joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45c4a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
mov dword [esp + 0x1c], ebx
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push eax
push 0x46580c
push 0x17
push ebx
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x30], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [esp + 0x38], ebx
mov eax, dword [esp + 8]
mov edx, dword [eax]
lea ecx, [esp + 0xc]
je 0x402c93
push 0xffffffffffffffff
jmp 0x402c94
push ebx
push ecx
push eax
call dword [edx + 0x24]
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0x14]
call dword [0x464b10]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
mov eax, dword [esp + 8]
cmp eax, ebx
mov byte [esp + 0x1c], bl
je 0x402cd6
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4039e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45c5fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push esi
push edi
mov edi, ecx
push 0x400
lea ecx, [esp + 0x10]
call fcn.0045ab96
push 0x98
mov dword [esp + 0xd0], 0
call sub.MFC71.DLL_operator_new
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0xcc], 1
je 0x403a47
mov ecx, dword [edi + 0x8c]
push ecx
mov ecx, eax
call fcn.00402d40
mov esi, eax
jmp 0x403a49
xor esi, esi
push 0
push 0x1000
push 0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x8c]
mov byte [esp + 0xdc], 0
call fcn.0045ab90
mov eax, dword [edi]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, edi
mov byte [esp + 0xd0], 2
call dword [eax + 8]
lea ecx, [esp + 0x7c]
call sub.MFC71.DLL_CArchive::Flush
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
lea ecx, [esp + 0x18]
call dword [edx + 0x30]
push 0
push 0x1000
push 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0045ab90
mov eax, 3
mov dword [esp + 0x44], eax
mov edx, dword [esi]
mov byte [esp + 0xcc], al
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call dword [edx + 8]
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
call sub.MFC71.DLL_CArchive::CArchive
lea ecx, [esp + 0x7c]
mov byte [esp + 0xcc], 0
call sub.MFC71.DLL_CArchive::CArchive
lea ecx, [esp + 0xc]
mov dword [esp + 0xcc], 0xffffffff
call sub.MFC71.DLL_CMemFile::CMemFile
mov ecx, dword [esp + 0xc4]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xc8
ret
Function at 0x408320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ca99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [0x464424]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::StringLength]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a500
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45cdfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x467cdc
call fcn.00434690
xor ebx, ebx
push 0xa
lea ecx, [esi + 0x2c]
mov dword [esp + 0x2c], ebx
call sub.MFC71.DLL_CObList::CObList
mov dword [esi + 0x28], ebx
xor eax, eax
xor ecx, ecx
mov edx, 0x64
lea ebx, [esi + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
push edx
mov ebp, edx
mov dword [ebx + 8], edx
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
mov dword [ebx + 0xc], ebp
call fcn.004346b0
push eax
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.004347b0
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00434710
mov ecx, dword [esp + 0x20]
pop edi
mov byte [esi + 4], bl
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x40b530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b550
test al, 0x10
je 0x40b550
mov eax, 1
ret
xor eax, eax
ret
Function at 0x40bcd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45d10e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
lea ecx, [esp + 0xc]
call fcn.00433210
xor ebx, ebx
push ebx
push str.SoftwareAheadNero_WaveEditor_
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.Directories
push eax
push ecx
mov byte [esp + 0x30], 1
call fcn.00408320
add esp, 0xc
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x18]
call fcn.00433220
lea ecx, [esp + 4]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, dword [esp + 0x24]
dec eax
cmp eax, 4
ja case.default.0x40bd4d
jmp dword [eax*4 + 0x40be44]
mov edx, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 2
push str.Presets
jmp 0x40be0e
mov eax, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 3
push str.Plugin
jmp 0x40be0e
mov edx, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 4
push str.Peakfiles
jmp 0x40be0e
mov eax, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 5
push str.Temporary
jmp 0x40be0e
mov edx, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
mov byte [esp + 0x24], 6
push str.MyMusic
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.00433390
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00433550
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x40bfe0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x45d132
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
mov dword [esp + 0xc], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esp + 0x14]
mov byte [esp + 0xc], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::IsEmpty]
test al, al
jne 0x40c043
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
dec eax
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetAt]
cmp al, 0x5c
je 0x40c043
push 0x4681e4
lea ecx, [esp + 0x18]
call dword [0x464b38]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40c0af
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 4]
push 0x111
push ecx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format_1]
add esp, 0xc
push 0
push 4
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call sub.MFC71.DLL_AfxMessageBox_1
cmp eax, 7
jne 0x40c0af
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor al, al
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 4]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40c810
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45d229
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi], 0x468550
mov dword [esp + 0x1c], eax
mov dword [edi], 0x4684f8
mov dword [edi + 4], eax
lea ebp, [esi + 0x18]
mov dword [ebp], 0x4684f8
mov dword [ebp + 4], eax
push 0xa
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 2
call sub.MFC71.DLL_CObList::CObList
push 0x93
push 4
push 0x93
mov byte [esp + 0x28], 3
call sub.MFC71.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
push eax
call ebx
push eax
mov ecx, edi
call sub.MFC71.DLL_CMenu::Attach
push 0xcd
push 4
push 0xcd
call sub.MFC71.DLL_AfxFindResourceHandle
push eax
call ebx
push eax
mov ecx, ebp
call sub.MFC71.DLL_CMenu::Attach
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40c82c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45d229
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi], 0x468550
mov dword [esp + 0x1c], eax
mov dword [edi], 0x4684f8
mov dword [edi + 4], eax
lea ebp, [esi + 0x18]
mov dword [ebp], 0x4684f8
mov dword [ebp + 4], eax
push 0xa
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 2
call sub.MFC71.DLL_CObList::CObList
push 0x93
push 4
push 0x93
mov byte [esp + 0x28], 3
call sub.MFC71.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
push eax
call ebx
push eax
mov ecx, edi
call sub.MFC71.DLL_CMenu::Attach
push 0xcd
push 4
push 0xcd
call sub.MFC71.DLL_AfxFindResourceHandle
push eax
call ebx
push eax
mov ecx, ebp
call sub.MFC71.DLL_CMenu::Attach
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40c8d0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45d25e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x468550
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 2
call fcn.0045aaf6
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
mov dword [ecx], 0x4684f8
call sub.MFC71.DLL_CMenu::DestroyMenu
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 0
mov dword [ecx], 0x4684f8
call sub.MFC71.DLL_CMenu::DestroyMenu
mov ecx, dword [esp + 8]
mov dword [esi], 0x468514
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40c8e6
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45d25e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x468550
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 2
call fcn.0045aaf6
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
mov dword [ecx], 0x4684f8
call sub.MFC71.DLL_CMenu::DestroyMenu
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 0
mov dword [ecx], 0x4684f8
call sub.MFC71.DLL_CMenu::DestroyMenu
mov ecx, dword [esp + 8]
mov dword [esi], 0x468514
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45d539
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [0x464424]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x416570
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45e0ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
lea edi, [esi + 4]
mov ecx, edi
mov dword [esi], 0x46a1e4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ebx, [esi + 8]
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [esi + 0x10], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x28]
mov dword [esi + 0xc], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x41bff0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45e8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.00406df0
xor eax, eax
push 0x20
mov dword [esp + 0x14], eax
mov dword [esi], 0x46b3c0
mov byte [esi + 0x28], al
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], 0xbf800000
mov dword [esi + 0x30], eax
mov byte [esi + 0x29], al
call sub.MFC71.DLL_operator_new_1
mov dword [esi + 0x2c], eax
add esp, 4
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x41de00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45eb2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
xor edi, edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
mov eax, dword [esi + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
push 0x5c
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push str.GDIPlus.dll
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00408320
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x10]
mov dword [esi + 0x100], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push edi
lea ecx, [esp + 0x18]
push ecx
add esi, 0xf8
push esi
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call sub.gdiplus.dll_GdiplusStartup
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x42e340
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x42e36c
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x42e389
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42e3ad
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4681e4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
push esi
je 0x42e398
mov eax, dword [esp + 0x14]
mov dx, word [eax + 0x12]
mov cx, word [eax + 0x10]
mov word [esp + 0x1c], dx
mov dx, word [eax + 0x16]
mov ax, word [eax + 0x14]
mov word [esp + 0x1e], cx
mov word [esp + 0x20], dx
mov word [esp + 0x22], ax
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x430960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call sub.MFC71.DLL_CStdioFile::CStdioFile
push 0
push 0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x18]
call sub.MFC71.DLL_CStdioFile::Open
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x34]
call fcn.004302b0
push 0x46cfe4
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CompareNoCase]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [esp + 8]
inc bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test bl, bl
je 0x4309e7
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004306d0
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x34]
call fcn.004302b0
push 0x46cfe0
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CompareNoCase]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [esp + 8]
inc bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test bl, bl
je 0x430a24
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00430770
lea ecx, [esp + 0xc]
call sub.MFC71.DLL_CStdioFile::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0045b2ea
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x20]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x430d30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4602c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0x400
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
mov dword [esi], 0x46cfe8
call fcn.0045ab96
lea edi, [esi + 0x2c]
mov ecx, edi
mov dword [esp + 0x14], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
mov eax, dword [esp + 0x1c]
push 0x465798
mov ecx, edi
mov byte [esp + 0x18], 1
mov dword [esi + 0x30], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x431730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4603b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x465844
movzx eax, word [esp + 0x1c]
push 0x2040
push esi
push esi
push esi
push eax
push 2
push eax
mov dword [esp + 0x30], esi
call sub.MFC71.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
lea ecx, [esp + 8]
call sub.MFC71.DLL_CGdiObject::Attach
push esi
mov esi, dword [esp + 0x24]
push 3
push 0x19
push 0x18
push 0x18
mov ecx, esi
call sub.MFC71.DLL_CImageList::Create
mov eax, dword [esp + 8]
mov ecx, dword [esi + 4]
push 0xff00ff
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 4], 0x46581c
call fcn.0045ab26
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8