joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c200
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x40c258
lea eax, [ecx - 4]
test ecx, ecx
je 0x40c21e
push eax
call sub.MFC40.DLL_CString::CString_2
mov ebx, dword [esi + 4]
mov edi, dword [esp + 0x1c]
lea ebp, [ebx - 4]
cmp edi, ebp
je 0x40c23e
sub ebp, 4
sub ebx, 4
push ebp
mov ecx, ebx
call sub.MFC40.DLL_CString::operator
cmp edi, ebp
jne 0x40c22c
mov eax, dword [esp + 0x20]
mov ecx, edi
push eax
call sub.MFC40.DLL_CString::operator
add dword [esi + 4], 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 8
sub ecx, dword [esi]
test ecx, 0xfffffffc
je 0x40c26d
sar ecx, 2
add ecx, ecx
mov dword [esp + 0x14], ecx
jmp 0x40c275
mov dword [esp + 0x14], 0x400
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x18]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40c2c0
mov edi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call edi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esi]
mov edi, dword [esp + 0x1c]
cmp edi, ebp
je 0x40c2e6
mov eax, ebp
mov ecx, ebx
add ebp, 4
add ebx, 4
test ecx, ecx
je 0x40c2e2
push eax
call sub.MFC40.DLL_CString::CString_2
cmp edi, ebp
jne 0x40c2ce
mov eax, edi
mov ecx, dword [esp + 0x10]
sub eax, dword [esi]
and eax, 0xfffffffc
add ecx, eax
je 0x40c2ff
mov eax, dword [esp + 0x20]
push eax
call sub.MFC40.DLL_CString::CString_2
mov eax, edi
mov ecx, dword [esp + 0x10]
sub eax, dword [esi]
mov ebp, dword [esi + 4]
and eax, 0xfffffffc
cmp edi, ebp
lea ebx, [eax + ecx + 4]
je 0x40c32d
mov eax, edi
mov ecx, ebx
add edi, 4
add ebx, 4
test ecx, ecx
je 0x40c329
push eax
call sub.MFC40.DLL_CString::CString_2
cmp edi, ebp
jne 0x40c315
mov edi, dword [esi + 4]
mov ebx, dword [esi]
cmp ebx, edi
je 0x40c344
mov ecx, ebx
add ebx, 4
call fcn.004d8858
cmp ebx, edi
jne 0x40c336
mov eax, dword [esi]
push eax
call sub.MFC40.DLL_operator_delete
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add esp, 4
lea edx, [ecx + eax*4]
mov eax, dword [esi + 4]
mov dword [esi + 8], edx
sub eax, dword [esi]
pop ebp
sar eax, 2
pop edi
mov dword [esi], ecx
lea eax, [ecx + eax*4]
add eax, 4
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x40c520
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x40c56b
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x40f750
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x5004f0
jmp 0x401020

Function at 0x412090
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4120db
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x418650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41877f
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x10], ecx
call fcn.004184f0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], eax
mov dword [ecx], vtable.CMyDCFont.0
lea eax, [ebp - 0x60]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
push eax
mov ecx, dword [edx + 4]
push 0x3c
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
push eax
call fcn.00418590
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov ecx, edx
push eax
mov eax, dword [edx]
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x10]
push 0x4fce70
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x1c]
call sub.MFC40.DLL_CString::CString_1
mov byte [ebp - 4], 1
mov ecx, dword [eax]
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
call fcn.00418777
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push str.WVUTSRQPONMLKJIHGFEDCBAZYX
mov dword [ecx + 0x18], edx
lea ecx, [ebp - 0x1c]
call sub.MFC40.DLL_CString::CString_1
mov byte [ebp - 4], 2
mov ecx, dword [eax]
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
call fcn.0041876f
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov dword [ecx + 0x14], edx
mov ecx, dword [ebp - 0xc]
mov esp, ebp
mov dword fs:[0], ecx
pop ebp
ret 8
Function at 0x418c00
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418e28
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov esi, ecx
push eax
mov edi, 0
call fcn.0042e310
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x418c47
mov edi, dword [ebp + 8]
add edi, 0x1c8
mov dword [esi + method.CHelpArbitrator.virtual_0], vtable.CHelpArbitrator.0
mov eax, dword [edi + 4]
push 0
mov dword [esi + 0x1cc], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x1d0], ecx
mov ebx, dword [edi + 0x10]
sub ebx, dword [edi + 0xc]
sar ebx, 2
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
shl ebx, 2
add esp, 4
push ebx
call sub.MFC40.DLL_operator_new
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x418cb4
mov eax, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
mov dword [ebp - 0x14], eax
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call dword [ebp - 0x14]
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov dword [esi + 0x1d4], ebx
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
cmp edx, eax
je 0x418cde
mov ecx, edx
mov eax, ebx
add edx, 4
add ebx, 4
test eax, eax
je 0x418cd9
mov ecx, dword [ecx]
mov dword [eax], ecx
cmp edx, dword [ebp - 0x14]
jne 0x418cc7
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x18]
mov byte [ebp - 4], 2
mov dword [esi + 0x1e0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1e4], ecx
mov edx, dword [edi + 0x20]
add eax, 0x200
push eax
mov dword [esi + 0x1e8], edx
mov dword [esi + method.CPanel_2.virtual_0], vtable.COwner.0
mov dword [esi + 0x1ec], 1
mov ecx, dword [eax - 0xc]
mov dword [esi + 0x1f4], ecx
lea ecx, [esi + 0x200]
call fcn.0044df60
mov byte [ebp - 4], 3
lea ecx, [esi + 0x208]
call fcn.0044def0
lea ecx, [esi + 0x210]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 4
add eax, 0x210
push eax
call fcn.0044f6e0
mov byte [ebp - 4], 5
lea ecx, [esi + 0x3d0]
lea ebx, [esi + 0x250]
call sub.MFC40.DLL_CString::CString_3
mov byte [ebp - 4], 6
mov ecx, ebx
mov dword [esi], vtable.CWidgetAsciiPlus.2.0
mov dword [esi + 0x40], vtable.CWidgetAsciiPlus.1.0
mov dword [esi + method.CPanel_2.virtual_0], vtable.CWidgetAsciiPlus.0
mov edi, dword [ebx]
call dword [edi + pe_nt_image_headers32]
mov ecx, 0
lea eax, [esi + 0x1c8]
cmp esi, 1
adc ecx, 0xffffffff
and ecx, eax
push ecx
mov ecx, ebx
call dword [edi + 0x4c]
mov eax, esi
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419a40
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
lea ecx, [eax + eax*2]
lea ecx, [eax + ecx*4]
shl ecx, 2
push ecx
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x419a91
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x41ad40
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
mov eax, dword [ecx + 4]
push edi
cmp dword [ecx + 8], eax
push ebp
mov esi, ecx
je 0x41adc4
lea ecx, [eax - 0x18]
test eax, eax
je 0x41ad60
push ecx
mov ecx, eax
call fcn.004a2000
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x1c]
lea edx, [ecx - 0x18]
cmp edi, edx
je 0x41ad96
mov eax, dword [edx - 0x18]
mov ebx, dword [edx - 0x14]
mov dword [ecx - 0x18], eax
sub edx, 0x18
mov dword [ecx - 0x14], ebx
sub ecx, 0x18
mov eax, dword [edx + 8]
cmp edi, edx
mov dword [ecx + 8], eax
mov ebx, dword [edx + 0xc]
mov dword [ecx + 0xc], ebx
mov ebp, dword [edx + 0x10]
mov dword [ecx + 0x10], ebp
jne 0x41ad6e
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, dword [edx + 8]
pop ebp
mov dword [edi + 8], eax
mov ecx, dword [edx + 0xc]
mov dword [edi + 0xc], ecx
mov edx, dword [edx + 0x10]
mov dword [edi + 0x10], edx
pop edi
add dword [esi + 4], 0x18
pop esi
pop ebx
add esp, 8
ret 8
sub eax, dword [esi]
mov ecx, 0x18
cdq
idiv ecx
test eax, eax
lea edi, [eax*2]
jne 0x41adde
mov edi, 0xaa
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
add esp, 4
lea eax, [edi + edi*2]
shl eax, 3
mov dword [esp + 0x14], eax
push eax
call sub.MFC40.DLL_operator_new
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x41ae2c
mov edi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call edi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esi]
mov edi, dword [esp + 0x1c]
cmp edi, ebp
je 0x41ae52
mov eax, ebp
mov ecx, ebx
add ebp, 0x18
add ebx, 0x18
test ecx, ecx
je 0x41ae4e
push eax
call fcn.004a2000
cmp edi, ebp
jne 0x41ae3a
mov eax, edi
mov ecx, 0x18
sub eax, dword [esi]
cdq
idiv ecx
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x10]
lea ecx, [eax + edx*8]
test ecx, ecx
je 0x41ae76
mov edx, dword [esp + 0x20]
push edx
call fcn.004a2000
mov eax, edi
mov ecx, 0x18
sub eax, dword [esi]
mov ebp, dword [esi + 4]
cdq
idiv ecx
cmp edi, ebp
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x10]
lea ebx, [eax + edx*8 + 0x18]
je 0x41aeac
mov eax, edi
mov ecx, ebx
add edi, 0x18
add ebx, 0x18
test ecx, ecx
je 0x41aea8
push eax
call fcn.004a2000
cmp edi, ebp
jne 0x41ae94
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov eax, edx
cmp eax, ecx
je 0x41aebc
add eax, 0x18
jmp 0x41aeb3
push edx
call sub.MFC40.DLL_operator_delete
mov eax, dword [esp + 0x18]
add esp, 4
mov ecx, 0x18
add eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
pop ebp
mov dword [esi], ebx
idiv ecx
pop edi
lea edx, [eax + eax*2]
lea eax, [ebx + edx*8]
add eax, ecx
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x420e20
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x420e6f
lea eax, [ecx - 4]
test ecx, ecx
je 0x420e3c
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x18]
lea edx, [eax - 4]
cmp edx, ecx
je 0x420e59
mov edi, dword [edx - 4]
sub eax, 4
sub edx, 4
mov dword [eax], edi
cmp edx, ecx
jne 0x420e4a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov edx, dword [eax]
mov dword [ecx], edx
add dword [esi + 4], 4
pop esi
pop ebx
add esp, 4
ret 8
sub ecx, dword [esi]
test ecx, 0xfffffffc
je 0x420e84
sar ecx, 2
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x420e8c
mov dword [esp + 0x10], 0x400
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x14]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x420ed5
mov ebx, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebx
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
mov edx, dword [esi]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
je 0x420ef8
mov ebp, edx
mov ebx, eax
add edx, 4
add eax, 4
test ebx, ebx
je 0x420ef4
mov ebp, dword [ebp]
mov dword [ebx], ebp
cmp edx, ecx
jne 0x420ee1
mov eax, ecx
sub eax, dword [esi]
and eax, 0xfffffffc
lea edx, [eax + edi]
test edx, edx
je 0x420f0e
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax]
mov dword [edx], ebx
mov eax, ecx
mov ebx, dword [esi + 4]
sub eax, dword [esi]
and eax, 0xfffffffc
cmp ecx, ebx
lea edx, [eax + edi + 4]
je 0x420f37
mov eax, ecx
mov ebp, edx
add ecx, 4
add edx, 4
test ebp, ebp
je 0x420f33
mov eax, dword [eax]
mov dword [ebp], eax
cmp ecx, ebx
jne 0x420f20
mov eax, dword [esi]
push eax
call sub.MFC40.DLL_operator_delete
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [edi + eax*4]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov dword [esi + 8], ecx
sar eax, 2
pop ebp
mov dword [esi], edi
lea eax, [edi + eax*4]
add eax, 4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x420f70
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x420fbb
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x420fe0
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x42102f
lea eax, [ecx - 4]
test ecx, ecx
je 0x420ffc
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x18]
lea edx, [eax - 4]
cmp ecx, edx
je 0x421019
mov edi, dword [edx - 4]
sub eax, 4
sub edx, 4
mov dword [eax], edi
cmp ecx, edx
jne 0x42100a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov edx, dword [eax]
mov dword [ecx], edx
add dword [esi + 4], 4
pop esi
pop ebx
add esp, 4
ret 8
sub ecx, dword [esi]
test ecx, 0xfffffffc
je 0x421044
sar ecx, 2
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x42104c
mov dword [esp + 0x10], 0x400
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x14]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x421095
mov ebx, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebx
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
mov edx, dword [esi]
mov ecx, dword [esp + 0x18]
cmp ecx, edx
je 0x4210b8
mov ebp, edx
mov ebx, eax
add edx, 4
add eax, 4
test ebx, ebx
je 0x4210b4
mov ebp, dword [ebp]
mov dword [ebx], ebp
cmp ecx, edx
jne 0x4210a1
mov eax, ecx
sub eax, dword [esi]
and eax, 0xfffffffc
lea edx, [eax + edi]
test edx, edx
je 0x4210ce
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax]
mov dword [edx], ebx
mov eax, ecx
mov ebx, dword [esi + 4]
sub eax, dword [esi]
and eax, 0xfffffffc
cmp ecx, ebx
lea edx, [eax + edi + 4]
je 0x4210f7
mov eax, ecx
mov ebp, edx
add ecx, 4
add edx, 4
test ebp, ebp
je 0x4210f3
mov eax, dword [eax]
mov dword [ebp], eax
cmp ecx, ebx
jne 0x4210e0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, ecx
cmp edx, eax
je 0x421107
add edx, 4
jmp 0x4210fe
push ecx
call sub.MFC40.DLL_operator_delete
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [edi + eax*4]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov dword [esi + 8], ecx
sar eax, 2
pop ebp
mov dword [esi], edi
lea eax, [edi + eax*4]
add eax, 4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x42ca20
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x505f10
jmp 0x401020

Function at 0x42e310
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e45a
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, ecx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
mov ebx, 0x34
call fcn.00446e80
mov ecx, dword [ebp + 8]
push 0
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x1a4]
sub eax, dword [ecx + 0x1a0]
cdq
idiv ebx
mov edi, eax
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
add esp, 4
lea eax, [edi + edi*2]
lea eax, [edi + eax*4]
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x42e3a9
mov ebx, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebx
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [esi + 0x1a0], edi
mov eax, dword [ecx + 0x1a4]
mov ebx, dword [ecx + 0x1a0]
mov dword [ebp - 0x14], eax
cmp ebx, eax
je 0x42e3de
mov eax, ebx
mov ecx, edi
add ebx, 0x34
add edi, 0x34
test ecx, ecx
je 0x42e3d9
push eax
call fcn.0042dfc0
cmp ebx, dword [ebp - 0x14]
jne 0x42e3c5
lea ecx, [esi + 0x1ac]
mov eax, dword [ebp + 8]
add eax, 0x1ac
mov dword [esi + 0x1a4], edi
push eax
mov dword [esi + 0x1a8], edi
mov byte [ebp - 4], 1
call sub.MFC40.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ecx + 0x1b0]
pop edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1b0], edx
mov dword fs:[0], ecx
mov dword [esi], vtable.CWidgetEditPlus.0
mov dword [esi + 0x40], vtable.CWidgetEditPlus.1.0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x432480
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4324cb
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x4337a0
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x5060e8
jmp 0x401020
Function at 0x433cd0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push ebp
push 0
mov ebp, dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
call ebp
add esp, 4
push 8
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x433d20
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
mov ebx, dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
call ebx
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
jmp 0x433d26
mov ebx, dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push 0
call ebp
add esp, 4
push 0xff0
call sub.MFC40.DLL_operator_new
add esp, 4
mov ebp, eax
test ebp, ebp
jne 0x433d64
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call ebx
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov dword [edi + 4], ebp
mov eax, dword [0x4fe1ac]
mov dword [edi], eax
mov dword [0x4fe1ac], edi
mov ebp, dword [edi + 4]
mov dword [0x4fe1a4], ebp
lea eax, [ebp + 0xff0]
pop ebp
mov dword [0x4fe1a0], eax
pop edi
pop esi
pop ebx
add esp, 8
ret