joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a693c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a6a05
jmp 0x4a69f9
cmp dword [esi + 0x10], 0x1000
jne 0x4a69e7
test byte [esi + 0x15], 1
jne 0x4a69e7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a6998
cmp ebp, 2
je 0x4a6998
cmp ebp, 0x10
je 0x4a6998
cmp ebp, 0x20
jne 0x4a69b4
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a69b4
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a69c5
mov eax, dword [esi]
add eax, ebx
call fcn.004a6934
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a69b8
cmp byte [esp + 4], 0
je 0x4a69e7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a6a05
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a696d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401686
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404474], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4041cf], ebp
mov dword [0x404404], eax
mov dword [0x4041c7], eax
mov dword [0x4043f0], 0x30
mov dword [0x4043f4], 2
jmp 0x4016c6
mov dword [0x4043f8], 0x403051
mov dword [0x4043fc], 0
mov dword [0x404400], 0
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40440c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404408], eax
mov dword [0x40441c], eax
mov dword [0x404418], 0x40439a
mov dword [0x404410], 0xf
push 0x4043f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4041c7]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push 0x4043e7
push str.lunt
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404468], eax
push 5
push dword [0x404468]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404468]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404420]
jmp 0x40179a
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x40178c
mov eax, dword [0x404428]
jmp 0x4017b5
call 0x402a06
ret
Function at 0x423d6f
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x1e852725
in eax, 0xe3
inc ebp
and byte [ecx + edx], bl
cld
invalid
xchg ecx, eax
mov eax, 0xd0391eb4
pop ecx
jp 0x423d6c
mov al, 0xe9
and dword [eax + 0x174eff6d], 0x7a
mov al, byte [0x174eff6d]
jp 0x423da0
pop esp
jge 0x423df5
mov al, byte [0x174eff6d]
jp 0x423da0
pop esp
jge 0x423df5
cmp eax, 0x7fc61da2
test al, 0x7d
mov al, 0x6b
mov edi, 0xb0bd6240
pop esp
jge 0x423d31
imul edi, dword [edi - 0x4f429dc0], 0x5c
xor byte ds:[eax], ch
salc
or ecx, dword [edi - 0x4c822ca6]
inc edx
lahf
lcall 0x9e2b, 0x30509f01
jno 0x423d7f
cmp eax, 0x5638e107
sbb byte [esp + 0x108d849d], 0xef
fld qword [eax + 0x40cec1ec]
cmp byte [esi - 0x80], dl
pushfd
movsb byte es:[edi], byte [esi]
popfd
test byte [ebp - 0x7f2210f0], cl
in al, dx
ror esi, 0x40
pop esp
mov al, byte [0x7adc9d78]
mov ss, edi
jae 0x423d63
invalid
pop ss
xchg ebp, eax
xchg edx, eax
mov dword [0x8b75e3f1], eax
invalid
mov cl, 0x10
pop ecx
out 0xc, eax
adc eax, 0x4cf02f2d
cmp al, 0x9f
jo 0x423e51
dec esi
wait
dec esi
cld
movsd dword es:[edi], dword [esi]
push edi
das
daa
sbb al, bh
jbe 0x423e4e
invalid
jl 0x423db1
nop
push eax
jp 0x423e0b
mov bl, 0xac
mov esp, 0x3abc6592
xor esi, dword [ebx]
pop esp
sub ebp, dword [ecx + ecx*4 + 0x3322f091]
je 0x423dd5
xchg edi, eax
lodsd eax, dword [esi]
jno 0x423dad
sal byte [ebp - 0x15bcd4dc], cl
clc
sbb eax, 0x232df242
shl esi, cl
sub edi, edi
sbb dword [ebp + 0x74414c0d], ebp
pushfd
jb 0x423e02
add dword [0xb94da777], esi
adc ecx, eax
sal byte [ebx - 7], 0xc4
mov edi, eax
sahf
and esi, dword [edi - 0x48]
rcr cl, 0xb1
mov al, 0x38
sbb eax, 0x4ed4f4c
stc
les ecx, [ecx + 0x77239ec7]
mov eax, 0xb0b1d9c0
cmp byte [0x4ed4f4c], bl
invalid
lds esp, [edi]
daa
or eax, dword [edi]
pushal
std
mov esi, 0x6e73cd0b
clc
adc esi, dword [esi + 0x7e]
add esp, dword [0xb55baab3]
dec eax
popfd
aam 0x97
mov al, 0x38
salc
jle 0x423e31
mov al, 0xc7
mov dword [0x9e4b4125], eax
out 0x93, al
mov dword [ecx], 0x7222678e
imul ebx, ebx, 0x49
xchg ebx, eax
je 0x423e4f
sbb dword [eax + 0x2fc0ecee], edx
mov al, 0x3f
out 0xe, al
pop ss
adc byte [ebp - 0x76], dh
int1
mov byte [0x4aaf6ae2], al
jae 0x423ece
in al, dx
ja 0x423e61
and cl, byte [ebp + 0x15aef566]
scasb al, byte es:[edi]
fdivr qword es:[esi]
jne 0x423f30
xchg ebp, eax
and bh, byte [ecx - 0x5f5d66de]
and bl, cl
scasb al, byte es:[edi]
xor eax, 0x75f755ae
loop 0x423ecb
jne 0x423f01
jne 0x423f01
mov cl, 0x23
rcl dword [edx - 0x20], 0xd4
and eax, ecx
push edx
loopne 0x423ea7
pop ecx
mov esi, 0x39c0c1f
inc ecx
ror byte [esi], 0x79
inc esi
std
dec ebx
pushfd
adc al, 0x9c
push 0xf5aeabb6
out 0x6b, eax
add edx, dword [edx - 0x574e5cd8]
mov ch, 0x26
stosb byte es:[edi], al
pop es
xchg ebx, eax
xchg ecx, eax
sub bl, 4
movsb byte es:[edi], byte [esi]
add dh, byte [ebx - 0x6bc25cdf]
mov byte [0x841d52c4], al
out 0xf9, eax
les edx, [edx + 0x1d]
test bh, ah
stc
pop esi
mov esi, 0x21e25ac
invalid
mov bl, 0x30
push es
push eax
and dl, byte ds:[ecx + 0x26]
cld
xchg ebp, eax
xor eax, 0x612b06f5
neg dword [edx]
in al, dx
invalid
Function at 0x46800f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov esp, 0x7d544f22
mov eax, 0x3238e0a4
or ah, byte [ebx - 0x201832eb]
int1
int 0xe7
fcompi st(1)
jmp 0x84797bc1
bound ebp, qword [esi - 0x518b71e8]
jbe 0x468049
jns 0x468047
xor ecx, dword [esi]
add byte [edx - 0x5e9d2c2b], ah
movsb byte es:[edi], byte [esi]
push ebx
sbb al, 9
pop ebx
dec esi
jnp 0x46809f
and al, byte [edi]
aas
mov bl, 0x83
xchg ebx, eax
cmp dword [edi - 0x4d], esp
xchg edx, eax
jbe 0x467fe8
jg 0x46807c
pop esi
loopne 0x468032
shl cl, cl
invalid
push esi
xor esp, dword [edx]
fdivr dword [edi]
and bl, al
aas
loopne 0x467ff5
dec esi
movsb byte es:[edi], byte [esi]
fnstsw word [ebx]
adc ah, byte [edx + 0x224e62ae]
and dl, byte [ebx]
push cs
and ch, byte [esi]
movsb byte es:[edi], byte [esi]
invalid
push ds
mov byte [0x8318a3e9], al
xchg ebx, eax
push 0x623fcf73
scasb al, byte es:[edi]
jbe 0x46808d
add ah, bl
dec esi
jecxz 0x4680db
add edx, dword [ebx + 2]
out dx, al
mov byte [0xb0b2ff77], al
xchg ebx, eax
jo 0x46808a
not dword [ebx]
cmp dword [ebx], edx
push edx
jg 0x46811a
pop ds
or dword [esi - 0x5dac5352], esp
lea edi, [edi]
sbb eax, dword [edi - 0x66]
or eax, 0xb333625a
xchg ebx, eax
mov bl, 0x9c
adc edx, dword [ebx - 0x2d]
aaa
invalid
lds esi, [edx + 0x3d3acf7c]
mov edx, 0x976b5ad6
popfd
je 0x468114
push ds
rcl byte [edx - 0x28], cl
jo 0x4680b9
test al, 0xfc
cmp eax, 0xaf9af2bd
pop edx
outsd dx, dword [esi]
mov edx, 0x25dba9b
or ebp, dword [ebx - 0x8b9dc51]
sub eax, 0xe5af85ef
push edx
mov ebp, 0x14efac52
xor ch, byte [ebp - 0xf]
push edx
lodsb al, byte [esi]
out dx, eax
adc al, 0x32
insd dword es:[edi], dx
int1
invalid
adc esp, dword [ebp + 0x5aaf99d2]
test dword [esi], ebx
and dword [ebp + 0x7af053c1], esi
mov edi, 0xee3adff4
jne 0x468181
inc ebp
xor dword [0x8ed6f4b0], 0x204ab0ad
sub esp, 0x6c158254
xchg ebx, eax
ret
jne 0x46810c
xchg dword [ecx], edx
pop ecx
xchg edx, eax
mov al, byte [0x278bb3c2]
inc eax
stosb byte es:[edi], al
aaa
dec eax
scasd eax, dword es:[edi]
xchg ecx, eax
invalid

Function at 0x468e0f
Capabilities:
Encode data using xor

Disassembly:
jl 0x468e01
test al, 0xf7
invalid
dec edi
nop
jl 0x468dd9
push esp
cmc
sar dword [ebp + 0x2f3d479e], cl
xchg byte [esi - 0x4a], al
sar dword [ebp - 0x55571447], 0x16
invalid
push cs
insb byte es:[edi], dx
inc ebp
jae 0x468d93
invalid
scasd eax, dword es:[edi]
jno 0x468db7
sbb al, 0xea
test byte [ebx], 0xf7
mov bh, dl
xor bh, byte [edi - 8]
dec eax
out dx, eax
and ebp, dword [edi + edx + 0x75eb965e]
js 0x468e12
inc esi
rol byte [edi], cl
pop eax
cmp dword [edx + 0x13], ebx
ret
Function at 0x562284
Capabilities:
Encode data using xor

Disassembly:
dec edi
invalid
fisub dword [ebp + 0x76f90ce3]
sbb al, 0xfd
cmp edi, dword [edi + ecx*2]
and eax, 0x27b52021
mov dh, 0x1a
adc eax, 0x1c4da96a
loope 0x562276
cmp eax, 0xa1ed5c57
outsd dx, dword [esi]
xor eax, 0x2f9acfc7
and eax, 0x9585d7a6
jns 0x56227c
sub dword [ebp - 0x4e5f7286], ebx
inc edi
sar byte [esi - 0x19], 0x18
scasd eax, dword es:[edi]
cmp ah, byte [eax]
push ss
xor ah, byte [eax]
cmp bl, bl
inc edx
inc esi
adc cl, bh
loopne 0x562287
aas
mov cl, 0x31
arpl word [eax], sp
add dword [ebp + 0x666bdbaa], 0x5443bcf3
aam 0x2c
mov esp, dword [ecx + 0x1ad2efa4]
lds edx, [ecx]
cmp al, 0xd4
adc ecx, ecx
test dword [ebx - 0x1a], esp
invalid

Function at 0x604b7f
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
stosb byte es:[edi], al
pushal
out 0x48, al
jno 0x604bad
jp 0x604bae
mov dl, bh
xor byte [esi - 7], 0xff
sub eax, 0x426b0c03
inc ebx
scasb al, byte es:[edi]
add ebp, dword [edx]
xchg edx, eax
shr dl, 1
mov byte [0x99f7368c], al
pop esi
invalid
and bh, byte [eax + 0x1f]
call 0xe4dd484f
xor dword [eax], ecx
jae 0x604bc4
pop ebp
sbb ah, bl
dec ecx
xor eax, dword [ebx]
stc
add byte [ebx - 0x2c94dc75], ch
mov esp, dword [ebx]
imul edx, ebx, 0x74
push ecx
mov esp, dword [ebx]
imul edx, ebx, 0x74
push ecx
xchg esp, eax
mov dl, 0xd9
adc esp, dword [esi - 0x15a09e69]
test eax, 0x702a06a0
jl 0x604b35
adc esi, dword [0xa6ece810]
or dl, 0x3f
lds ebx, [ebp + 0x32a2ceda]
clc
mov eax, 0x6e2dee5d
jge 0x604b6a
stc
sbb dl, cl
int 0x1d
loope 0x604b3a
ror ebp, 1
sbb eax, 0x7786e1f2
das
xchg byte [edi + 0x2f], dh
ja 0x604be5
sahf
cwde
add edx, edi
popal
mov bh, 0xfc
mov ebx, 0xc0a469de
sub eax, 0xb7f105cf
push esp
push edx
clc
xchg ebx, eax
push 0x53
aam 0x64
xchg esp, eax
dec ebp
js 0x604bb3
iretd
xchg ecx, eax
jecxz 0x604be2
or ecx, ebx
mov edx, 0x62bf46bd
adc bh, ah
pop eax
int 0xe1
retf
inc ecx
sti
pop edi
shr byte [ebx + 0x34], cl
test byte [edx], bl
call dword [ecx - 0x2547ab94]
invalid
Function at 0x627d21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313d0
cmp edx, dword [eax]
je 0x627d43
add eax, 8
inc ecx
cmp eax, 0x631460
jl 0x627d34
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313d0]
jne 0x627e71
mov eax, dword [0x639d78]
cmp eax, 1
je 0x627e4b
test eax, eax
jne 0x627d74
cmp dword [0x6312f8], 1
je 0x627e4b
cmp edx, 0xfc
je 0x627e71
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627dab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00628700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627dee
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62da6c
push edi
call fcn.0062aa60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00628700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00628710
lea eax, [ebp - 0xa0]
push 0x62da4c
push eax
call fcn.00628710
push dword [esi + 0x6313d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00628710
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a9d4
add esp, 0x2c
pop edi
jmp 0x627e71
lea eax, [ebp + 8]
lea esi, [esi + 0x6313d4]
push 0
push eax
push dword [esi]
call fcn.00628b90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460c82
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x958]
mov dword [esp + 0x20], 5
call fcn.00423f00
lea ecx, [esi + 0x948]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x908]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CListCtrl::CListCtrl
lea ecx, [esi + 0x8c8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CComboBox::CComboBox
push fcn.0041e980
push 5
lea eax, [esi + 0x364]
push 0x114
push eax
mov byte [esp + 0x30], 1
call fcn.00428530
push fcn.00401360
push 5
lea ecx, [esi + 0x1c0]
push 0x54
push ecx
mov byte [esp + 0x30], 0
call fcn.00428530
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 0xa
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov byte [esp + 0x20], 0x10
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0x12
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x402d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4613b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 2
lea eax, [esi + 0x5a8]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.00428530
push sub.MFC42.DLL_CListBox::CListBox
push 1
lea ecx, [esi + 0x568]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.00428530
push fcn.00401360
push 3
lea edx, [esi + 0x46c]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.00428530
push fcn.0041e980
push 2
lea eax, [esi + 0x244]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.00428530
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x402ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461490
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 2
lea eax, [esi + 0x7bc]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.00428530
push sub.MFC42.DLL_CListBox::CListBox
push 4
lea ecx, [esi + 0x6bc]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.00428530
push fcn.00401360
push 7
lea edx, [esi + 0x470]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.00428530
push fcn.0041e980
push 2
lea eax, [esi + 0x248]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.00428530
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
push sub.MFC42.DLL_CEdit::CEdit
push 1
lea eax, [esi + 0x724]
push 0x40
push eax
mov dword [esp + 0x30], 3
call fcn.00428530
push sub.MFC42.DLL_CListBox::CListBox
push 4
lea ecx, [esi + 0x624]
push 0x40
push ecx
mov byte [esp + 0x30], 2
call fcn.00428530
push fcn.00401360
push 6
lea edx, [esi + 0x42c]
push 0x54
push edx
mov byte [esp + 0x30], 1
call fcn.00428530
push fcn.0041e980
push 2
lea eax, [esi + 0x204]
push 0x114
push eax
mov byte [esp + 0x30], 0
call fcn.00428530
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov byte [esp + 0x20], 0xe
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4037f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4618c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x53c]
mov dword [esp + 0x20], 3
call sub.MFC42.DLL_CIPAddressCtrl::CIPAddressCtrl
lea ecx, [esi + 0x4fc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CIPAddressCtrl::CIPAddressCtrl
push fcn.00401360
push 3
lea eax, [esi + 0x3f8]
push 0x54
push eax
mov byte [esp + 0x30], 1
call fcn.00428530
push fcn.0041e980
push 2
lea ecx, [esi + 0x1d0]
push 0x114
push ecx
mov byte [esp + 0x30], 0
call fcn.00428530
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x15c]
mov dword [esp + 0x10], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x14], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x108]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0xb4]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ebx, [esi + 0x60]
mov dword [esp + 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4679c8
mov ecx, edi
mov byte [esp + 0x20], 0x10
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, ebx
mov dword [edi], 0x4679b4
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CStatic::CStatic
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret