joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb91
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4156d8
cmp edx, dword [eax]
je 0x40bbb3
add eax, 8
inc ecx
cmp eax, 0x415768
jl 0x40bba4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4156d8]
jne 0x40bce1
mov eax, dword [0x416330]
cmp eax, 1
je 0x40bcbb
test eax, eax
jne 0x40bbe4
cmp dword [0x4152e4], 1
je 0x40bcbb
cmp edx, 0xfc
je 0x40bce1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40bc1b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407dc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004075d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40bc5e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004075d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x413748
push edi
call fcn.0040ce30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407dc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407dd0
lea eax, [ebp - 0xa0]
push 0x4151cc
push eax
call fcn.00407dd0
push dword [esi + 0x4156dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407dd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040cd9d
add esp, 0x2c
pop edi
jmp 0x40bce1
lea eax, [ebp + 8]
lea esi, [esi + 0x4156dc]
push 0
push eax
push dword [esi]
call fcn.004075d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40f30d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x40f34d
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x40f32b
and esi, 3
xor eax, eax
dec esi
je 0x40f369
dec esi
je 0x40f362
dec esi
jne 0x40f36e
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc
Function at 0x4042b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [edi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x4c]
lea eax, [edi + 0x6f0]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x30]
push 1
mov ecx, esi
mov ebp, eax
call sub.MFC42.DLL_CDC::SetBkMode
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub eax, ecx
push 5
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
lea ecx, [edi + 0x130]
push eax
push ecx
push esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x19
call fcn.0043e746
mov eax, dword [edi + 0x12c]
add esp, 0x10
test eax, eax
jle 0x4043c0
lea ecx, [esp + 0x4c]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [edi + 0x12c]
lea eax, [esp + 0x4c]
push edx
push 0x44e070
push eax
mov dword [esp + 0x50], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
sub eax, ecx
mov ecx, dword [esp + 0x24]
push 5
sub ecx, edi
lea edx, [eax - 0x28]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x3c], edx
lea edi, [ecx - 0x1e]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x5c]
push ecx
push edx
push esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], eax
call fcn.0043e746
add esp, 0x1c
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi]
push ebp
mov ecx, esi
call dword [eax + 0x30]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x40cf90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x442378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x10]
mov ecx, dword [edi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x50]
lea eax, [edi + 0x7c0]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x30]
push 1
mov ecx, esi
mov dword [esp + 0x10], eax
call sub.MFC42.DLL_CDC::SetBkMode
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
sub eax, ebx
push 5
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x34]
lea ecx, [edi + 0x1e8]
push eax
push ecx
push esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0x19
call fcn.0043e746
mov eax, dword [edi + 0x1e4]
add esp, 0x10
test eax, eax
jle 0x40d0a2
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [edi + 0x1e4]
lea eax, [esp + 0x50]
push edx
push 0x44e070
push eax
mov dword [esp + 0x54], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x28]
push 5
sub ecx, ebx
lea edx, [eax - 0x28]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x40], edx
lea ebx, [ecx - 0x1e]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x60]
push ecx
push edx
push esi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
call fcn.0043e746
add esp, 0x1c
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub ebx, 0x25
add eax, 0x39
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x1f4]
mov ebx, 0x14
add edx, ebx
sub ecx, ebx
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
jne 0x40d140
mov ecx, dword [esp + 0x14]
mov eax, edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x1ec]
lea ecx, [esp + 0x20]
push 0x414
mov dword [esp + 0x2c], edx
mov edx, dword [esi]
push ecx
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x70]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov edi, dword [edi + 0x1ec]
mov eax, dword [esi]
sub edx, ecx
cmp edx, 0xf
jge 0x40d130
push 0x15
jmp 0x40d131
push ebx
mov edx, dword [edi - 8]
lea ecx, [esp + 0x14]
push ecx
push edx
push edi
mov ecx, esi
call dword [eax + 0x70]
mov ecx, dword [esp + 0xc]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x40eb30
Capabilities:
Set current directory

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
lea edi, [esp + 0x1d]
lea ebp, [esi + 0x148]
mov byte [esp + 0x1c], 0
mov dword [ebp], eax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push ecx
stosb byte es:[edi], al
call fcn.0043dae6
mov edx, dword [eax]
add esp, 4
lea eax, [esp + 0x1c]
push edx
push str._sdata
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, esi
call fcn.004120c0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esi + 0x50e0], eax
call ebx
push 1
mov edi, eax
call ebx
cmp edi, 0x2ee
jg 0x40ebc7
mov edi, 0x2ee
cmp eax, 0x23a
jg 0x40ebd3
mov eax, 0x23a
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x17]
push eax
push ecx
push 0
push ebp
mov dword [esp + 0x2c], edi
mov byte [esp + 0x27], 1
call dword [sym.imp.2DEngineDll.dll_public:_static_long_int___cdecl_IXHandler::IDisplay::InitializeEx2_struct_HWND____const_const___char_const___bool_const___unsigned_int_const___unsigned_int_const__]
add esp, 0x14
mov ecx, esi
call fcn.0040fc90
lea edi, [esi + 0x14c]
mov ecx, edi
call fcn.00433560
lea ecx, [esi + 0x2958]
call fcn.00405240
lea ecx, [esi + 0x4ef8]
call fcn.004300c0
push edi
lea ecx, [esi + 0x5024]
call fcn.00401220
push 0
mov ecx, esi
call fcn.0040ff50
mov dword [esi + 0x20], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x4137e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4429a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
xor eax, eax
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 4], 0x18
call fcn.004357d0
lea edx, [esp + 4]
push 3
push edx
push 0x18
push 7
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
call fcn.00435850
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00435810
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4

Function at 0x4219b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x442be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x1c
call fcn.004357d0
lea edx, [esp + 4]
push 2
push edx
push 0x1c
push 7
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0
call fcn.00435850
mov ecx, dword [esi + 8]
lea edx, [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00435810
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 4

Function at 0x421a50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
movsx edx, byte [0x4509c4]
push 0x442c08
push eax
mov dword fs:[0], esp
sub esp, 0x24
lea eax, [edx + edx*4]
push ebx
mov ebx, dword [esp + 0x38]
push esi
shl eax, 8
push edi
mov edi, ecx
mov esi, dword [eax + 0x45119c]
xor ecx, ecx
test esi, esi
jle 0x421ab1
lea eax, [eax + 0x4511a0]
cmp dword [eax], ebx
je 0x421a9e
inc ecx
add eax, 4
cmp ecx, esi
jl 0x421a90
jmp 0x421ab1
lea eax, [edx + edx*4]
shl eax, 6
add eax, ecx
mov esi, dword [eax*4 + 0x4511f0]
test esi, esi
jne 0x421ac3
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.MSVCRT.dll_time]
mov esi, dword [esp + 0x44]
add esp, 4
xor edx, edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 0xc], 0x1c
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
call fcn.004357d0
lea eax, [esp + 0xc]
push 2
push eax
push 0x1c
push 7
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0
call fcn.00435850
mov ecx, dword [edi + 8]
lea eax, [esp + 0x1c]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
add esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00435810
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x423840
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x442d5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x518
push ebx
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x322]
mov word [esp + 0x320], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x103
stosw word es:[edi], ax
lea eax, [esp + 0x324]
push eax
push 0
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0x320]
push 0x5c
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4238be
lea edx, [esp + 0x320]
push 0x2f
push edx
call esi
add esp, 8
mov ebp, eax
mov word [ebp], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11a]
mov word [esp + 0x118], 0
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [0x4508ac]
stosw word es:[edi], ax
lea eax, [esp + 0x11c]
push eax
push ecx
call ebx
mov edi, 2
lea edx, [esp + 0x118]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
jne 0x42391d
lea eax, [esp + 0x118]
push 0x2f
push eax
call esi
add esp, 8
dec edi
mov word [eax], 0
jne 0x4238fb
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..config.ini
push 0
push str.Version
push 0x44ec7c
call ebx
mov ecx, eax
mov eax, 0x431bde83
mul ecx
mov esi, edx
mov eax, ecx
xor edx, edx
mov edi, 0xf4240
div edi
mov eax, 0xd1b71759
shr esi, 0x12
mul edx
mov edi, edx
mov eax, ecx
xor edx, edx
mov ecx, 0x2710
div ecx
lea ecx, [esp + 0x118]
lea eax, [ebp + 2]
push ecx
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
shr edi, 0xd
push edx
push edi
push esi
lea edx, [esp + 0x344]
push eax
push edx
push eax
push 0x44ec6c
call fcn.0043f7b0
add esp, 0x34
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
call fcn.0043d20c
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x534], 0
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str._sconfigDynamicInfo.ini
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x2710
push 0x44ec44
push 0x44ec7c
call ebx
push 0
push eax
call fcn.0043fea0
add esp, 8
call fcn.0043fe60
lea ecx, [esp + 0x10]
mov dword [esp + 0x530], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x51c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x524
ret
Function at 0x425390
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4432d0
push eax
mov dword fs:[0], esp
mov dword [esp + 8], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push 5
push ecx
push str.public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [esp + 0x14]
cmp eax, 5
mov byte [esp + 8], 0
lea ecx, [esp + 0x10]
mov dword [edx], eax
jne 0x425401
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc

Function at 0x425880
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x4432f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push 0x4500bc
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call fcn.0043dae6
add esp, 4
push str...GameListMenu1.dll
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0xdc], eax
je 0x425a06
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateRMenuObject
push eax
call edi
mov dword [esi + 0xe0], eax
mov eax, dword [esi + 0xdc]
push str.ReleaseRMenuWnd
push eax
call edi
mov ecx, dword [esi + 0xdc]
push str.AddNewMenu
push ecx
mov dword [esi + 0xe4], eax
call edi
mov edx, dword [esi + 0xdc]
push str.CreateRMenu
push edx
mov dword [esi + 0xe8], eax
call edi
mov dword [esi + 0xec], eax
mov eax, dword [esi + 0xdc]
push str.SetLpIGameSite
push eax
call edi
mov dword [esi + 0xf0], eax
mov eax, dword [esi + 0xcc]
cmp eax, ebx
je 0x425998
mov ecx, dword [esi + 0xdc]
push str.MenuOnOtherMsg
push ecx
call edi
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0xe0]
pop edi
cmp eax, ebx
je 0x4259c3
cmp dword [esi + 0xe4], ebx
je 0x4259c3
cmp dword [esi + 0xe8], ebx
je 0x4259c3
cmp dword [esi + 0xec], ebx
je 0x4259c3
cmp dword [esi + 0xf0], ebx
jne 0x425a06
push ebx
push ebx
push 0x44ee20
call sub.MFC42.DLL_AfxMessageBox_1
mov edx, dword [esi + 0xdc]
mov dword [esi + 0xe0], ebx
push edx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xc4], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0xdc], ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x425ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov edi, ecx
push 0x4500bc
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
call fcn.0043dae6
add esp, 4
push str.hcq.dll
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [edi + 0x9e34], eax
je 0x425c36
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x425b95
mov eax, dword [edi + 0x9e34]
push eax
jmp 0x425c30
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0x447bf8
push 0x446a68
call eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x425c29
test eax, eax
jl 0x425c29
mov edx, dword [ecx]
lea esi, [edi + 0xa60c]
push esi
push 0x446a48
push 0
push ecx
call dword [edx + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
test eax, eax
je 0x425c14
test ebp, ebp
jl 0x425c14
mov edx, dword [eax]
push 0x10
push eax
call dword [edx + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [edi + 0x9e34]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
jmp 0x425c36
mov ecx, dword [edi + 0x9e34]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x427bc0
Capabilities:
Access peb ldr_data
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4433e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push 0x4500bc
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x28], ebx
call fcn.0043dae6
add esp, 4
push str.dlgprj.dll
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4500bc
lea ecx, [esp + 0x14]
mov dword [esi + 0x11c], eax
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push str.lala_strPath__s
push ecx
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0xc
push edx
call ebp
mov eax, dword [esi + 0x11c]
cmp eax, ebx
jne 0x427c96
push str.lala_m_hDlgDll__NULL
jmp 0x427cfe
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DLGAboutShow
push eax
call edi
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x11c]
push str.DLGSetting
push eax
call edi
mov ecx, dword [esi + 0x11c]
push str.DLGExit
push ecx
mov dword [esi + 0x124], eax
call edi
mov edx, dword [esi + 0x11c]
push str.DLGExitAnswer
push edx
mov dword [esi + 0x128], eax
call edi
mov dword [esi + 0x12c], eax
mov eax, dword [esi + 0x120]
cmp eax, ebx
pop edi
jne 0x427cf9
push str.lala_DlgAbout__NULL
jmp 0x427cfe
push str.lala_DlgAbout___NULL
call ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret