joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f1c8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1eb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
lea ecx, [esi + 0x18]
push ebx
mov dword [esp + 0x14], esi
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0044cf20
push ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0x50
mov byte [esi + 0x28], 1
call fcn.0044bf90
push edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 1
call fcn.004051e0
mov edi, dword [esp + 0x28]
mov byte [esp + 0x1c], 2
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x38]
mov ebp, eax
lea ecx, [ebp + 1]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi + 0x1c], eax
mov edx, dword [edi]
mov ecx, edi
push ebp
push eax
call dword [edx + 0x3c]
mov ecx, dword [esi + 0x1c]
pop edi
mov byte [ecx + eax], bl
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40f520
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4b1f19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
call fcn.0040fc20
xor ebx, ebx
lea edi, [esi + 0x14c8]
push ebx
push ebx
push 1
mov dword [edi], vtable.ITermStreamSink.0
push ebx
mov dword [esp + 0xc8], ebx
mov dword [esi + 0x14cc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x14d0], eax
mov eax, dword [esp + 0xc8]
cmp eax, ebx
mov dword [esi + 0x14d4], ebx
mov dword [esi + 0x14d8], eax
mov dword [esi + 0x14dc], ebx
mov dword [esi + 0x14e0], ebx
mov dword [esi + 0x14e4], ebx
mov dword [esi + 0x14e8], ebx
mov dword [esi + 0x14ec], ebx
mov dword [esi + 0x1900], ebx
mov dword [esi], vtable.PrinterPortStream.1.0
mov dword [edi], vtable.PrinterPortStream.0
je 0x40f5da
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, esi
mov ecx, dword [esi + 0x14d8]
neg eax
sbb eax, eax
and eax, edi
push eax
call fcn.0043c540
mov edi, dword [esp + 0xc0]
cmp edi, ebx
jne 0x40f5f1
mov dword [esi + 0x20], 1
jmp 0x40f767
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
push edi
lea edx, [esp + 0x10]
push str.._s
push edx
mov byte [esp + 0xc4], 1
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x18]
add esp, 0xc
push ebx
push 0x40000000
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x14cc], eax
jne 0x40f6d7
mov ecx, dword [0x58f8c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x74]
call fcn.0044f770
mov edx, dword [0x58f8c8]
lea ecx, [esp + 0x28]
push edx
push 0xe100001f
mov byte [esp + 0xc0], 2
call fcn.0044f770
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0xbc], 3
call fcn.0044fd90
lea ecx, [esp + 0x6c]
call fcn.004500d0
push eax
lea ecx, [esp + 0x2c]
call fcn.0044fd90
push ebx
push ebx
lea ecx, [esp + 0x30]
call fcn.004500d0
push eax
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 0x28]
mov dword [esi + 0x20], 1
mov byte [esp + 0xb8], 2
call fcn.0044fa10
lea ecx, [esp + 0x6c]
mov byte [esp + 0xb8], 1
call fcn.0044fa10
jmp 0x40f757
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x40f72e
mov eax, dword [esi + 0x14cc]
mov ecx, dword [esp + 0xc4]
push eax
call fcn.00460910
test al, al
jne 0x40f700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 0x14cc]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x1388
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push ebx
push 4
push ebx
push ebx
push esi
push 0x40fc00
call sub.MFC42.DLL_AfxBeginThread
mov dword [esi + 0x14d4], eax
mov dword [eax + 0x28], ebx
mov eax, dword [esi + 0x14d4]
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [esp + 0xc]
mov byte [esp + 0xb8], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xb0]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xb0
ret 0xc
Function at 0x4103b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b2046
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
xor eax, eax
push esi
mov dword [esp + 4], eax
push edi
mov dword [esp + 0xc], eax
mov edi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [0x58f8f0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004279c0
mov edx, dword [edi + 8]
lea ecx, [esp + 8]
push ecx
push edx
xor esi, esi
call dword [sym.imp.GDI32.dll_StartDocA]
test eax, eax
jg 0x410451
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0xa4]
push eax
mov dword [esp + 0xa8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xb4], 2
je 0x410451
mov esi, 0xe1000004
mov ecx, dword [0x58f8f0]
call fcn.004279d0
test esi, esi
je 0x410523
mov ecx, dword [0x58f8c8]
push ecx
push esi
lea ecx, [esp + 0x68]
call fcn.0044f770
lea ecx, [esp + 0x60]
mov dword [esp + 0x140], 0
call fcn.004500e0
push eax
push 0x571f78
call fcn.0046d7a0
add esp, 8
cmp esi, 0x4c7
je 0x4104ef
mov edx, dword [0x58f8c8]
lea ecx, [esp + 0x1c]
push edx
push 0xe1000005
call fcn.0044f770
lea ecx, [esp + 0x60]
mov byte [esp + 0x140], 1
call fcn.004500e0
push eax
lea ecx, [esp + 0x20]
call fcn.0044fd90
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.004512d0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 0
call fcn.0044fa10
lea ecx, [esp + 0x60]
mov dword [edi + 0x20], 1
mov dword [esp + 0x140], 0xffffffff
call fcn.0044fa10
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
add esp, 0x13c
ret
mov ecx, dword [esp + 0x138]
mov dword [edi + 0x58], 1
mov dword [edi + 0x5c], 0xffffffff
pop edi
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret
Function at 0x411570
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b21de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
push 0xd9
mov dword [esp + 0x1c], esi
call fcn.004af9d8
lea edi, [esi + 0x64]
mov dword [esp + 0x20], ebx
mov ecx, edi
mov dword [esi + 0x60], vtable.IHostnameChanged.0
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x28]
lea ecx, [esi + 0x7c]
push eax
mov byte [esp + 0x24], 1
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.004afb58
push 0x58f110
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi], vtable.QuickConnectDialog.1.0
mov dword [esi + 0x60], vtable.QuickConnectDialog.0
call sub.MFC42.DLL_CString::operator
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
cmp dword [0x58f5c8], ebx
jne 0x4116d4
push ebx
lea ecx, [esp + 0x10]
call sub.ConnectDialog13.dll_public:_void___thiscall_SessionDatabase::constructor_int_
push 0x571334
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_4
push ebx
push 0x571618
push 0x5715f8
lea ecx, [esp + 0x34]
push ebx
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 3
call sub.ConnectDialog13.dll_public:_class_ISessionConfig____thiscall_SessionDatabase::Lookup_class_CString_const__
push eax
call sub.MSVCRT.dll___RTDynamicCast
add esp, 0x14
lea ecx, [esp + 0x28]
mov edi, eax
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [edi]
push ebx
push 0x571618
push 0x5715f8
push ebx
mov ecx, edi
call dword [edx + 0x30]
push eax
call sub.MSVCRT.dll___RTDynamicCast
add esp, 0x14
cmp edi, ebx
mov dword [0x58f5c8], eax
je 0x411676
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edx, dword [0x58f5c8]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [edx + 0x38]
call sub.ConnectDialog13.dll_public:_class_VString___thiscall_ConnectConfigPtr::Protocol_void_
push 0x572030
push eax
mov byte [esp + 0x28], 4
call fcn.0044dec0
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], al
mov byte [esp + 0x20], 2
call fcn.0044d0c0
cmp byte [esp + 0x28], bl
je 0x4116d4
push ebx
call sub.ConnectDialog13.dll_class_ConnectProtocolTable____cdecl_GetConnectProtocolTable_void_
mov ecx, eax
call sub.ConnectDialog13.dll_public:_class_ConnectProtocolTableElement____thiscall_ConnectProtocolTable::operator___int_
mov ecx, eax
call fcn.0044c8e0
mov ecx, dword [0x58f5c8]
push eax
call sub.ConnectDialog13.dll_public:_void___thiscall_SessionConfig::SetTerminalProtocol_char_const__
mov ecx, dword [0x58f5c8]
push ebx
push 0x571618
push 0x5715f8
mov eax, dword [ecx]
push ebx
call dword [eax + 0x30]
push eax
call sub.MSVCRT.dll___RTDynamicCast
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov dword [esi + 0x70], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x416008
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b28e8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0xc]
call fcn.0044e0a0
test al, al
push 0
jne 0x41603a
push 0
push str.ScriptThread:_Notification_sink_creation_failed
call sub.MFC42.DLL_AfxMessageBox
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
test edi, edi
jge 0x41609d
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
push edi
lea eax, [esp + 0xc]
push str.COM
push eax
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::Format_1
mov ecx, dword [esp + 0x14]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
call edi
test eax, eax
je 0x4160de
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x10]
push ecx
call ebp
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call edi
test eax, eax
jne 0x4160c5
pop ebp
mov eax, dword [esi + 0x98]
test eax, eax
je 0x416104
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 0x98]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [esi + 0x98], 0
lea ecx, [esi + 0x28]
mov byte [esi + 0xa4], 0
call fcn.00401b50
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4197b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x40c
mov eax, dword [esp + 0x410]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
xor edx, edx
xor esi, esi
mov eax, dword [edi - 8]
mov dword [esp + 0x10], edx
test eax, eax
jle 0x419863
mov al, byte [edi + esi]
cmp al, 0x30
jl 0x4197e9
cmp al, 0x39
jg 0x4197e9
movsx eax, al
sub eax, 0x30
jmp 0x41980b
cmp al, 0x61
jl 0x4197f9
cmp al, 0x66
jg 0x4197f9
movsx eax, al
sub eax, 0x57
jmp 0x41980b
cmp al, 0x41
jl 0x419809
cmp al, 0x46
jg 0x419809
movsx eax, al
sub eax, 0x37
jmp 0x41980b
xor eax, eax
mov cl, byte [edi + esi + 1]
cmp cl, 0x30
jl 0x419821
cmp cl, 0x39
jg 0x419821
movsx ecx, cl
sub ecx, 0x30
jmp 0x419847
cmp cl, 0x61
jl 0x419833
cmp cl, 0x66
jg 0x419833
movsx ecx, cl
sub ecx, 0x57
jmp 0x419847
cmp cl, 0x41
jl 0x419845
cmp cl, 0x46
jg 0x419845
movsx ecx, cl
sub ecx, 0x37
jmp 0x419847
xor ecx, ecx
shl al, 4
add al, cl
add esi, 2
mov byte [esp + edx + 0x1c], al
mov eax, dword [edi - 8]
inc edx
cmp esi, eax
jl 0x4197d6
mov dword [esp + 0x10], edx
mov eax, 4
cmp edx, eax
jle 0x41988f
lea ecx, [eax - 4]
and ecx, reloc.WS2_32.dll_closesocket
jns 0x41987c
dec ecx
or ecx, 0xfffffffc
inc ecx
mov cl, byte [esp + ecx + 0x1c]
mov bl, byte [esp + eax + 0x1c]
xor bl, cl
mov byte [esp + eax + 0x1c], bl
inc eax
cmp eax, edx
jl 0x41986c
mov ebx, dword [esp + 0x430]
mov ebp, dword [esp + 0x42c]
test ebx, ebx
jle 0x4198cf
mov edi, dword [esp + 0x428]
mov esi, ebp
sub edi, ebp
push 0x58f110
lea ecx, [edi + esi]
call sub.MFC42.DLL_CString::operator
push 0x58f110
mov ecx, esi
call sub.MFC42.DLL_CString::operator
add esi, 4
dec ebx
jne 0x4198ac
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x424]
sub edx, 5
and eax, 0xff
test edx, edx
mov dword [ecx], eax
lea esi, [esp + 0x21]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
jle 0x4199ac
mov eax, dword [esp + 0x428]
mov ebx, ebp
sub eax, ebp
mov dword [esp + 0x18], eax
jmp 0x419911
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x430]
mov edi, dword [esp + 0x14]
cmp edi, ecx
jge 0x4199ac
cmp byte [esi], 0
je 0x419936
push esi
lea ecx, [ebx + eax]
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0x10]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
sub eax, ecx
mov edi, esi
add edx, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esi + ecx + 1]
lea esi, [esi + ecx + 1]
test al, al
je 0x419971
push esi
mov ecx, ebx
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0x10]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add ebx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
sub eax, ecx
mov edi, esi
add edx, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], edx
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x14]
not ecx
dec ecx
inc edi
test edx, edx
lea esi, [esi + ecx + 1]
mov dword [esp + 0x14], edi
jg 0x41990d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret
Function at 0x422a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b3ecd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esp + 0x24]
call fcn.00453320
push 0
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], 0
call fcn.0044cf20
push 0
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], 1
call fcn.0044cf20
mov dword [esp + 0x24], vtable.VProfile2_class_VString__class_VProfileSz_.0
push 0
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 2
call fcn.00453070
push str.Global
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 3
call fcn.00450fe0
push eax
lea ecx, [esp + 0x14]
call fcn.00453180
push 0
push 0xffffffffffffffff
push 0x58f110
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 4
call fcn.0044d050
push str.Config_Path
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 5
call fcn.00453300
lea eax, [esp + 0xc]
test eax, eax
je 0x422b24
lea eax, [esp + 0x24]
lea ecx, [esp + 0x30]
neg eax
sbb eax, eax
push 4
and eax, ecx
lea ecx, [esp + 0x2c]
push eax
call fcn.0044c8e0
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x34]
call fcn.00453430
test al, al
je 0x422b24
push 0
jmp 0x422b34
lea eax, [esp + 8]
lea ecx, [esp + 0x30]
push eax
call fcn.0044c2f0
push 1
lea ecx, [esp + 0x28]
call fcn.00453310
lea eax, [esp + 0x24]
lea ecx, [esp + 0x30]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x34]
push eax
call fcn.0044c2f0
lea ecx, [esp + 8]
mov byte [esp + 0x40], 4
call fcn.0044d0c0
lea ecx, [esp + 0x30]
call fcn.0044d920
test al, al
jne 0x422b9b
lea eax, [esp + 0x24]
lea edx, [esp + 0x30]
neg eax
sbb eax, eax
push edi
mov edi, dword [esp + 0x4c]
and eax, edx
push eax
mov ecx, edi
call fcn.0044c2f0
mov ecx, edi
call fcn.0044c8e0
push eax
mov ecx, esi
call fcn.00422310
pop edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 3
call fcn.004531a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 2
call fcn.00453100
lea ecx, [esp + 0x34]
mov dword [esp + 0x40], 7
call fcn.0044d0c0
lea ecx, [esp + 0x24]
lea eax, [esp + 0x30]
neg ecx
sbb ecx, ecx
mov byte [esp + 0x40], 6
and ecx, eax
call fcn.0044d0c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0xffffffff
call fcn.004532c0
mov ecx, dword [esp + 0x38]
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x424dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x58f698]
sub esp, 0x110
cmp eax, 5
push ebx
push esi
push edi
jb 0x424df0
mov edi, dword [str.SoftwareClasses_telnet_shellopencommand]
mov esi, getpeername
jmp 0x424dfb
mov edi, dword [str.telnet_shellopencommand]
mov esi, bind
mov ebx, dword [esp + 0x120]
mov dword [esp + 0xc], 0
mov ecx, ebx
call sub.MFC42.DLL_CString::Empty
lea eax, [esp + 0xc]
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424e3f
push str.RegOpenKeyEx_hRootKey__
call fcn.0046d7a0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x110
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0x58f110
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x424e9a
push str.RegQueryValueEx_hkey__
call fcn.0046d7a0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call sub.MFC42.DLL_CString::operator
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x110
ret
Function at 0x433fa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov dword [esi + 8], edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov dword [esp + 0xc], esi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
mov al, byte [esp + 0x30]
add ecx, edx
shl ecx, 2
dec edi
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esi + 0x4c], 1
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], edi
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], al
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x90], 1
call sub.MFC42.DLL_operatornew
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
add edx, ecx
add esp, 4
xor edi, edi
mov dword [esi + 4], eax
test edx, edx
jle 0x43409c
push 0x24
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x18], 1
je 0x434084
mov cl, byte [esi + 0x59]
mov edx, dword [esi + 0x10]
push ecx
push edx
mov ecx, eax
call fcn.004336f0
jmp 0x434086
xor eax, eax
mov ecx, dword [esi + 4]
inc edi
mov byte [esp + 0x18], bl
mov dword [ecx + edi*4 - 4], eax
mov edx, dword [esi + 8]
add edx, dword [esi + 0x14]
cmp edi, edx
jl 0x43405c
mov ecx, 8
xor eax, eax
lea edi, [esi + 0x70]
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x43ec60
Capabilities:
Open clipboard

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b5ea1
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, ecx
push 0xe100001c
call edi
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_OpenClipboard]
push eax
call ebp
test eax, eax
je 0x43eca5
mov al, 1
jmp 0x43ee37
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xe100001c
jne 0x43ecd4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xe100001c
call edi
mov ecx, dword [esi + 0x20]
push ecx
call ebp
test eax, eax
je 0x43ecd4
mov al, 1
jmp 0x43ee37
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov esi, eax
call ebx
cmp eax, 0xe100001c
jne 0x43edeb
xor edi, edi
cmp esi, edi
je 0x43edeb
cmp dword [0x58f918], edi
jne 0x43ed21
push 0x5759b8
lea edx, [esp + 0xa4]
push str.User32.dll
push edx
call fcn.00454e20
add esp, 0xc
lea ecx, [esp + 0xa0]
call fcn.0044fa10
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
mov eax, dword [0x58f918]
test eax, eax
je 0x43ed43
push 2
push esi
call eax
mov edi, eax
push str._Unknown_Application_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_4
test edi, edi
mov dword [esp + 0xec], 0
je 0x43ed72
push edi
call sub.MFC42.DLL_CWnd::FromHandle
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov edx, dword [0x58f8c8]
lea ecx, [esp + 0x18]
push edx
push 0xe1000018
call fcn.0044f770
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0xf0], 1
call fcn.0044fd90
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0044ffe0
push ebp
lea ecx, [esp + 0x1c]
call fcn.0044ffe0
lea edx, [esp + 0x18]
push edx
push 0
call fcn.004512d0
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0xec], 0
call fcn.0044fa10
lea ecx, [esp + 0x10]
mov dword [esp + 0xec], 0xffffffff
call sub.MFC42.DLL_CString::CString
jmp 0x43ee35
mov eax, dword [0x58f8c8]
push eax
call ebx
push eax
lea ecx, [esp + 0x64]
call fcn.0044f770
lea ecx, [esp + 0x5c]
mov dword [esp + 0xec], 2
call fcn.004500e0
push eax
push 0xe1000017
push 0
call fcn.00451360
add esp, 0xc
lea ecx, [esp + 0x5c]
mov dword [esp + 0xec], 0xffffffff
call fcn.0044fa10
xor al, al
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret
Function at 0x442f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b6070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], vtable.CFont.0
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x30]
mov edx, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
mov edi, eax
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ebx, dword [esp + 0x5c]
mov ecx, 0xe
lea esi, [esp + 0x14]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x4c]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 0xc

Function at 0x4471e0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 4]
mov dword [ecx], vtable.VThread.0
test eax, eax
je 0x4471f2
jmp method.ScriptThread.virtual_8
ret
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
ret

Function at 0x447200
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x447250
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret