joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5437c0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x587ab2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push edi
push 0
push 0x5e308c
push 6
mov edi, ecx
push str..zip
push 0x5e3080
push 1
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFileDialog::CFileDialog
lea ecx, [esp + 0x14]
mov dword [esp + 0x218], 0
call sub.MFC42.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x54398f
lea eax, [esp + 4]
push ebx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileDialog::GetPathName
lea ecx, [esp + 0xc]
push 4
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 1
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x5d558c
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x54396a
push esi
push 0
lea edx, [esp + 0x18]
push str.skin_
push edx
call fcn.004528d0
add esp, 0xc
push 0x5c
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 2
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x10]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0xc]
mov bl, 3
mov byte [esp + 0x220], bl
mov ecx, dword [eax - 8]
cmp esi, ecx
jge 0x543945
mov eax, ecx
lea ecx, [esp + 0xc]
sub eax, esi
dec eax
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x224], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x220], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00564ce6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x543945
push 0
push 0
push 0x5e3074
mov ecx, edi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [edi + 0x160]
call fcn.005478a0
test eax, eax
je 0x543945
mov edx, dword [edi + 0x180]
push eax
push 9
push 0x110b
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x220], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x220], 1
call sub.MFC42.DLL_CString::CString
pop esi
jmp 0x54397d
push 0x30
push 0x5e2ff0
push 0x5e3050
mov ecx, edi
call sub.MFC42.DLL_CWnd::MessageBoxA
lea ecx, [esp + 8]
mov byte [esp + 0x21c], 0
call sub.MFC42.DLL_CString::CString
pop ebx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x218], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x218], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x210]
pop edi
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x5478a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5881bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push edi
mov edi, ecx
mov dword [esp + 0x14], 0xffff0003
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], 0x27
mov eax, dword [edi + 0x4c]
push ecx
mov dword [esp + 0x14], eax
mov eax, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0xc]
xor ebx, ebx
push 4
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], ebx
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x5d558c
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete byte [esp + 0x54]
call sub.MFC42.DLL_CString::CString
cmp byte [esp + 0x54], bl
je 0x547a75
push esi
push 0x1c
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, ebx
mov byte [esp + 0x50], 1
je 0x547990
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 4]
mov byte [esp + 0x50], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 8]
mov byte [esp + 0x50], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0xc]
mov byte [esp + 0x50], 4
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x10]
mov byte [esp + 0x50], 5
call sub.MFC42.DLL_CString::CString_3
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], vtable.CBitmap.0
jmp 0x547992
xor esi, esi
mov eax, dword [esp + 0xc]
mov ecx, edi
push eax
push esi
mov byte [esp + 0x58], bl
call fcn.005471b0
neg eax
sbb eax, eax
push 0x5c
and eax, esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], eax
call sub.MFC42.DLL_CString::ReverseFind
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x58]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Right
push 0x2e
lea ecx, [esp + 0x5c]
mov byte [esp + 0x54], 6
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x60]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x54], 7
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 6
call sub.MFC42.DLL_CString::CString
push 0x208
lea ecx, [esp + 0x5c]
call sub.MFC42.DLL_CString::GetBuffer
push 0xffffffffffffffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x30], eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x1100
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x58]
mov esi, eax
mov byte [esp + 0x50], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x44]
pop edi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x54be10
Capabilities:
Accept command line arguments
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x588755
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x10], esi
mov dword [esi + 4], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0xc]
mov dword [esp + 0x28], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x10]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_3
mov dword [esi + 0x34], edi
lea ebp, [esi + 0x3c]
mov byte [esp + 0x28], 3
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x40]
mov byte [esp + 0x28], 4
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov ecx, ebp
mov byte [esp + 0x28], 5
mov dword [esi + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], 0x98967f
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
call sub.MFC42.DLL_CString::Empty
mov ecx, ebx
call sub.MFC42.DLL_CString::Empty
mov eax, dword [0x5ed920]
mov ecx, 0x5ed920
mov dword [esp + 0x14], ecx
call dword [eax + 4]
mov eax, dword [0x5e5cb8]
mov bl, 6
cmp eax, edi
mov byte [esp + 0x28], bl
jne 0x54bfa4
cmp dword [0x5e5cb4], edi
jne 0x54bfa4
push 0x380
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
cmp ebp, edi
mov byte [esp + 0x28], 7
je 0x54bf15
mov ecx, ebp
call fcn.00478dc0
mov dword [ebp], vtable.CComObjectNoRef_class_CKMPPlayer_.0
mov eax, ebp
jmp 0x54bf17
xor eax, eax
mov ecx, dword [0x5eafa8]
mov dword [0x5e5cb4], eax
xor ebp, ebp
mov byte [esp + 0x28], bl
mov ebx, dword [0x5cebb0]
lea eax, [ecx - 1]
cmp eax, edi
jl 0x54bf54
mov ecx, dword [0x5eafa4]
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 4]
cmp ebx, edx
jge 0x54bf50
inc ebp
add ecx, 8
cmp ebp, eax
jle 0x54bf3b
cmp eax, edi
jge 0x54bf6a
push 1
mov eax, 0x406a50
push ebx
push eax
push ebp
mov ecx, 0x5eafa0
call fcn.00417f10
jmp 0x54bf9a
jle 0x54bf9a
mov eax, dword [0x5eafa4]
cmp dword [eax + edi*8], 0x406a50
je 0x54bf9a
push 1
mov eax, 0x406a50
push ebx
push eax
push ebp
mov ecx, 0x5eafa0
call fcn.00417f10
mov ecx, dword [0x5eafa8]
inc edi
dec ecx
cmp edi, ecx
jl 0x54bf6c
mov dword [0x5e5cb8], 1
mov edx, dword [0x5ed920]
mov edi, dword [0x5e5cb4]
mov ecx, 0x5ed920
mov byte [esp + 0x28], 5
call dword [edx + 8]
push esi
mov ecx, edi
call fcn.00479b90
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push str._play
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x54bfe2
mov dword [esi + 0x30], 1
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x54e490
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
mov cx, word [0x5e391c]
mov dl, byte [0x5e391e]
mov word [esp + 4], cx
add cl, al
lea eax, [esp + 4]
mov byte [esp + 6], dl
push eax
mov byte [esp + 8], cl
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 5
sete al
ret 4
Function at 0x550730
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x244
mov eax, dword [esp + 0x248]
push ebx
xor ebx, ebx
push ebp
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x550770
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret 8
lea ecx, [esp + 8]
push ebx
push ecx
lea edx, [esp + 0x4c]
push 0x108
push edx
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x55079f
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret 8
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push esi
mov esi, dword [esp + 0x258]
push edi
lea edi, [esp + 0x155]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov ecx, 0x3f
xor eax, eax
mov byte [esp + 0x154], bl
lea edx, [esp + 0x54]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp byte [esi], 0x43
jne 0x550811
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x54]
add edx, 0xfffffff8
lea ecx, [esp + 0x34]
push edx
push eax
lea edx, [esp + 0x15c]
push ecx
push edx
mov dword [esp + 0x44], 0x100
call fcn.0055a2a0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x154]
sub eax, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
mov edi, vtable.CBitBuffer.0
add eax, 0xfffffff8
push ecx
push 5
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call fcn.0054fde0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.0054fde0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.0054fde0
mov eax, 0xcccccccd
mov ecx, dword [esp + 0x14]
mul dword [esp + 0x3c]
lea eax, [esp + 0x48]
push eax
push ecx
shr edx, 4
lea ecx, [esp + 0x20]
mov dword [esi + 9], edx
call fcn.0054fde0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.0054fde0
mov eax, 0xcccccccd
mul dword [esp + 0x40]
mov eax, dword [esp + 0x28]
shr edx, 4
cmp eax, ebx
mov dword [esi + 0xd], edx
je 0x5508c4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], ebx
inc eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x30]
push ecx
push 0x10
lea ecx, [esp + 0x20]
call fcn.0054fde0
mov dx, word [esp + 0x30]
lea eax, [esp + 0x38]
push eax
push 0x10
lea ecx, [esp + 0x20]
mov word [esi + 0x11], dx
call fcn.0054fde0
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov cl, ah
push ebp
mov ch, al
mov word [esi + 0x13], cx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], edi
pop edi
cmp eax, ebx
pop esi
je 0x550921
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x550921
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
pop ebp
mov eax, 1
pop ebx
add esp, 0x244
ret 8
Function at 0x550d40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x588bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, vtable.CUnzipper.0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
call fcn.00550bd0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x434], ebx
push eax
call fcn.0055b020
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0055b2d0
mov esi, dword [esp + 0x43c]
mov dword [esp + 0x18], ebx
cmp esi, ebx
mov byte [esp + 0x1c], bl
je 0x550e3d
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push esi
call ebp
test eax, eax
je 0x550e3d
lea edx, [esp + 0x124]
push ebx
push edx
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
test eax, eax
je 0x550e3d
lea eax, [esp + 0x124]
push eax
call fcn.0055b2c0
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x550e30
lea ecx, [esp + 0x32c]
push ebx
lea edx, [esp + 0x22c]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x130]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
lea edx, [esp + 0x340]
push ebx
lea eax, [esp + 0x240]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
setne al
cmp al, bl
jne 0x550e5c
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edi
push eax
call fcn.0055b020
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0055b2d0
xor al, al
jmp 0x550f60
cmp ecx, ebx
je 0x550f42
mov edi, dword [esp + 0x440]
cmp edi, ebx
je 0x550f42
push edi
call ebp
test eax, eax
je 0x550f42
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x550ef2
and eax, 0x10
cmp al, 0x10
sete al
cmp al, bl
je 0x550f42
lea ecx, [esp + 0x14]
call fcn.00551110
test eax, eax
je 0x550f42
push ebx
lea ecx, [esp + 0x18]
call fcn.00551190
test al, al
je 0x550f42
mov esi, dword [esp + 0x444]
lea ecx, [esp + 0x14]
push esi
push edi
call fcn.00551500
test al, al
je 0x550f42
push ebx
lea ecx, [esp + 0x18]
call fcn.00551310
test al, al
je 0x550f40
push esi
push edi
lea ecx, [esp + 0x1c]
call fcn.00551500
test al, al
jne 0x550ed3
jmp 0x550f42
push edi
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, eax
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0xc
cmp eax, ebx
je 0x550e9a
push esi
mov byte [eax], bl
call fcn.00551bb0
add esp, 4
test al, al
push esi
jne 0x550f26
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
jmp 0x550f42
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x550f42
jmp 0x550e9a
mov bl, 1
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.CUnzipper.0
push edx
call fcn.0055b020
mov eax, dword [esp + 0x18]
push eax
call fcn.0055b2d0
mov al, bl
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x428
ret
Function at 0x551bb0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x551c13
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
je 0x551c13
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x551be0
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
pop edi
sete cl
mov al, cl
pop esi
ret
push edi
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, eax
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0xc
test eax, eax
je 0x551c2e
push esi
mov byte [eax], 0
call fcn.00551bb0
add esp, 4
test al, al
push esi
jne 0x551c18
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
xor al, al
pop esi
ret
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x551c13
pop edi
mov al, 1
pop esi
ret

Function at 0x551d10
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 8], ebx
je 0x551d9f
cmp dword [esp + 0x30], ebx
jne 0x551d3b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esi + 0xc]
push ebx
push ebx
push 0x12
push eax
mov dword [esi + 4], 1
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ebx
push ecx
call edi
test eax, eax
je 0x551d7e
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x551d56
mov ecx, dword [esi + 8]
push 1
push ecx
call ebp
cmp eax, ebx
je 0x551d8f
cmp eax, 0xffffffff
jne 0x551d56
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov edi, eax
lea eax, [esi + 0xc]
push eax
push ebx
push edi
push 0x551e00
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x551de9
test edi, edi
je 0x551dd7
push 0xffffffffffffffff
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 8], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
Function at 0x552770
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x8c]
push edi
cmp eax, ebp
mov dword [esi + 0x90], ebp
jbe 0x5527a9
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi], ebp
mov eax, dword [esi + 0x8c]
inc ebx
add edi, 4
cmp ebx, eax
jb 0x55278e
mov eax, dword [esp + 0x18]
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x88], ebp
mov dword [esi + 0x84], ebp
cmp eax, 0xffffffff
mov dword [esi + 0x9c], 1
mov dword [esi + 0x98], eax
jne 0x5527de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
push 8
xor ebx, ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x98]
mov dword [esp + 0x10], ebp
cmp eax, 0xffffffff
je 0x5528fd
push ebp
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, ebx
jne 0x5528fd
mov edx, dword [esi + 0x98]
lea ecx, [esp + 0x10]
push ebp
push ecx
push 8
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp eax, ebp
je 0x5528fd
cmp dword [esp + 0x10], 8
jne 0x5528fd
push 0xc
call sub.MFC42.DLL_operatornew
add esp, 4
cmp eax, ebp
je 0x5528fd
mov cl, byte [edi + 3]
mov dl, byte [edi + 2]
mov byte [esp + 0x18], cl
mov cl, byte [edi + 1]
mov byte [esp + 0x19], dl
mov dl, byte [edi]
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], dl
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov dl, byte [edi + 7]
mov cl, byte [edi + 6]
mov byte [esp + 0x18], dl
mov dl, byte [edi + 5]
mov byte [esp + 0x19], cl
mov cl, byte [edi + 4]
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], cl
mov dword [eax + 8], ebx
mov edx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov ecx, dword [eax]
cmp ecx, 8
jb 0x5528fd
mov ecx, dword [esi + 0x8c]
cmp ecx, 0x20
ja 0x5528fd
mov dword [esi + ecx*4 + 4], eax
mov ecx, dword [esi + 0x8c]
inc ecx
mov dword [esi + 0x8c], ecx
mov edx, dword [eax + 4]
xor ecx, ecx
cmp edx, 0x6d6f6f76
sete cl
cmp ecx, ebp
je 0x5528d6
cmp dword [esi + 0x84], ebp
jne 0x5528d6
mov dword [esi + 0x84], eax
mov edx, dword [eax + 4]
xor ecx, ecx
cmp edx, 0x6d646174
sete cl
cmp ecx, ebp
je 0x5528f6
cmp dword [esi + 0x88], ebp
jne 0x5528f6
mov dword [esi + 0x88], eax
add ebx, dword [eax]
jmp 0x5527ec
push edi
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esi + 0x84]
add esp, 4
cmp ecx, ebp
je 0x552922
cmp dword [esi + 0x88], ebp
je 0x552922
mov dword [esi + 0x90], 1
mov eax, dword [esi + 0x90]
cmp eax, ebp
jne 0x55296a
cmp dword [esi + 0x88], ebp
jne 0x55294a
cmp ecx, ebp
jne 0x552960
mov dword [esi + 0xa4], 2
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
cmp ecx, ebp
jne 0x552960
mov dword [esi + 0xa4], 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 0xa4], 5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x556ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x589413
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CWnd::CWnd
lea edi, [esi + 0x48]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::CString_3
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
push 0x5e3d0c
mov ecx, edi
mov byte [esp + 0x34], 1
mov dword [esi], vtable.CVideoTimeWnd.0
call sub.MFC42.DLL_CString::operator_2
push 0xff00ff
mov dword [esi + 0x40], ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x4c], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x194
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
cmp eax, ebx
mov dword [esi + 0x44], eax
je 0x556b5b
lea ecx, [esp + 0x10]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], eax
push 0x5cfc38
push 0x20
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push 0xc
mov dword [esi + 0x54], ebx
call dword [sym.imp.GDI32.dll_CreateFontA]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x5588f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x58971b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0xc]
push str.cookie.ini
push eax
call fcn.004528d0
mov ecx, dword [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1b8], 0
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
je 0x558a47
mov edx, dword [esp + 8]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5e5830
push 0x5d42e0
push str.root
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5e5830
push str.totalTime
push str.root
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5e5830
push str.score
push str.root
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5e5830
push 0x5e3ecc
push str.root
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::operator_2
mov dword [esi + 0x2c], 1
pop ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1a4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a0
ret