joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c4c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x56380f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
push ebp
push 0x110
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CDialog::CDialog_1
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], 0
mov ecx, edi
call sub.MFC42.DLL_CObArray::CObArray
lea ebx, [esi + 0x88]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CWnd::CWnd
mov dword [ebx], 0x57f9a0
lea ebx, [esi + 0xc8]
mov byte [esp + 0x1c], 2
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
push 0x5c0168
mov ecx, ebx
mov byte [esp + 0x20], 3
mov dword [esi], 0x583ab8
mov dword [esi + 0x60], ebp
call sub.MFC42.DLL_CString::operator_1
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
jle 0x46c56c
mov eax, dword [ebp + 4]
mov edx, dword [edi + 8]
mov ecx, dword [eax + ebx*4]
push ecx
push edx
mov ecx, edi
call sub.MFC42.DLL_CObArray::SetAtGrow
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, eax
jl 0x46c552
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x7c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x84], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x80], eax
mov dword [esi + 0x78], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4a62c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push esi
xor ebx, ebx
push 0x5c03d8
push eax
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_operator_3
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push 8
push 0xa
push ecx
mov ecx, esi
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::Mid_1
push ecx
mov ecx, esi
mov edx, esp
mov dword [ebp - 0x1c], esp
push 3
push 6
push edx
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::Mid_1
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x5c031c
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [0x5c0424]
push 0x5c02c8
mov byte [ebp - 4], 2
call fcn.0044e110
cmp eax, 1
je 0x4a639a
lea ecx, [ebp - 0x18]
push 0x58eda0
push ecx
mov dword [ebp - 0x18], 1
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ecx]
call dword [edx + 0x7c]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ae1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56ab20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_3
push 0x5c02ec
lea eax, [esp + 0x24]
push str.Select_max_Pzh__from
push eax
mov byte [esp + 0x3c], 3
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0x38]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_operator_3
push str._PZGL_M_Where_kjn
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x38], 5
push eax
call sub.MFC42.DLL_operator_4
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_operator_3
push str._and_kjy
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x38], 7
push eax
call sub.MFC42.DLL_operator_4
lea ecx, [esp + 0x40]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x3c], 8
call sub.MFC42.DLL_operator_3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 9
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 4]
push eax
push ecx
mov ecx, esp
lea edx, [esp + 0x10]
mov dword [esp + 0x2c], esp
push edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x4c]
mov ecx, esi
push eax
call fcn.00415f10
test eax, eax
jne 0x4ae33d
push 0x2010
push 0x5b6164
push 0x5ba8f4
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 4], 0xffffffff
mov ecx, dword [esp + 4]
mov byte [esp + 0x30], 2
lea esi, [ecx + 1]
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 0x10
Function at 0x4ae3a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56ab48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
push str.Select_Max_ID__as_MAX_ID_from_SupperTmp
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.00415f10
test eax, eax
jne 0x4ae44b
push 0x2010
push 0x5b6164
push 0x5ba940
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x4ae44f
mov eax, dword [esp + 4]
inc eax
lea ecx, [esp + 8]
mov dword [esp + 4], eax
mov esi, eax
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x1c
ret 8

Function at 0x4ae490
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x56ab90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
push 0x5b622c
push ecx
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_3
lea edx, [esp + 0x20]
lea eax, [esp + 0xc]
push edx
push str.Delete_from_SupperTmp
push eax
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_operator_2
push str._where_ID
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_operator_4
lea edx, [esp + 4]
mov byte [esp + 0x18], 4
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_operator_3
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
push 1
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00418c90
test eax, eax
jne 0x4ae584
push 0x2040
push 0x5b75e8
push 0x5ba978
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x4aef75
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push ecx
mov ebx, eax
call edi
mov ebp, eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.004af150
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
jg 0x4af141
mov eax, dword [esi + 0x40]
dec ecx
push eax
push ecx
mov word [eax], 0xc8
mov ecx, dword [esi + 0x20]
push 0xc4
push ecx
call edi
test ebx, ebx
jne 0x4aefdd
xor ecx, ecx
jmp 0x4aefe0
mov ecx, dword [ebx + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, dword [esi + 4]
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0xd
jne 0x4af010
push 0
push 0xd
push edx
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x27
jne 0x4af054
mov edx, dword [esp + 0x14]
dec edx
cmp edx, eax
jl 0x4af141
cmp dword [esp + 0x10], ebp
jl 0x4af141
push 0
push 0x27
push 0x100
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x25
jne 0x4af095
mov eax, dword [esp + 0x14]
mov esi, 1
cmp eax, esi
jne 0x4af141
cmp dword [esp + 0x10], esi
jne 0x4af141
push 0
push 0x25
push edx
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x26
jne 0x4af0cc
mov eax, dword [esp + 0x10]
mov esi, 1
cmp eax, esi
jne 0x4af141
push 0
push 0x26
push edx
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x28
jne 0x4af0f7
cmp dword [esp + 0x10], ebp
jl 0x4af141
push 0
push 0x28
push edx
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x22
jne 0x4af11c
push 0
push 0x22
push edx
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
cmp edx, 0x100
jne 0x4af141
cmp dword [esi + 8], 0x21
jne 0x4af141
push 0
push 0x21
push edx
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x4b44b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x56b848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
mov eax, dword [esi + 0xe0]
push 0
push 0
push 0x303
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
lea edi, [esi + 0x128]
push ecx
mov ecx, edi
call fcn.0050f570
push eax
lea ecx, [esi + 0x124]
mov dword [esp + 0x4c], 0
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, edi
call fcn.00515480
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebp, edx
call fcn.005154a0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, edi
mov dword [esp + 0x1c], edx
call fcn.005154c0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x18], edx
call fcn.005154e0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
push 0
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, esi
mov dword [esp + 0x18], edx
call sub.MFC42.DLL_CWnd::UpdateData
mov eax, dword [esi + 0x148]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CWnd::ScreenToClient
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
add edx, 0xfffffffe
push 8
push edx
mov edx, dword [esp + 0x24]
add eax, 0xfffffffc
push eax
lea ebx, [esi + 0xc0]
lea eax, [ecx + edx + 1]
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [sym.imp.MFC42.DLL_CWndconstCWnd::wndTop]
lea edx, [ecx + ebp + 2]
mov ecx, ebx
push edx
push eax
call sub.MFC42.DLL_CWnd::SetWindowPos
mov ecx, edi
call fcn.00515370
cmp eax, 4
je 0x4b4656
mov ecx, edi
call fcn.005152d0
cmp eax, 1
jle 0x4b4656
push 5
mov ecx, ebx
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, ebx
call sub.MFC42.DLL_CWnd::SetFocus
mov ecx, dword [ebx + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
push 0x3e8
push 0xb1
push ecx
call edi
mov edx, dword [ebx + 0x20]
push 0
push 0
push 0xb7
push edx
call edi
jmp 0x4b465f
push 0
mov ecx, ebx
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, dword [esi + 0x178]
mov edx, dword [esi + 0x180]
mov ecx, dword [esi + 0x17c]
mov dword [esp + 0x20], eax
add edx, eax
mov eax, dword [esi + 0x184]
mov dword [esp + 0x24], ecx
add eax, ecx
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x148]
lea ecx, [esp + 0x20]
push 1
push ecx
push edx
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x4beee0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x318
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x32c]
push edi
push eax
push esi
call dword [sym.imp.MSVCRT.dll__findfirst]
add esp, 8
cmp eax, 0xffffffff
jne 0x4bef1d
push eax
call dword [sym.imp.MSVCRT.dll__findclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
push eax
call dword [sym.imp.MSVCRT.dll__findclose]
push 0x5b8e14
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
call esi
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4bef4b
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x318
ret
mov ecx, dword [esp + 0x32c]
push str.wb
push ecx
call esi
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4bef73
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x318
ret
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 0x200
lea edx, [esp + 0x130]
push 1
push edx
call ebp
mov esi, eax
push ebx
push esi
lea eax, [esp + 0x140]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x20
cmp eax, esi
jl 0x4befb0
cmp esi, 0x200
jl 0x4befc0
jmp 0x4bef79
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x318
ret
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
push ebx
call esi
push edi
call esi
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
Function at 0x4bf660
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x56d100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], 2
call sub.MFC42.DLL_CString::CString_3
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x138]
stosb byte es:[edi], al
lea eax, [esp + 0x10]
mov bl, 3
push eax
push 0x20019
push 0
push ecx
push edx
mov byte [esp + 0x140], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4bf6ff
mov esi, dword [esp + 0x134]
push 0x5c0168
mov ecx, esi
call fcn.0055734e
mov ebx, 1
mov dword [esp + 0x14], ebx
jmp 0x4bf7a0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::operator_1
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0055734e
lea eax, [esp + 0x1c]
push eax
call fcn.004bd7e0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 4
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x134]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov ebx, 1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x13c]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x140]
mov byte [esp + 0x12c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x124]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x124
ret
Function at 0x4c41b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x56d5bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [esp + 0x2c]
push 0
push 0
push esi
mov dword [esp + 0x2c], 1
call dword [sym.imp.MSVCRT.dll_fseek]
mov ebx, dword [esp + 0x3c]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
add esp, 0xc
mov dword [esp + 0x2c], 0x2bc
push esi
push 1
lea eax, [esp + 0x18]
push 1
push eax
call edi
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp al, 0xa
je 0x4c4239
test al, al
jne 0x4c4227
push 0x20
jmp 0x4c4230
cmp al, 0xd
jne 0x4c422f
inc dword [ebx]
jmp 0x4c4239
push eax
lea ecx, [esp + 0x10]
call fcn.00557258
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x4c4208
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4c4280
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x56d5ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
xor edi, edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [esp + 0x2c]
push edi
push 0x2bd
push esi
mov dword [esp + 0x2c], 1
call dword [sym.imp.MSVCRT.dll_fseek]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea eax, [esp + 0x24]
push 1
push eax
call ebp
add esp, 0x1c
cmp eax, 1
jne 0x4c4325
push ebx
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp al, 0xa
je 0x4c4310
test al, al
jne 0x4c42f2
push 0x20
jmp 0x4c4307
cmp al, 0xd
jne 0x4c4306
inc edi
cmp edi, ebx
je 0x4c4324
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Empty
jmp 0x4c4310
push eax
lea ecx, [esp + 0x14]
call fcn.00557258
push esi
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
call ebp
add esp, 0x10
cmp eax, 1
je 0x4c42e2
pop ebx
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4c50e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56d742
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push 0x60
call sub.MFC42.DLL_operatornew
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
test ebx, ebx
mov dword [esp + 0x1c], 0
je 0x4c5131
mov dword [ebx], 0x57f4c4
lea ecx, [ebx + 0x14]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_3
mov dword [ebx], 0x586c74
jmp 0x4c5133
xor ebx, ebx
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 4]
sub eax, edx
mov edx, dword [esp + 0x2c]
add eax, 6
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x30]
sub ecx, edi
mov dword [ebx + 4], edx
add ecx, 6
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
lea ecx, [ebp + 0x50]
push ecx
lea ecx, [ebx + 0x14]
call sub.MFC42.DLL_CString::operator_2
lea esi, [ebp + 0x14]
lea edi, [ebx + 0x18]
mov ecx, 0xf
push ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0x78]
mov dword [ebx + 0x54], edx
mov eax, dword [ebp + 0x7c]
mov dword [ebx + 0x58], eax
mov ecx, dword [ebp + 0x64]
mov dword [ebx + 0x5c], ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 8]
push edx
call sub.MFC42.DLL_CObArray::SetAtGrow
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret