55
push 3
push 0xa
lea edx, [esp + 0x1c]
push str.__c____d._dlf
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x38]
add esp, 0x10
test eax, eax
je 0x459684
lea edx, [ebp + 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x459674
movsx eax, bl
push eax
push edx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x459684
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
jmp 0x4596ac
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push edx
mov ecx, ebp
call fcn.004cd050
sub esp, 8
lea ecx, [esp + 0x18]
movsx eax, bl
fstp qword [esp]
push eax
push esi
push ecx
call sub.MFC42.DLL_CString::Format_1
add esp, 0x14
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push 0
mov edi, dword [edx - 8]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push edx
mov edx, dword [esp + 0x38]
push esi
push 6
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 4]
sub eax, edi
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_OffsetRect]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x459840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x10]
push str.T_02d_02d
push edx
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x30]
add esp, 0x10
mov edi, dword [edx - 8]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0
push edi
push edx
push esi
push 6
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 4]
sub eax, edi
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_OffsetRect]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46dc10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fe248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [0x53a940]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x24]
mov eax, 0x55555556
imul ecx
mov eax, edx
mov dword [esp + 8], 0
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x20]
shl edx, 1
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [eax + eax*2]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
push 0xe733
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [0x53a940]
mov ecx, dword [esp + 4]
push 0
lea eax, [esp + 0xc]
push edx
push eax
push 0x50ce0000
push ecx
push 0
mov ecx, esi
call sub.MFC42.DLL_CMDIChildWnd::Create
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x473920
Capabilities:
Terminate process

Disassembly:
mov ax, word [esp + 4]
push esi
mov esi, ecx
push edi
mov word [esi + 8], ax
mov dword [esi], 0x50e384
movsx eax, ax
lea edi, [eax + 1]
push edi
call sub.MFC42.DLL_operatornew
mov dword [esi + 0x18], eax
lea eax, [edi + edi]
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esi + 0x18]
xor ecx, ecx
add esp, 8
cmp edx, ecx
mov dword [esi + 4], eax
je 0x473999
cmp eax, ecx
je 0x473999
mov eax, 1
mov word [esi + 0xc], cx
mov word [esi + 0xa], ax
mov word [esi + 0xe], cx
mov word [esi + 0x10], 0xa
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov dword [esi + 0x1c], edx
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
mov word [esi + 0x24], ax
mov dword [esi + 0x20], edx
mov word [esi + 0x26], cx
mov eax, esi
pop edi
pop esi
ret 4
push str.No_space_for_scanner_
push esi
call fcn.004739e0
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop

Function at 0x473a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
mov eax, dword [0x53b010]
push str.yyLEXTBL
push str.UD_RES_yyLEX
mov dword [esp + 8], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x53b010]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x473a66
xor ax, ax
add esp, 0x10
ret
mov edx, dword [0x533ec0]
mov ecx, dword [0x533ec8]
push ebx
mov ebx, dword [0x533ecc]
push ebp
mov ebp, dword [0x533ed0]
push esi
mov esi, dword [0x533ed4]
mov dword [esp + 0x10], edx
mov edx, dword [0x533eb8]
push edi
mov edi, dword [0x533ebc]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x533ed4], eax
add eax, 0xde
mov dword [0x533ebc], eax
add eax, 0xbc
mov dword [0x533ecc], eax
add eax, 0xa
mov dword [0x533ed0], eax
mov ecx, dword [esp + 0x10]
add eax, 0x2ea
mov dword [0x533ec0], eax
add eax, 0x2ea
mov dword [0x533ec8], eax
add eax, 0xbc
mov dword [0x533eb8], eax
call fcn.00473b30
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [0x533ebc], edi
mov dword [0x533ed4], esi
mov dword [0x533ec0], ecx
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [0x533ed0], ebp
pop esi
mov dword [0x533ecc], ebx
pop ebp
mov dword [0x533ec8], edx
mov dword [0x533eb8], ecx
pop ebx
add esp, 0x10
ret
Function at 0x474b50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fe93a
push eax
mov eax, dword [0x5323dc]
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov ebx, ecx
mov ecx, dword [eax + 0x380]
push ebp
push esi
push edi
test ecx, ecx
je 0x474b8b
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x474b8b
push 0
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x5323dc]
mov ecx, dword [ecx + 0x384]
test ecx, ecx
je 0x474ba9
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x474ba9
push 0
call sub.MFC42.DLL_CWnd::ShowWindow
mov edx, dword [0x5323dc]
mov ecx, dword [edx + 0x388]
test ecx, ecx
je 0x474bc7
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x474bc7
push 0
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, dword [0x5323dc]
mov ecx, dword [eax + 0x37c]
test ecx, ecx
jne 0x474c14
push 0x238
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x4c], 0
je 0x474bfe
push 0
mov ecx, eax
call fcn.00474260
jmp 0x474c00
xor eax, eax
mov ecx, dword [0x5323dc]
mov dword [esp + 0x4c], 0xffffffff
mov dword [ecx + 0x37c], eax
mov edx, dword [0x5323dc]
mov ecx, dword [edx + 0x37c]
test ecx, ecx
je 0x474c2b
mov eax, dword [ecx + 0x20]
test eax, eax
jne 0x474c3f
call fcn.004b0790
mov eax, dword [0x5323dc]
push 5
mov ecx, dword [eax + 0x37c]
jmp 0x474c41
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [ebx + 0x134]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xcf
push ecx
call esi
mov edx, dword [ebx + 0x174]
push 0
push 0
push 0xcf
push edx
call esi
mov eax, dword [ebx + 0x1b4]
push 0
push 0
push 0xcf
push eax
call esi
mov ecx, dword [ebx + 0x1f4]
push 0
push 0
push 0xcf
push ecx
call esi
push 1
push 0x59e
mov ecx, ebx
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 0x5a1
mov ecx, ebx
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov ecx, dword [esp + 0x54]
mov edx, dword [ecx]
call dword [edx + 8]
mov ebp, eax
mov ecx, ebp
mov eax, dword [ebp]
call dword [eax + 8]
mov edx, dword [ebp]
mov ecx, 6
mov esi, eax
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
call dword [edx + 0xc]
mov ecx, 6
mov esi, eax
mov eax, dword [0x5323dc]
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
lea ecx, [eax + 0x190]
call sub.MFC42.DLL_CSplitterWnd::GetPane
fld qword [esp + 0x14]
fsub qword [eax + 0x118]
push 0
mov ecx, ebx
fstp qword [ebx + 0x230]
fld qword [esp + 0x20]
fsub qword [eax + 0x110]
fadd st(0), st(0)
fstp qword [ebx + 0x228]
fld qword [esp + 0x30]
fsub qword [eax + 0x118]
fstp qword [ebx + 0x220]
fld qword [esp + 0x38]
fsub qword [eax + 0x110]
fadd st(0), st(0)
fstp qword [ebx + 0x218]
call sub.MFC42.DLL_CWnd::UpdateData
pop edi
mov ecx, dword [esp + 0x40]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x47bac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x484630
sub esp, 0x50
push esi
push edi
push 0x1602
push 0x408
call dword [sym.imp.OPENGL32.dll_glColorMaterial]
push 0
push 0x1601
push 0x408
call dword [sym.imp.OPENGL32.dll_glMateriali]
mov edi, dword [sym.imp.OPENGL32.dll_glEnable]
push 0xb57
call edi
push 0xb71
mov dword [esp + 0xc], 0x3f666666
mov dword [esp + 0x10], 0x3f666666
mov dword [esp + 0x14], 0x3f666666
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x1c], 0x3f19999a
mov dword [esp + 0x20], 0x3f19999a
mov dword [esp + 0x24], 0x3f19999a
mov dword [esp + 0x28], 0x3f800000
mov dword [esp + 0x3c], 0x3e4ccccd
mov dword [esp + 0x40], 0x3e4ccccd
mov dword [esp + 0x44], 0x3e4ccccd
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x2c], 0x41200000
mov dword [esp + 0x30], 0x41200000
mov dword [esp + 0x34], 0x41200000
mov dword [esp + 0x38], 0
mov dword [esp + 0x4c], 0x3ecccccd
mov dword [esp + 0x50], 0x3ecccccd
mov dword [esp + 0x54], 0x3ecccccd
mov dword [esp + 0x58], 0x3f800000
call edi
call dword [sym.imp.OPENGL32.dll_glPushMatrix]
call dword [sym.imp.OPENGL32.dll_glLoadIdentity]
mov esi, dword [sym.imp.OPENGL32.dll_glLightfv]
lea eax, [esp + 8]
push eax
push 0x1200
push 0x4000
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x1201
push 0x4000
call esi
lea edx, [esp + 0x28]
push edx
push 0x1203
push 0x4000
call esi
lea eax, [esp + 0x38]
push eax
push 0x1202
push 0x4000
call esi
call dword [sym.imp.OPENGL32.dll_glPopMatrix]
lea ecx, [esp + 0x48]
push ecx
push 0xb53
call dword [sym.imp.OPENGL32.dll_glLightModelfv]
push 0x4000
call edi
mov esi, dword [sym.imp.OPENGL32.dll_glDisable]
push 0x4001
call esi
push 0x4002
call esi
push 0x4003
call esi
push 0x4004
call esi
push 0x4005
call esi
push 0x4006
call esi
push 0x4007
call esi
push 0xb50
call edi
pop edi
pop esi
add esp, 0x50
ret
Function at 0x489640
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ff4b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CPtrArray::CPtrArray
mov dword [esi], 0x50fccc
push 0
push 0
push 0x46293e59
lea edi, [esi + 0x18]
push 0x39a08cea
push 0x46293e59
push 0x39a08cea
mov ecx, edi
mov dword [esp + 0x30], 0
call fcn.004d5c00
push 0
push 0
push 0xc6293e59
push 0x39a08cea
push 0xc6293e59
push 0x39a08cea
lea ecx, [edi + 0x18]
call fcn.004d5c00
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x50fcb8
mov dword [esi + 0x48], 0xffffffff
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x489890
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ff5cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0xe0]
mov dword [esp + 0x20], 2
test eax, eax
je 0x4898e1
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push fcn.004897f0
push ecx
push 0x70
push eax
call fcn.004f713f
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [edi + 0xe4]
test ecx, ecx
je 0x4898f2
mov edx, dword [ecx]
push 1
call dword [edx + 4]
lea esi, [edi + 0x130]
mov dword [esp + 0x14], esi
mov dword [esi], 0x50fcb8
mov ebp, dword [esi + 8]
xor ebx, ebx
test ebp, ebp
mov byte [esp + 0x20], 7
jle 0x489924
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*4]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
inc ebx
cmp ebx, ebp
jl 0x489910
push 0xffffffffffffffff
push 0
mov ecx, esi
call sub.MFC42.DLL_CPtrArray::SetSize
mov ecx, esi
mov byte [esp + 0x20], 1
call fcn.004f6a2a
lea esi, [edi + 0x70]
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 0x20], 0xa
mov ebp, 0x41efffff
je 0x489972
lea ecx, [esi + 0x20]
call sub.MFC42.DLL_CDC::DeleteDC
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], ebx
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esi + 0x58], 0xffe00000
mov dword [esi + 0x5c], ebp
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 9
call fcn.0043e150
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 8
call fcn.004f6580
add esi, 0x18
mov dword [esp + 0x14], esi
mov dword [esi], 0x508630
mov ecx, esi
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esi], 0x508238
mov eax, dword [edi + 0x24]
mov dword [esp + 0x20], 0xe
cmp eax, ebx
je 0x4899d7
lea ecx, [edi + 0x20]
call sub.MFC42.DLL_CDC::DeleteDC
lea ecx, [edi + 0x18]
mov dword [edi + 0x24], ebx
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi + 0x58], 0xffe00000
mov dword [edi + 0x5c], ebp
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 0xd
call fcn.0043e150
lea ecx, [edi + 0x20]
mov byte [esp + 0x20], 0xc
call fcn.004f6580
lea esi, [edi + 0x18]
mov dword [esp + 0x14], esi
mov dword [esi], 0x508630
mov ecx, esi
mov dword [esp + 0x20], 0xf
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x18]
mov dword [esi], 0x508238
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret