joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c830
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10034c64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x2aff
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CDialog::CDialog_2
lea edi, [esi + 0x60]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x1c], ebp
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0x64]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x68], 0x1003ab88
lea ebp, [esi + 0x70]
mov byte [esp + 0x1c], 3
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
push 0x1005a050
mov ecx, edi
mov byte [esp + 0x20], 4
mov dword [esi], sym.EoRezoTools_3.dll_const_CDlgError::vftable
call sub.MFC42.DLL_CString::operator_2
push 0x1005a050
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0x2c]
mov ecx, ebx
push edx
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0x28]
mov ecx, ebp
push eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x1000d000
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x10034d97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
push ebp
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0x80]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebp, ebp
push ebp
push ebp
push 0x18b
push eax
mov dword [esp + 0x190], ebp
call edi
cmp eax, ebp
jle 0x1000d1b7
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [esi + 0x80]
push 0
push ebp
push 0x187
push ecx
call edi
test eax, eax
je 0x1000d19b
lea edx, [esp + 0x10]
lea ecx, [esi + 0x60]
push edx
push ebp
call sub.MFC42.DLL_CListBox::GetText
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
push 1
lea eax, [esp + 0x7c]
push 0x26
push eax
push 0
mov byte [esp + 0x194], 1
call ebx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x34]
push 0x10054854
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x40], 0x44
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x190], 2
call sub.MFC42.DLL_operator_1
push 0x10054850
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x18c], 3
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x184], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x184], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x78]
lea edx, [esp + 0x14]
push ecx
push str._sInternet_Exploreriexplore.exe
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x24]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000d173
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x184], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x184], 0
call sub.MFC42.DLL_CString::CString
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0x80]
push 0
push 0
push 0x18b
push edx
inc ebp
call edi
cmp ebp, eax
jl 0x1000d05e
pop ebx
push 1
mov ecx, esi
call sub.MFC42.DLL_CDialog::EndDialog
lea ecx, [esp + 0xc]
mov dword [esp + 0x180], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x178]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x178
ret
Function at 0x1000e9e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10035138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_CDialog::OnInitDialog
push 5
push 0x64
push 0x64
xor edi, edi
push 0x8c
push 0x8c
push edi
mov ecx, esi
mov dword [esi + 0xb0], edi
call sub.MFC42.DLL_CWnd::SetWindowPos
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esi + 0xb4]
call sub.MFC42.DLL_CGdiObject::Attach
lea ecx, [esp + 0x10]
call sym.EoRezoTools_3.dll_public:_void___thiscall_CRegistry::constructor_void_
push str.SoftwareEoRezoPop
push SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], edi
call sym.EoRezoTools_3.dll_public:_int___thiscall_CRegistry::CreateKey_struct_HKEY_____char_const__
push str.NbAccounts
push str.SoftwareEoRezoPop
push SysReAllocString
lea ecx, [esp + 0x1c]
call sym.EoRezoTools_3.dll_public:_unsigned_long_int___thiscall_CRegistry::ReadDwordKey_struct_HKEY_____char_const___char_const__
cmp eax, 0xffffffff
mov dword [esi + 0xb0], eax
jne 0x1000ea81
mov dword [esi + 0xb0], edi
push str.Accounts
push str.SoftwareEoRezoPop
lea eax, [esp + 0x14]
push SysReAllocString
push eax
lea ecx, [esp + 0x20]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
mov eax, dword [esi + 0xb0]
mov byte [esp + 0x28], 1
cmp eax, edi
mov dword [esp + 0x14], edi
jle 0x1000eb91
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push edi
push 0x100548d8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 2
mov ebp, edi
call sub.MFC42.DLL_CString::Find_1
mov edi, eax
cmp edi, 0xffffffff
je 0x1000eb29
lea ecx, [esp + 0x20]
push edi
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x80]
push edx
push 0
push 0x180
push eax
call ebx
add edi, 4
jmp 0x1000eb6a
lea ecx, [esp + 0x24]
push ebp
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x80]
push edx
push 0
push 0x180
push eax
call ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0xb0]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x1000eabd
pop ebp
pop ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call sym.EoRezoTools_3.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x100102c0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
mov dword [sym.EoRezoTools_3.dll_struct_HICON____CHyperLink::g_hLinkCursor], eax
jne 0x100102d2
jmp sym.EoRezoTools_3.dll_protected:_static_void___cdecl_CHyperLink::SetDefaultCursor_void_
ret

Function at 0x100107e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10035488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.EoRezoTools_3.dll_struct_HICON____CHyperLink::g_hLinkCursor]
test eax, eax
jne 0x1001088b
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 8]
call fcn.10032ddc
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10010872
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x10010872
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [sym.EoRezoTools_3.dll_struct_HICON____CHyperLink::g_hLinkCursor], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100108a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10010902
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret
Function at 0x10010b10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push ebx
push 0
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x10010bfb
lea eax, [esp + 0x10]
push eax
push str..htm
push SysReAllocString
call sym.EoRezoTools_3.dll_protected:_static_long_int___cdecl_CHyperLink::GetRegKey_struct_HKEY_____char_const___char__
add esp, 0xc
test eax, eax
jne 0x10010bfb
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str._shellopencommand
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
push SysReAllocString
call sym.EoRezoTools_3.dll_protected:_static_long_int___cdecl_CHyperLink::GetRegKey_struct_HKEY_____char_const___char__
add esp, 0xc
test eax, eax
jne 0x10010bfb
lea ecx, [esp + 0x10]
push str.__1_
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10010bd5
lea edx, [esp + 0x10]
push 0x10054ce0
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10010bd5
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x10010bd8
mov byte [esi], 0
push 0x100540d0
push esi
call edi
push ebp
push esi
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x10010c80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x100354f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x124]
push eax
lea eax, [esp + 0x10]
push 0xff
push eax
push 0x1005a050
push ecx
push edx
mov dword [esp + 0x12c], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esi + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
call fcn.10032dca
mov esi, dword [esp + 0x11c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
mov byte [esp + 0x118], 3
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x114], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x120]
mov byte [esp + 0x114], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x124]
mov byte [esp + 0x114], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x114
ret 0xc
Function at 0x10010df0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10035528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 0x74], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x7c]
push eax
lea eax, [esp + 0xc]
push 0x5a
push eax
push 0x1005a050
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edx, edx
mov dword [esi + 0xc], eax
test eax, eax
setg dl
lea ecx, [esp + 4]
mov esi, edx
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x74
ret 4

Function at 0x10010e80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10035556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7d8
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
call sub.MFC42.DLL_CStringList::RemoveAll
mov eax, dword [esi + 0x10]
push eax
lea eax, [esp + 0x14]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea ecx, [esp + 8]
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0xc]
xor edi, edi
test eax, eax
mov dword [esp + 0x7e8], 0
jle 0x10010f5a
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__mbscmp]
mov al, byte [esp + edi + 0x14]
test al, al
je 0x10010f1f
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_operator_3
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x7f0], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x7ec], 0
call sub.MFC42.DLL_CString::CString
jmp 0x10010f51
mov eax, dword [esp + 0xc]
push 0x1005a050
push eax
call ebp
add esp, 8
test eax, eax
je 0x10010f43
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
call sub.MFC42.DLL_CStringList::InsertAfter
push 0x1005a050
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x10010ee2
pop ebp
mov esi, dword [esi + 4]
lea ecx, [esp + 8]
mov dword [esp + 0x7e8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x7e0]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x7e4
ret
Function at 0x10010f90
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1003557e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7d8
push esi
push edi
mov esi, ecx
mov ecx, dword [esi]
xor edi, edi
mov dword [esp + 0x7e8], edi
call sub.MFC42.DLL_CStringList::RemoveAll
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x7f0]
push eax
lea eax, [esp + 0x14]
push 0x7d0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea ecx, [esp + 8]
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0xc]
mov byte [esp + 0x7e8], 1
cmp eax, edi
jle 0x10011074
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__mbscmp]
mov al, byte [esp + edi + 0x14]
test al, al
je 0x1001103a
push eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_operator_3
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x7f0], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x7ec], 1
call sub.MFC42.DLL_CString::CString
jmp 0x1001106b
mov ecx, dword [esp + 0xc]
push 0x1005a050
push ecx
call ebp
add esp, 8
test eax, eax
je 0x1001105d
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
call sub.MFC42.DLL_CStringList::InsertAfter
push 0x1005a050
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x10010ffd
pop ebp
mov esi, dword [esi]
lea ecx, [esp + 8]
mov byte [esp + 0x7e8], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x7f0]
mov dword [esp + 0x7e8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x7e0]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x7e4
ret 4
Function at 0x10013670
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10035c90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esi + 8], edi
call sym.EoRezoTools_3.dll_public:_void___thiscall_CRegistry::constructor_void_
push str.Version
push str.SoftwareEorezoEoEngine
lea eax, [esp + 0x14]
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], ebx
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
add esi, 4
push eax
mov ecx, esi
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
cmp edi, 1
jne 0x1001371c
push str.Version
push str.SoftwareEorezoEoWeather
lea ecx, [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
lea ecx, [esp + 0x30]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
push eax
mov ecx, esi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
jmp 0x100137e1
cmp edi, 2
jne 0x1001375d
push str.Version
push str.SoftwareEorezoEoComputer
lea edx, [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
push edx
lea ecx, [esp + 0x30]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
push eax
mov ecx, esi
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
jmp 0x100137e1
cmp edi, 3
jne 0x1001379b
push str.Version
push str.SoftwareEorezoEoclock
lea eax, [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea ecx, [esp + 0x30]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
push eax
mov ecx, esi
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
jmp 0x100137e1
cmp edi, 0x64
jne 0x100137d9
push str.Version
push str.SoftwareEorezoEoAdv
lea ecx, [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
lea ecx, [esp + 0x30]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
push eax
mov ecx, esi
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
jmp 0x100137e1
push esi
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sym.EoRezoTools_3.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10013940
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10035d04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80c
mov eax, dword [esp + 0x81c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
lea ecx, [esp + 0xc]
mov dword [esi + 0x14], ebx
call fcn.10032dca
mov ecx, dword [esp + 8]
mov dword [esp + 0x81c], ebx
cmp dword [ecx - 8], ebx
jne 0x100139cd
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
push 1
lea edx, [esp + 0x18]
push 0x1a
push edx
push ebx
mov byte [esp + 0x82c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push str._sEoRezouser.xml
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x81c], bl
call sub.MFC42.DLL_CString::CString
push 0x74
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x81c], 2
je 0x100139f0
mov ecx, eax
call sym.EoRezoTools_3.dll_public:_void___thiscall_CXmlUser::constructor_void_
jmp 0x100139f2
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
push edx
mov byte [esp + 0x820], bl
mov dword [esi + 0x38], eax
call sym.EoRezoTools_3.dll_public:_bool___thiscall_CXmlUser::Load_XML_Document_char_const__
and eax, 0xff
mov dword [esp + 0x10], eax
je 0x10013a1c
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x6c]
mov dword [esi + 0x14], eax
mov esi, dword [esi + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x81c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x814]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x818
ret 4
Function at 0x10013e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10035dee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0x24], esi
mov dword [esi + 4], 0x1003c96c
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 0xa
lea ecx, [esi + 0x20]
mov dword [esp + 0x30], edi
call sym.EoRezoTools_3.dll_public:_void___thiscall_CPOP3Handler::constructor_void_
mov byte [esp + 0x30], 1
mov dword [esi], sym.EoRezoTools_3.dll_const_CManagePOP3::vftable
call sym.EoRezoTools_3.dll_bool___cdecl_StartupPOP3Handler_void_
lea ecx, [esp + 0x14]
call sym.EoRezoTools_3.dll_public:_void___thiscall_CRegistry::constructor_void_
push str.NbAccounts
push str.SoftwareEoRezoPop
push SysReAllocString
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call sym.EoRezoTools_3.dll_public:_unsigned_long_int___thiscall_CRegistry::ReadDwordKey_struct_HKEY_____char_const___char_const__
mov ebp, eax
push str.Accounts
push str.SoftwareEoRezoPop
lea eax, [esp + 0x18]
push SysReAllocString
push eax
lea ecx, [esp + 0x24]
call sym.EoRezoTools_3.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__
cmp ebp, edi
mov byte [esp + 0x30], 3
jbe 0x10013f7d
push ebx
mov dword [esp + 0x1c], ebp
mov ebx, 4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push edi
push 0x100548d8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], bl
mov ebp, edi
call sub.MFC42.DLL_CString::Find_1
mov edi, eax
cmp edi, 0xffffffff
je 0x10013f28
lea ecx, [esp + 0x20]
push edi
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call sym.EoRezoTools_3.dll_public:_int___thiscall_CManagePOP3::AddAccount_class_CString__
add edi, ebx
jmp 0x10013f5f
lea eax, [esp + 0x24]
push ebp
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sym.EoRezoTools_3.dll_public:_int___thiscall_CManagePOP3::AddAccount_class_CString__
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x1c], eax
jne 0x10013ec8
pop ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call sym.EoRezoTools_3.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret