joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461ff8
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dde60
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov eax, dword [esi - 0xd0]
lea edi, [esi - 0xd0]
mov ecx, edi
call dword [eax + 0x90]
test eax, eax
je 0x462166
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x88]
test eax, eax
je 0x462166
mov ecx, dword [esp + 0x38]
lea eax, [esi - 0x94]
push ecx
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x462166
mov eax, dword [esi + 0x5c]
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
je 0x462066
cmp dword [esi + 0x144], ebx
je 0x462066
mov byte [esi + 0x7d], 1
jmp 0x462069
mov byte [esi + 0x7d], bl
cmp dword [esi + 0x58], ebx
je 0x46207d
mov edi, dword [esp + 0x3c]
push 1
mov ecx, edi
call sub.MFC42.DLL_CDC::SetBkMode
jmp 0x46208f
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0xa8]
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x34]
mov eax, dword [esi + 0xa4]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x38]
cmp dword [esi + 0x5c], ebx
je 0x4620b0
cmp dword [esi + 0x144], ebx
je 0x4620b0
mov byte [esi + 0x7d], 1
jmp 0x4620b3
mov byte [esi + 0x7d], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], vtable.CFont.0
lea ecx, [esi + 0x68]
mov dword [esp + 0x34], ebx
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [edi]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [edx + 0x30]
mov ecx, dword [esi + 0x54]
mov ebp, eax
cmp ecx, 6
mov eax, 0x8820
jne 0x4620f9
mov eax, 0x8821
jmp 0x462103
cmp ecx, 2
jne 0x462103
mov eax, 0x8822
cmp dword [esi + 0x140], ebx
je 0x462113
mov esi, dword [esi + 0x13c]
jmp 0x462119
mov esi, dword [esi + 0xac]
mov ecx, dword [esi - 8]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push esi
mov ecx, edi
call dword [edx + 0x70]
mov edx, dword [edi]
push ebp
mov ecx, edi
call dword [edx + 0x30]
mov dword [esp + 0x14], vtable.CGdiObject.0
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov ecx, dword [esp + 0x24]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x462a60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ddf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], edi
lea eax, [edi + 4]
mov dword [edi + 0x80], ebx
cmp eax, ebx
mov dword [eax], vtable.IKMPThemeObject.0
mov dword [eax + 0xc], vtable.CArray_struct_IKMPObject___struct_IKMPObject__.0
mov dword [eax + 0x10], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 8], ebx
je 0x462ab1
lea ecx, [eax - 4]
jmp 0x462ab3
xor ecx, ecx
mov dword [eax + 4], ecx
lea esi, [edi + 0x24]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 6
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 7
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 8
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 9
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x40]
mov byte [esp + 0x1c], 0xa
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x44]
mov byte [esp + 0x1c], 0xb
call sub.MFC42.DLL_CString::CString_3
mov dword [esi], vtable.CKMPBaseData.0
mov dword [esi + 4], 0x60
mov word [esi + 8], 0x7f00
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x4c]
mov byte [esp + 0x1c], 0xc
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 0xd
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x54]
mov byte [esp + 0x1c], 0xe
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x58]
mov byte [esp + 0x1c], 0xf
call sub.MFC42.DLL_CString::CString_3
mov dword [esi], vtable.CKMPThemeData.0
push 0xa
lea ecx, [edi + 0x84]
mov byte [esp + 0x20], 0x10
call fcn.004cf032
mov dword [edi + 0xa0], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x462be0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4de042
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], vtable.CKMPThemeData.0
lea ecx, [esi + 0x58]
mov dword [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x54]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov dword [esi], vtable.CKMPBaseData.0
lea ecx, [esi + 0x44]
mov dword [esp + 0x10], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x462bf6
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4de042
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], vtable.CKMPThemeData.0
lea ecx, [esi + 0x58]
mov dword [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x54]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov dword [esi], vtable.CKMPBaseData.0
lea ecx, [esi + 0x44]
mov dword [esp + 0x10], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x462e30
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4de0a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push edi
mov edi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [edi + 0x90]
mov byte [esp + 0x2c], 2
neg eax
sbb eax, eax
test eax, eax
mov dword [esp + 0x14], eax
je 0x462f2b
push ebx
push esi
lea esi, [edi + 0x84]
mov bl, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CMapStringToString::GetNextAssoc
lea eax, [esp + 0x18]
push 0x3b
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator_1
lea edx, [esp + 0x14]
mov byte [esp + 0x34], 3
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_operator_3
push 0x3b
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x40], bl
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x462e98
pop esi
pop ebx
push 0x3b
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::TrimRight
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [edi + 0x3c]
lea eax, [esp + 8]
push edx
push str.SOFTWAREStorm_skins_s
push eax
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push 1
push str.pref
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4670d0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4de98b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0xb0]
mov dword [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xac]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xa8]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xa4]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov dword [esi], vtable.CKMPBaseData.0
lea ecx, [esi + 0x44]
mov dword [esp + 0x10], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x467fa0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4debfd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0xac]
mov dword [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xa8]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xa4]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov dword [esi], vtable.CKMPBaseData.0
lea ecx, [esi + 0x44]
mov dword [esp + 0x10], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49be50
Capabilities:
Initialize iwebbrowser2

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3160
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebp
push esi
mov esi, dword [esp + 0x5c]
xor ebp, ebp
cmp esi, ebp
push edi
jne 0x49be8b
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 4
mov dword [esp + 0x60], ebp
lea eax, [esp + 0x60]
mov dword [esp + 0x58], ebp
push eax
push 0x519910
push 7
push ebp
push 0x519900
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebp
jge 0x49bedf
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
cmp eax, ebp
je 0x49bfe6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 4
mov eax, dword [esp + 0x60]
push 0xffffffffffffffff
push eax
mov edx, dword [eax]
call dword [edx + 0xa4]
cmp eax, ebp
jge 0x49bf22
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
cmp eax, ebp
je 0x49bfe6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 4
push ebx
push 0xffffffffffffffff
push esi
call fcn.00404d00
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
push 0x5265c0
lea ecx, [esp + 0x48]
mov word [esp + 0x48], bp
call fcn.00421a60
push 0x5265c0
lea ecx, [esp + 0x38]
mov word [esp + 0x38], bp
call fcn.00421a60
push 0x5265c0
lea ecx, [esp + 0x28]
mov word [esp + 0x28], bp
call fcn.00421a60
mov word [esp + 0x14], 3
mov dword [esp + 0x1c], 0xe
lea ecx, [esp + 0x44]
mov eax, dword [esp + 0x64]
push ecx
lea ecx, [esp + 0x38]
mov edx, dword [eax]
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x64], 5
push ecx
lea ecx, [esp + 0x20]
push ecx
push edi
push eax
call dword [edx + 0x2c]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [esp + 0x14]
push edx
mov ebx, eax
call esi
lea eax, [esp + 0x24]
push eax
call esi
lea ecx, [esp + 0x34]
push ecx
call esi
lea edx, [esp + 0x44]
push edx
call esi
cmp ebx, ebp
pop ebx
push edi
jge 0x49bffc
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
cmp eax, ebp
je 0x49bfe6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 4
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
cmp eax, ebp
je 0x49c018
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x50]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x50
ret 4
Function at 0x49f750
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x418
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cx, word [0x521af4]
mov dl, byte [0x521af6]
mov word [esp + 0x10], cx
mov byte [esp + 0x12], dl
mov cl, byte [eax]
mov esi, eax
test cl, cl
je 0x49f7ab
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [esp + 0x10]
test cl, cl
lea eax, [esp + 0x10]
je 0x49f7a3
cmp byte [esi], cl
je 0x49f7b8
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x49f792
mov cl, byte [esp + 0x10]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x49f78a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
push esi
call edi
mov esi, eax
test esi, esi
je 0x49f7ab
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnRegister
push esi
call ebx
test eax, eax
je 0x49f823
push str.Register
push esi
call ebx
test eax, eax
je 0x49f8a7
cmp byte [esi], 0
je 0x49f7ab
mov cl, byte [esp + 0x10]
test cl, cl
lea eax, [esp + 0x10]
je 0x49f805
cmp byte [esi], cl
je 0x49f80f
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x49f7f4
mov cl, byte [esp + 0x10]
mov al, byte [esi + 1]
inc esi
test al, al
je 0x49f7ab
jmp 0x49f7ec
push esi
call edi
mov esi, eax
test esi, esi
jne 0x49f7c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
mov dword [0x52c5f0], 0x521978
push eax
push 0x5218f8
push 0x52c580
mov dword [0x52c620], 0x52c580
mov dword [0x52c580], 0x84
mov dword [0x52c5e4], 0x300
call fcn.0049fb80
push 0
push 0
push 0
push 0x67
push 0x52c580
call fcn.0049fef0
push 0
push 1
push 0x52c580
call fcn.0049fd30
push 0
mov ecx, ebp
call fcn.0049e130
mov eax, dword [ebp + 0x6c]
mov ecx, ebp
push eax
call fcn.0049f9b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
mov dword [0x52c5f0], 0x521978
push eax
push 0x5218f8
push 0x52c580
mov dword [0x52c620], 0x52c580
mov dword [0x52c580], 0x84
mov dword [0x52c5e4], 0x300
call fcn.0049fb80
push 0
push 0
push 1
push 0x67
push 0x52c580
call fcn.0049fef0
mov edx, dword [0x52c584]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x11c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x220]
push 0x104
push edx
lea eax, [esp + 0x124]
push 0xffffffffffffffff
push eax
push 0
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
test eax, eax
jl 0x49f97d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x220]
push 0
push eax
push ecx
call dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49f98b
mov edx, dword [eax]
push eax
call dword [edx + 8]
push 1
mov ecx, ebp
call fcn.0049e130
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret
Function at 0x49f9b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x234
push ebx
mov eax, str.DllUnregisterServer
push ebp
mov ecx, 1
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x248]
lea eax, [esp + 0x140]
push 0x104
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x20], str.media2.dll
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], str.StormSet.dll
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], bl
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 2
mov edi, dword [esi]
cmp edi, ebx
je 0x49fad5
lea eax, [esp + 0x140]
lea ecx, [esp + 0x3c]
push eax
push ecx
call ebp
lea edx, [esp + 0x3c]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x49fa83
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x49fad5
mov dword [esi + 0xc], 1
mov edx, dword [esi + 4]
mov edi, dword [esi + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x49fa97
call eax
cmp dword [esi + 0xc], ebx
je 0x49faa3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 8], ebx
je 0x49fad5
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49fad5
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x49fad5
push 4
lea edx, [esp + 0x40]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [esp + 0x10]
add esi, 0x14
dec eax
mov dword [esp + 0x10], eax
jne 0x49fa33
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 4
Function at 0x4a1aa0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3cc8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, ecx
test esi, esi
je 0x4a1ba1
mov ebx, dword [esp + 0x34]
test ebx, ebx
jl 0x4a1ba1
mov ebp, dword [esp + 0x38]
test ebp, ebp
jl 0x4a1ba1
lea eax, [esp + 0x10]
push eax
push 0
push ebp
push ebx
call sub.MFC42.DLL_CListCtrl::GetSubItemRect
test eax, eax
je 0x4a1ba1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 0x64
mov dword [esp + 0x1c], eax
sub eax, ecx
push 0x40
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push 0
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowPos
push ebp
lea eax, [esp + 0x34]
push ebx
push eax
mov ecx, edi
call sub.MFC42.DLL_CListCtrl::GetItemText
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
push ecx
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetFocus
mov edx, dword [esi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0xd
push 0xffffffffffffffff
push 0x153
push edx
call ebx
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x158
push ecx
call ebx
test eax, eax
jge 0x4a1b78
xor eax, eax
mov edx, dword [esi + 0x20]
push 0
push eax
push 0x14e
push edx
call ebx
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ebp
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc