joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x673d48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0xc679
lea ecx, [esp + 0x14]
call fcn.00411680
mov eax, dword [eax]
lea edi, [esi + 0x41e4]
push eax
push 0x80
push 0x66
push esi
mov ecx, edi
mov dword [esp + 0x30], 0
call fcn.0060e7e0
test eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
sete bl
call fcn.004116d0
test bl, bl
je 0x45f9cb
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, esi
call fcn.0046db70
mov ecx, esi
call fcn.004788e0
mov eax, dword [eax + 0x478]
mov ebx, 1
test eax, eax
je 0x45f9f0
push ebx
mov ecx, edi
call fcn.0060e880
push 0x80
lea ecx, [esi + 0x430c]
call fcn.00459dd0
test eax, eax
je 0x45fa59
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00467fd0
add esp, 8
mov esi, dword [eax]
push 0
push 0xc8cb
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
call fcn.00411680
mov eax, dword [eax]
push 0xa
push ebx
push esi
push eax
mov ecx, edi
mov byte [esp + 0x30], 2
call fcn.0060ee60
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], bl
call fcn.004116d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4609d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x673eb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
call sub.MFC42u.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42u.DLL_CCmdTarget::BeginWaitCursor
push 0
push 0xc81d
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.00411680
push eax
lea eax, [esi + 0x6a8]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.004d1c30
lea ecx, [esp + 4]
mov byte [esp + 0x18], 3
call fcn.004116d0
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esi + 0x195c4]
call fcn.004b1900
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push edx
call sub.MFC42u.DLL_CString::CString_6
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov byte [esp + 0x24], 4
call fcn.004e9930
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x18], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.004d1c90
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42u.DLL_CCmdTarget::EndWaitCursor
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
Function at 0x475ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x676f97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x710]
mov dword [esp + 0x20], 5
call fcn.0061fe10
lea ecx, [edi + 0x578]
mov byte [esp + 0x20], 4
call fcn.0056a690
lea esi, [edi + 0x1f4]
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x378]
mov byte [esp + 0x20], 0x12
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x374]
mov byte [esp + 0x20], 0x11
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x370]
mov byte [esp + 0x20], 0x10
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x36c]
mov byte [esp + 0x20], 0xf
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x368]
mov byte [esp + 0x20], 0xe
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x364]
mov byte [esp + 0x20], 0xd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x360]
mov byte [esp + 0x20], 0xc
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x358]
mov byte [esp + 0x20], 0xb
call fcn.004116d0
lea ecx, [esi + 0x354]
mov byte [esp + 0x20], 0xa
call sub.MFC42u.DLL_CString::CString
lea ecx, [esi + 0x1b4]
mov byte [esp + 0x20], 9
call fcn.004169f0
lea ecx, [esi + 0x144]
mov byte [esp + 0x20], 8
call fcn.00668820
lea ecx, [esi + 0x104]
mov byte [esp + 0x20], 7
call fcn.006090fe
lea ebx, [esi + 0xac]
mov dword [esp + 0x14], ebx
push fcn.00407360
push 3
lea eax, [ebx + 0x40]
push 8
push eax
mov byte [esp + 0x30], 0x13
call fcn.00609920
mov ecx, ebx
mov byte [esp + 0x20], 6
call sub.MFC42u.DLL_CStatic::CStatic
mov ecx, esi
mov byte [esp + 0x20], 3
call fcn.00440c60
lea ecx, [edi + 0x1a0]
mov byte [esp + 0x20], 2
call fcn.0061fa90
lea ecx, [edi + 0x19c]
mov byte [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [edi + 0x190]
mov byte [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [edi + 0x18c]
mov dword [esp + 0x20], 0x16
call sub.MFC42u.DLL_CString::CString
lea ecx, [edi + 0x110]
mov byte [esp + 0x20], 0x15
call fcn.004201e0
lea ecx, [edi + 0x60]
mov byte [esp + 0x20], 0x14
call fcn.004154e0
mov ecx, edi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x476260
Capabilities:
Delete directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6770a8
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
call fcn.004788e0
mov esi, dword [esp + 0x38]
mov ebp, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x194]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x20]
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.004ee8e0
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0
call dword [edx + 0x28]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp + 0x1248]
mov ebx, dword [esp + 0x34]
test eax, eax
je 0x4762d9
mov eax, dword [ebx + 0x10]
or al, 1
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4762e9
mov eax, dword [ebx + 0x10]
or al, 4
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x476351
lea eax, [esp + 0x38]
lea ebp, [ebx + 0x18]
push eax
push 0xffffffffffffffff
mov ecx, ebp
mov byte [esp + 0x40], 0
call fcn.00406c42
test eax, eax
jne 0x47633f
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x476336
lea ecx, [esp + 0x34]
push ecx
push 0xfffffffffffffff0
mov ecx, ebp
call fcn.006105b0
test eax, eax
jne 0x476336
lea edx, [esp + 0x2c]
mov ecx, ebp
push edx
push 0xe
call fcn.006105b0
test eax, eax
je 0x47633f
push 0x7c
mov ecx, ebp
call fcn.00485b80
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push ecx
lea ecx, [esi + 0x30a0]
call sub.MFC42u.DLL_CString::operator_3
mov ecx, edi
call fcn.004f55f0
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x47637d
dec eax
je 0x476372
dec eax
jne 0x4763c3
push ebx
push esi
mov ecx, edi
call fcn.005084b0
jmp 0x4763c3
push ebx
push esi
mov ecx, edi
call fcn.00514ee0
jmp 0x4763c3
lea ecx, [edi + 0x3900]
call fcn.0051af50
mov ebp, eax
test ebp, ebp
je 0x4763a7
test edi, edi
jne 0x476396
xor eax, eax
jmp 0x476399
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov ecx, edi
call fcn.00515000
push ebx
push esi
mov ecx, edi
call fcn.00514ee0
test ebp, ebp
je 0x4763c3
mov ecx, edi
call fcn.00515000
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4763dc
mov edx, dword [esp + 0x28]
cmp dword [edx], 0
jne 0x4763dc
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x190]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x479810
Capabilities:
Set current directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x677820
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x195cc]
test eax, eax
je 0x4798a2
push 1
call fcn.00471d90
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x195c4]
call fcn.004ae500
mov eax, dword [eax]
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x1c], 0
call fcn.0040cc70
add esp, 8
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 4]
push 1
push edx
call fcn.0040c9e0
add esp, 8
test eax, eax
je 0x479891
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47a470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x677a00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x24], edi
lea ebx, [esi + 0xbc]
mov dword [esp + 0x18], ebx
mov dword [ebx], vtable.CMap_class_CString__unsigned_short_int_const___struct_TDCCADATA__struct_TDCCADATA__.0
mov eax, dword [ebx + 4]
mov byte [esp + 0x24], 7
cmp eax, edi
je 0x47a528
mov ecx, dword [ebx + 8]
xor eax, eax
cmp ecx, edi
mov dword [esp + 0xc], eax
jbe 0x47a528
push ebp
jmp 0x47a4c5
xor edi, edi
mov ecx, dword [ebx + 4]
mov ebp, dword [ecx + eax*4]
cmp ebp, edi
je 0x47a519
lea esi, [ebp + 0xc]
xor edi, edi
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov byte [esp + 0x28], 8
call sub.MFC42u.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x28], 7
call sub.MFC42u.DLL_CString::CString
add esi, 8
mov edx, edi
dec edi
mov dword [esp + 0x14], esi
test edx, edx
jne 0x47a4d8
lea eax, [ebp + 8]
push 1
push eax
call sub.MFC42u.DLL_DestructElements
mov ebp, dword [ebp]
test ebp, ebp
jne 0x47a4cf
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x47a4c3
xor edi, edi
pop ebp
mov eax, dword [ebx + 4]
push eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [ebx + 0x14]
add esp, 4
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
call sub.MFC42u.DLL_CPlex::FreeDataChain
lea ecx, [esi + 0x80]
mov dword [ebx + 0x14], edi
mov dword [ebx], vtable.CObject.0
mov byte [esp + 0x24], 5
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0x6c]
mov byte [esp + 0x24], 4
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0x58]
mov byte [esp + 0x24], 3
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0x44]
mov byte [esp + 0x24], 2
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 1
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0x1c]
mov byte [esp + 0x24], 0
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x47a940
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x677b5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 8], esi
mov dword [esi], 0x64
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esi + 0x1c]
mov dword [esp + 0x20], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
call fcn.006086f6
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 1
call fcn.006086f6
lea ecx, [esi + 0x44]
mov byte [esp + 0x20], 2
call fcn.006086f6
lea ecx, [esi + 0x58]
mov byte [esp + 0x20], 3
call fcn.006086f6
lea ecx, [esi + 0x6c]
mov byte [esp + 0x20], 4
call fcn.006086f6
lea ecx, [esi + 0x80]
mov byte [esp + 0x20], 5
call fcn.006086f6
mov dword [esi + 0x94], 0x383
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov eax, 7
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], 0x11
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], 0xa
mov dword [esi + 0xbc], vtable.CTDCCustomAttributeDataMap.0
mov byte [esp + 0x20], al
lea eax, [esp + 0xc]
push eax
call sub.MFC42u.DLL_COleDateTime::GetTickCount
mov ecx, dword [eax]
pop edi
mov dword [esi + 0xa4], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0xa8], edx
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0xa4]
mov dword [esi + 0xac], eax
mov dword [esi + 0x98], ecx
mov edx, dword [esi + 0xa8]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x9c], edx
mov eax, dword [esi + 0xac]
mov dword [esi + 0xa0], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4815a0
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xc]
call fcn.00407107
push esi
push 0x4815d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 0x14]
pop esi
ret
Function at 0x48b1d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x67a168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00486040
xor ebx, ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], ebx
call fcn.004858d0
mov eax, 1
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], vtable.TDCCOLEDITVISIBILITY.0
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], eax
call fcn.004858d0
mov dword [esp + 0x10], vtable.TDCCOLEDITFILTERVISIBILITY.0
lea ebp, [esi + 0x1604]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
mov dword [esp + 0x7c], 2
call fcn.005652b0
mov esi, dword [esi + 0x1f3c]
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp esi, 2
sete cl
cmp eax, 2
mov dword [esp + 0x50], ecx
je 0x48b314
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x48b28e
mov eax, dword [esp + 0x38]
cmp eax, ebx
jbe 0x48b28e
mov ecx, esi
mov edx, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x48b288
mov eax, dword [eax]
cmp eax, ebx
jne 0x48b282
add ecx, 4
dec edx
jne 0x48b27c
push esi
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x48]
add esp, 4
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call sub.MFC42u.DLL_CPlex::FreeDataChain
mov dword [esp + 0x44], ebx
xor esi, esi
push esi
call fcn.00470990
add esp, 4
test eax, eax
je 0x48b30e
mov eax, dword [esp + 0x4c]
sub eax, ebx
je 0x48b304
dec eax
je 0x48b2e2
dec eax
jne 0x48b30e
lea edx, [esp + 0xf]
lea ecx, [esp + 0x30]
push edx
push esi
mov byte [esp + 0x17], bl
call fcn.00406c42
jmp 0x48b300
cmp esi, 5
jne 0x48b2ed
cmp dword [esp + 0x50], ebx
jne 0x48b304
push esi
call fcn.0048b370
add esp, 4
lea ecx, [esp + 0x10]
push eax
call fcn.00404443
cmp eax, ebx
je 0x48b30e
push esi
lea ecx, [esp + 0x34]
call fcn.00485b80
inc esi
cmp esi, 0x20
jle 0x48b2b2
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.005652d0
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], 3
call fcn.00485af0
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], 4
call fcn.00485af0
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xffffffff
call fcn.00486300
mov ecx, dword [esp + 0x70]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret 8
Function at 0x48b920
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, ebx
je 0x48b938
push eax
call edi
mov eax, dword [esi + 8]
mov dword [esi + 4], ebx
cmp eax, ebx
je 0x48b945
push eax
call edi
mov eax, dword [esi + 0xc]
mov dword [esi + 8], ebx
cmp eax, ebx
je 0x48b952
push eax
call edi
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], ebx
cmp eax, ebx
je 0x48b95f
push eax
call edi
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x48b96c
push eax
call edi
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], ebx
cmp eax, ebx
je 0x48b979
push eax
call edi
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x18], ebx
cmp eax, ebx
je 0x48b986
push eax
call edi
mov eax, dword [esi + 0x20]
mov dword [esi + 0x1c], ebx
cmp eax, ebx
je 0x48b993
push eax
call edi
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], ebx
cmp eax, ebx
je 0x48b9a0
push eax
call edi
mov eax, dword [esi + 0x28]
mov dword [esi + 0x24], ebx
cmp eax, ebx
je 0x48b9ad
push eax
call edi
mov al, byte [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x28], ebx
test al, 1
je 0x48b9d9
cmp dword [esi + 4], ebx
jne 0x48b9d9
call ebp
push eax
push ebx
push 0x48bb70
push 4
call edi
mov dword [esi + 4], eax
test byte [esp + 0x14], 2
je 0x48b9f5
cmp dword [esi + 8], ebx
jne 0x48b9f5
call ebp
push eax
push ebx
push 0x48bcc0
push 0xc
call edi
mov dword [esi + 8], eax
test byte [esp + 0x14], 4
je 0x48ba11
cmp dword [esi + 0xc], ebx
jne 0x48ba11
call ebp
push eax
push ebx
push 0x48be20
push 5
call edi
mov dword [esi + 0xc], eax
test byte [esp + 0x14], 8
je 0x48ba2d
cmp dword [esi + 0x10], ebx
jne 0x48ba2d
call ebp
push eax
push ebx
push 0x48bec0
push 0xb
call edi
mov dword [esi + 0x10], eax
test byte [esp + 0x14], 0x10
je 0x48ba49
cmp dword [esi + 0x14], ebx
jne 0x48ba49
call ebp
push eax
push ebx
push 0x48bf60
push 3
call edi
mov dword [esi + 0x14], eax
test byte [esp + 0x14], 0x20
je 0x48ba65
cmp dword [esi + 0x18], ebx
jne 0x48ba65
call ebp
push eax
push ebx
push 0x48c070
push 2
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
test ah, 1
je 0x48ba83
cmp dword [esi + 0x20], ebx
jne 0x48ba83
call ebp
push eax
push ebx
push 0x48c1d0
push 0xffffffffffffffff
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x14]
test ah, 2
je 0x48baa1
cmp dword [esi + 0x24], ebx
jne 0x48baa1
call ebp
push eax
push ebx
push 0x48c2e0
push 0xa
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x14]
test ah, 4
je 0x48babf
cmp dword [esi + 0x28], ebx
jne 0x48babf
call ebp
push eax
push ebx
push 0x48c350
push 6
call edi
mov dword [esi + 0x28], eax
test byte [esp + 0x14], 0x40
je 0x48badb
cmp dword [esi + 0x1c], ebx
jne 0x48badb
call ebp
push eax
push ebx
push 0x48c110
push 7
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x2c]
push eax
call sub.MFC42u.DLL_CString::operator_3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
Function at 0x48d0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67a3e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0x14], 0
call fcn.0048c840
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
push ecx
call fcn.0048c840
mov esi, dword [esp + 0x30]
mov edx, dword [eax]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x10
lea ecx, [esp + 0xc]
test eax, eax
setne bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x48d19a
mov eax, dword [esp + 0x30]
test eax, eax
je 0x48d165
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
push eax
push esi
push str..ResourcesTranslations
push 0
push ecx
call fcn.0040fc40
add esp, 0x14
jmp 0x48d19a
lea edx, [esp + 0x28]
push edx
call fcn.0048c9d0
mov ecx, dword [esp + 0x30]
mov eax, dword [eax]
push ecx
push esi
push eax
lea edx, [esp + 0x18]
push 0
push edx
mov byte [esp + 0x34], 2
call fcn.0040fc40
add esp, 0x18
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x48db30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67a54a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push 0
push 0
mov esi, ecx
push 0
push 0x738574
mov dword [esp + 0x20], esi
call sub.MFC42u.DLL_CPropertySheetEx::CPropertySheetEx
lea edi, [esi + 0xc0]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.0048e300
lea ecx, [esi + 0x168]
mov byte [esp + 0x1c], 1
call fcn.00612980
lea ecx, [esi + 0x240]
mov byte [esp + 0x1c], 2
call fcn.0060ef60
push 0
push 0xffffffffffffffff
push 0x71e468
mov byte [esp + 0x28], 3
mov dword [esi], vtable.CTDLWebUpdatePromptDlg.0
call fcn.00407bd0
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x164], eax
add esp, 0xc
mov dword [esi + 0x160], eax
mov eax, dword [esp + 0x28]
push eax
push ecx
mov ecx, edi
call fcn.0048e3c0
push edi
mov ecx, esi
call sub.MFC42u.DLL_CPropertySheetEx::AddPage
mov edx, dword [esi + 0x90]
and dh, 0xfd
or edx, 0x1180004
mov dword [esi + 0x90], edx
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0
push 0x30
push 0x80
lea ecx, [esp + 0x18]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], 0x7d5
call fcn.00407330
mov eax, dword [eax + 4]
mov byte [esp + 0x1c], 4
push eax
call fcn.00409e50
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esi + 0x304], eax
mov dword [esi + 0xbc], eax
mov byte [esp + 0x1c], 3
call fcn.00407360
mov eax, dword [esi + 0x90]
mov ecx, dword [esp + 0x14]
or al, 0x20
pop edi
mov dword [esi + 0x90], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x48e3c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67a6e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea eax, [esp + 8]
push edi
mov esi, ecx
push eax
call fcn.00418200
add esp, 4
mov edi, eax
push 0
push 0xc8b4
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00411680
mov ecx, dword [esp + 0x20]
mov edx, dword [edi]
mov eax, dword [eax]
push ecx
push edx
push eax
lea eax, [esi + 0x90]
mov byte [esp + 0x24], 1
push eax
call sub.MFC42u.DLL_CString::Format_1
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.004116d0
or edi, 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], edi
call sub.MFC42u.DLL_CString::CString
push 0x71f2f0
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_2
push 0
push 0xc8b3
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 2
call fcn.00411680
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x24], 3
call sub.MFC42u.DLL_operator_3
push eax
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 4
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call fcn.004116d0
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], edi
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x24]
push 0
push 1
push 0x71f9e8
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004184f0
add esp, 0x14
add esi, 0x9c
push eax
mov ecx, esi
mov dword [esp + 0x1c], 5
call sub.MFC42u.DLL_CString::operator_2
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString
push 0x718e6c
push 0x71bcd0
mov ecx, esi
call sub.MFC42u.DLL_CString::Replace
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x48e920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67a719
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42u.DLL_CString::CString_5
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esi + 8]
mov byte [esp + 0x14], 1
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 2
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 3
call sub.MFC42u.DLL_CString::CString_5
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret