joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428180
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x4421e8]
call fcn.00429548
mov esi, eax
test esi, esi
je 0x4281ff
cmp dword [esi + 4], 0
je 0x4281d0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004286d0
test eax, eax
je 0x4281c4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42820a
cmp dword [esp + 8], 0
je 0x42820a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x428220
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x441bc0]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4283a4
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x42826e
test ebp, ebp
je 0x428310
dec ebp
cmp dword [ebx + 4], 0
je 0x428287
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004286d0
mov dword [esp + 0x14], eax
jmp 0x4282a1
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x428310
test cl, cl
je 0x4282b5
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x4282f0
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x441bc0]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x428310
cmp dword [esp + 0x2c], 0
jne 0x428260
cmp cl, 0xd
je 0x428317
cmp cl, 0xa
jne 0x428260
dec esi
jmp 0x428387
cmp dword [esp + 0x2c], 0
jne 0x428387
cmp cl, 0xa
jne 0x42831f
dec esi
jmp 0x428387
cmp cl, 0xd
jne 0x428387
dec esi
cmp dword [ebx + 4], 0
je 0x42833e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004286d0
mov dword [esp + 0x14], eax
jmp 0x428354
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x428387
cmp dword [ebx + 4], 0
je 0x428366
inc dword [ebx + 0xc]
jmp 0x428387
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4283b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x441bc0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x42855d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x428404
test ebp, ebp
je 0x4284bd
dec ebp
cmp dword [ebx + 4], 0
je 0x42841d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004286d0
mov dword [esp + 0x14], eax
jmp 0x428437
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x4284bd
test ax, ax
je 0x428451
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x428498
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x441bc0]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x4284bd
cmp dword [esp + 0x30], 0
jne 0x4283f6
cmp ax, 0xd
je 0x4284c4
cmp ax, 0xa
jne 0x4283f6
sub edi, 2
jmp 0x42853c
cmp dword [esp + 0x30], 0
jne 0x42853c
cmp ax, 0xa
jne 0x4284cf
sub edi, 2
jmp 0x42853c
cmp ax, 0xd
jne 0x42853c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x4284f1
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004286d0
mov dword [esp + 0x14], eax
jmp 0x428507
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x42853c
cmp dword [ebx + 4], 0
je 0x42851b
add dword [ebx + 0xc], 2
jmp 0x42853c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x428570
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x441bc0]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4286c0
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x4285bc
test edi, edi
je 0x42862d
dec edi
push esi
push ebp
call fcn.004287f0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4285cf
xor cl, cl
jmp 0x4285d1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x428614
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x441bc0]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x42862d
test eax, eax
jne 0x4285b2
cmp cl, 0xd
je 0x428631
cmp cl, 0xa
jne 0x4285b2
dec esi
jmp 0x4286a3
test eax, eax
jne 0x4286a3
cmp cl, 0xa
jne 0x428639
dec esi
jmp 0x4286a3
cmp cl, 0xd
jne 0x4286a3
dec esi
cmp dword [ebp + 4], 0
je 0x428658
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004286d0
mov dword [esp + 0x20], eax
jmp 0x42866f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4286a3
cmp dword [ebp + 4], 0
je 0x428681
inc dword [ebp + 0xc]
jmp 0x4286a3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4286d0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4286f1
push esi
call fcn.00427d40
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x428765
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x428752
dec ecx
je 0x42873d
sub ecx, 2
je 0x42872a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4287aa
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4287cb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4287f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x428817
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004286d0
mov dword [esp + 4], eax
jmp 0x428831
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x42883d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x428859
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x428869
mov esi, 2
jmp 0x428885
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x428878
mov esi, 3
jmp 0x428885
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4288e2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x4288b4
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.004286d0
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
Function at 0x40c61d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e50e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.DataMgr.dll_class_CDataMgr____cdecl_gf_GetDataMgr_void_]
mov dword [ebp - 0x10], eax
call dword [sym.imp.DataMgr.dll_class_CFrameWnd____cdecl_gf_GetMainFrame_void_]
mov ecx, eax
call fcn.0040e570
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40c7b9
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40c7b3
push 0x19000
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CMemFile::CMemFile
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.DataMgr.dll_public:_int___thiscall_CDataMgr::GetPickCount_void_const]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
jmp 0x40c6b8
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jge 0x40c6d8
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.DataMgr.dll_public:_class_CEntity____thiscall_CDataMgr::GetPickEntity_int_const]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
jmp 0x40c6af
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.DataMgr.dll_int___cdecl_ExportEzdFile_class_CFile___class_CEntity____int_]
add esp, 0xc
test eax, eax
jne 0x40c792
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CFile::GetLength
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jbe 0x40c792
mov edx, dword [ebp - 0x48]
add edx, 1
push edx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x40c77b
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x40c760
push 0
push 0
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CMemFile::Seek
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x50]
push edx
lea ecx, [ebp - 0x44]
call fcn.0040e610
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x40c77b
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x4c], 0
je 0x40c792
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.DataMgr.dll_unsigned_int___cdecl_gf_GetClipboardFormat_void_]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
push edx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0051c572
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46008e
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522005
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0045fac0
mov ecx, dword [ebp - 0x40]
cmp dword [ecx], 0
je 0x4600e5
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f350
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
jmp 0x460111
mov edx, dword [ebp - 0x40]
cmp dword [edx + 4], 0
je 0x460111
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f350
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
mov ecx, dword [ebp + 8]
call fcn.00460340
mov dword [ebp - 0x34], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x38]
push 1
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.0044e490
mov dword [ebp - 4], 0
push 0x58
mov ecx, dword [ebp + 8]
call fcn.0045fa10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0x60
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x24], eax
push 0
push str.Marlett
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CFont::CreatePointFont
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov dword [ebp - 0x38], eax
push 0x568180
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0xc]
add eax, 2
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 8]
add edx, 2
push edx
mov ecx, dword [ebp + 8]
call fcn.00460360
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0051c506
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x38]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0044e4e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b9057
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x1f8
call fcn.0044d120
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x4b921b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x60]
jge 0x4b921b
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
add eax, 2
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
lea eax, [edx + ecx*4 + 0x64]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004759c0
and eax, 0xff
test eax, eax
je 0x4b920a
push 0xff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + edx*4 + 0x64]
call fcn.0040e3d0
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1f4]
add edx, 2
push edx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0x3e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx + eax*4 + 0x64]
call fcn.0040e3d0
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push str.NULL
push str.LANGUAGE
push 0x570494
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x5704a0
push 0x5704a4
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Replace
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
and ecx, 0x3ff
mov byte [ebp - 0x24], cl
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sar edx, 0xa
mov byte [ebp - 0x1c], dl
push str.CHINESE_SIMPLIFIED
lea eax, [ebp - 0x18]
push eax
call fcn.004b9310
and eax, 0xff
test eax, eax
je 0x4b91b8
mov byte [ebp - 0x24], 4
mov byte [ebp - 0x1c], 2
jmp 0x4b91e1
push str.CHINESE_TRADITIONAL
lea ecx, [ebp - 0x18]
push ecx
call fcn.004b9310
and eax, 0xff
test eax, eax
je 0x4b91d9
mov byte [ebp - 0x24], 4
mov byte [ebp - 0x1c], 1
jmp 0x4b91e1
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x1c], 1
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
mov cl, byte [ebp - 0x24]
mov byte [eax], cl
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 1], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0051c506
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0051c506
jmp 0x4b925a
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x60]
jl 0x4b925a
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1f4]
mov byte [edx], 9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x1f4]
mov byte [ecx + 1], 1
push str.DEFENGLISH
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
add eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x51a320
Capabilities:
Print debug messages

Disassembly:
mov ax, word [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov word [edi + 0x46], ax
xor eax, eax
mov ax, word [edi + 0x5a]
cmp eax, 5
je 0x51a371
cmp eax, 9
je 0x51a350
push edi
push edi
call fcn.0051a970
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edi + 0x52]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x60
push edi
push 0x60
push edi
push 0x9c406404
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 0x12b
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..LPT1
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x51a3b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x51a3e0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebp
dec ebp
test eax, eax
jne 0x51a37c
mov edx, dword [edi + 0x52]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x60
push edi
push 0x60
push edi
push 0x22000f
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, 0xffffffff
je 0x51a3db
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x51a3ec
push str.Not_Find_file_LPT1
jmp 0x51a3f1
push str.unknow_error_in_createfile_LPT1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebp, ebp
jne 0x51a3b3
mov word [edi], 0x81
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x51a930
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
test bx, bx
mov esi, edi
mov eax, edi
jbe 0x51a967
push ebp
and ebx, 0xffff
movzx dx, byte [ecx]
mov ebp, edx
sub ebp, eax
xor ebp, edi
add ebp, esi
dec ecx
mov eax, ebp
dec ebx
mov byte [ecx + 1], al
mov esi, edx
jne 0x51a94f
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51b930
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x5979a4]
sub esp, 0xc
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jne 0x51b9b5
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebp, ebp
mov byte [esp + 0x10], bl
lea eax, [esp + 0x20]
push ebx
push eax
lea ecx, [esp + 0x18]
push 8
push ecx
push ebx
push ebx
push 0x220020
push esi
call edi
test eax, eax
je 0x51b987
cmp byte [esp + 0x10], 0xff
je 0x51b997
inc ebp
cmp ebp, 0x1f4
jl 0x51b952
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax], edx
pop esi
mov dword [eax + 4], ecx
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [esp + 0x10], bl
xor ebp, ebp
lea edx, [esp + 0x20]
push ebx
push edx
lea eax, [esp + 0x18]
push 9
push eax
push esi
call edi
test eax, eax
je 0x51b9fe
mov eax, dword [0x5979a8]
cmp eax, ebx
mov al, byte [esp + 0x18]
je 0x51b9ee
cmp al, byte [0x597994]
je 0x51b9f5
cmp byte [esp + 0x11], 0xff
je 0x51ba0e
inc ebp
cmp ebp, 0x1f4
jl 0x51b9c5
pop edi
pop esi
mov dword [0x5979a8], ebx
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x11]
mov edx, dword [esp + 0x15]
mov byte [0x597994], al
mov eax, dword [esp + 0x24]
mov dword [0x5979a8], ebx
pop edi
mov dword [eax], ecx
pop esi
mov dword [eax + 4], edx
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x51bad0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 8]
mov ecx, dword [esp + 4]
push ebx
xor eax, eax
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, 0xa
jl 0x51badb
pop ebx
ret