joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428340
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x344
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
call sub.mfc90.dll_Ordinal_4993
push 0x434e3e
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x7d2
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc90.dll_Ordinal_4431]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4283a2
push eax
mov ecx, esi
call sub.mfc90.dll_Ordinal_6559
push 0x434e3f
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x2710
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90.dll_Ordinal_4431]
push 0x434e63
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
lea eax, [ebp - 0x1c]
push eax
push 0x3ea
mov ecx, esi
mov byte [ebp - 4], 2
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_4116
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x208
lea ecx, [ebp - 0x350]
push ecx
push 0
call edi
push 0x104
lea edx, [ebp - 0x148]
push edx
push 0
call edi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.version.txt
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4284ad
lea ecx, [ebp - 0x30]
call sub.mfc90.dll_Ordinal_320
push 0
lea eax, [ebp - 0x148]
mov bl, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call sub.mfc90.dll_Ordinal_578
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call sub.mfc90.dll_Ordinal_5776
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call sub.mfc90.dll_Ordinal_780
mov dword [ebp - 4], 3
mov byte [ebp - 4], 2
call sub.mfc90.dll_Ordinal_1265
jmp 0x4284bf
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x350]
call fcn.00416130
add esp, 4
push 0x434e72
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push ecx
push edx
push eax
lea ecx, [ebp - 0x18]
push str._s__s__s
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov edx, dword [ebp - 0x18]
add esp, 0x14
push edx
push 0x3ea
mov ecx, esi
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_6559
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x428fac
push ebx
push edi
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 0xc]
movzx ecx, si
push 0x435630
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push esi
push eax
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 0x10]
push edx
push 1
push edi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x428faa
mov edi, dword [esp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebp
je 0x428f4a
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0x1c], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStreamICM
mov ecx, dword [esp + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
jmp 0x428f4c
xor esi, esi
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x20]
mov dword [ebx], esi
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x28], ebp
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebp
je 0x428f6b
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov dword [edi + 0x64], ecx
mov esi, dword [ebx]
mov eax, dword [esi + 4]
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x28], ebp
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebp
je 0x428f91
mov dword [esi + 8], eax
mov edx, dword [edi + 0x64]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [edi + 0x6c], edx
mov dword [edi + 0x68], ecx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x429d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x431bb9
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0xcc]
mov eax, dword [eax - 0xc]
add esi, 0xcc
test eax, eax
jne 0x429e9c
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.SATRegMgr.0
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], 0
call fcn.00419fd0
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea edx, [esp + 8]
push edx
push str.PresetFolderPath
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x2c], 2
call fcn.00419cd0
test al, al
je 0x429e80
mov eax, dword [esp + 8]
cmp dword [eax - 0xc], 0
je 0x429e80
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x429e80
shr eax, 4
and al, 1
je 0x429e80
call fcn.004231f0
call fcn.004231f0
cmp dword [eax], 0
je 0x429e80
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x20], 3
call fcn.004231f0
call fcn.004231f0
mov eax, dword [eax]
call fcn.0041faf0
push eax
lea ecx, [esp + 0x10]
push str._04d
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_1320]
mov eax, dword [esp + 8]
call fcn.00415fc0
test al, al
je 0x429e76
lea eax, [esp + 8]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.SATRegMgr.0
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret
Function at 0x42a2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431e46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
push 0x434f35
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_310]
xor edi, edi
mov dword [esp + 0x2c], edi
mov eax, dword [esi + 0xd0]
mov edx, dword [eax + 0x14c]
lea ecx, [esi + 0xd0]
call edx
mov ecx, eax
cmp ecx, edi
mov dword [esp + 0x1c], ecx
jle 0x42a38e
test edi, edi
jl 0x42a373
mov eax, dword [esi + 0x140]
sub eax, dword [esi + 0x13c]
sar eax, 2
cmp edi, eax
jge 0x42a373
jb 0x42a355
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 0x13c]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x42a36f
push 7
mov eax, ebx
call fcn.00422e80
test eax, eax
jne 0x42a37a
mov ecx, dword [esp + 0x1c]
inc edi
cmp edi, ecx
jl 0x42a336
jmp 0x42a38e
push 0
mov eax, ebx
call fcn.00422e80
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x42a47d
call fcn.00429a30
test al, al
je 0x42a449
mov edx, dword [esp + 0x14]
push edx
push ecx
mov ecx, esi
call fcn.00429d60
add esp, 4
push eax
mov eax, dword [ebp + 8]
push 0x435760
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov eax, dword [esi + 0xcc]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42a3e9
shr eax, 4
and al, 1
jne 0x42a4d7
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x849
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 2
call dword [sym.imp.mfc90.dll_Ordinal_4431]
push 0x2710
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_4431]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
push 0x30
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x1c]
jmp 0x42a4d1
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0
push 0
mov byte [esp + 0x34], 3
mov ecx, dword [esi + 0x1f4]
push 0x147
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42a4a0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 0x80004005
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esi + 0x1d4]
call sub.mfc90.dll_Ordinal_3175
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 8]
push eax
push ecx
push str._s_s
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x10
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42bc00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x432f64
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0xd0]
lea edi, [ebp + 0x60]
call fcn.00422c70
mov eax, dword [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1009
push eax
call edi
mov ecx, dword [esi + 0x2c0]
call fcn.00424e20
call fcn.00429a30
test al, al
je 0x42bd27
push 0x434f0d
lea ecx, [esp + 0x20]
mov dword [esi + 0x2dc], 1
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00429d60
push eax
lea ecx, [esp + 0x20]
push str._s.
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov eax, dword [esi + 0xcc]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bcad
shr eax, 4
and al, 1
jne 0x42bd13
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x849
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call dword [sym.imp.mfc90.dll_Ordinal_4431]
push 0x2710
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_4431]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x20]
push 0x30
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.0042b080
lea ecx, [esp + 0x1c]
jmp 0x42bda7
push 0x434f0e
lea ecx, [esp + 0x18]
mov dword [esi + 0x2dc], 0
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0
push 0
mov dword [esp + 0x30], 3
mov eax, dword [esi + 0x1f4]
push 0x147
push eax
call edi
lea ecx, [esp + 0x14]
cmp eax, 0xffffffff
jne 0x42bd7b
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
push ecx
push eax
lea ecx, [esi + 0x1d4]
call sub.mfc90.dll_Ordinal_3175
push 0x43570c
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov edx, dword [esp + 0x14]
push edx
mov edi, esi
call fcn.0042ae80
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, ebp
call fcn.0042d550
mov eax, dword [esi + 0xf0]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret
Function at 0x42dc90
Capabilities:
Check os version

Disassembly:
mov ecx, dword [esi + 4]
sub esp, 0x224
push ebx
push edi
push 0x30
lea eax, [esp + 0x1fc]
push eax
push ecx
call dword [sym.imp.WINMM.dll_mixerGetDevCapsA]
test eax, eax
jne 0x42dd2c
push 0xa8
xor ebx, ebx
lea edx, [esp + 0x24]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x160]
mov edi, 0x94
push eax
mov dword [esp + 0x164], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x42dd3a
cmp dword [esp + 0x170], 2
jne 0x42dd3a
cmp dword [esp + 0x164], 6
jb 0x42dd3a
mov edx, dword [esi + 4]
push SysReAllocString
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], ebx
push edx
mov dword [esp + 0x2c], 0xa8
call dword [sym.imp.WINMM.dll_mixerGetLineInfoA]
test eax, eax
je 0x42dd52
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42dd2c
push eax
call dword [sym.imp.WINMM.dll_mixerClose]
mov dword [esi + 4], ebx
mov eax, 0x80004005
pop edi
pop ebx
add esp, 0x224
ret
mov ecx, dword [esi + 4]
push 0x80000003
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x40], 4
push ecx
jmp 0x42dd09
push edi
lea edx, [esp + 0xcc]
push ebx
push edx
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
push edx
mov dword [esp + 0x20], edi
mov edi, dword [sym.imp.WINMM.dll_mixerGetLineControlsA]
lea ecx, [esp + 0xd0]
mov ebx, 1
push eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x1c], 0x50030001
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ecx
call edi
test eax, eax
jne 0x42dd2c
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0xcc]
mov edx, dword [esp + 0x130]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x10], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 4]
mov dword [esi + 0xc], edx
push eax
lea edx, [esp + 0xd0]
push ecx
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x1c], 0x20010002
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x94
mov dword [esp + 0x28], edx
call edi
test eax, eax
jne 0x42dd2c
mov edx, dword [esp + 0xcc]
pop edi
mov dword [esi + 0x14], edx
pop ebx
add esp, 0x224
ret
Function at 0x42df10
Capabilities:
Get file version info

Disassembly:
sub esp, 0x48
push esi
push edi
mov edi, eax
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x42dfa0
add esi, 5
push esi
call sub.mfc90.dll_Ordinal_265
add esp, 4
push eax
push esi
push 0
push ebx
mov dword [edi + 8], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42dfa0
mov eax, dword [edi + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x4357b8
push eax
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.MSVCR90.dll_memcpy_s]
push 0x34
push ecx
lea edx, [esp + 0x24]
push 0x34
push edx
call esi
mov edx, dword [edi + 8]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4357bc
push edx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0xc]
push 4
push eax
push 4
add edi, 4
push edi
call esi
add esp, 0x10
pop edi
pop esi
add esp, 0x48
ret

Function at 0x42ec00
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x16c
push 0x200
push 0x160
lea eax, [esp + 0x10]
push eax
push 0
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov eax, esi
add esp, 0x16c
ret

Function at 0x42ec40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
mov ecx, dword [esp + 0xc]
push 0x4311bc
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x130]
push esi
push edi
call dword [sym.imp.mfc90.dll_Ordinal_2327]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, 0x443190
jmp 0x42ec80
push 0x103
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call sub.MSVCR90.dll_memset
mov ecx, dword [esi]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0x24]
push edx
push 0
call edi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x130], 0
mov eax, dword [eax]
push eax
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
lea ecx, [esp + 0x18]
sete bl
mov dword [esp + 0x130], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
jne 0x42ed12
add esi, 4
cmp esi, 0x443258
jl 0x42ec80
xor al, al
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x124
ret 8
lea ecx, [esp + 0x1c]
lea esi, [esp + 0x14]
call fcn.0042ec00
mov ecx, dword [esp + 0x13c]
push eax
mov dword [esp + 0x134], 1
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, 1
jmp 0x42ecf7
Function at 0x42f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431c40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [esp + 0x24]
mov esi, edx
mov dword [esp + 0xc], ebx
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x2c], bl
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [esp + 0x3c], ebx
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push eax
push edi
lea eax, [esp + 0x18]
mov ebx, esi
mov dword [esp + 0x30], edx
call fcn.0042f4b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
lea ebx, [esi + 0x54]
push ecx
call fcn.004021a0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push ecx
push 0x14a
push edx
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x20]
push 0
push eax
push 0x14e
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 2
call fcn.0042eec0
cmp eax, 7
jle 0x42f6ee
call fcn.0042f2a0
test al, al
je 0x42f6ee
mov eax, ebx
call fcn.00402150
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x146
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
dec eax
push eax
push 0x144
push ecx
call edi
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c108
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x42c117
pop dword [ebp - 0x18]
mov eax, 0x42c117
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa8619061
add dword [ebp - 0x28], 0xa5f0b4ea
mov dword [ebp - 0x24], 0x6c531ee
sub dword [ebp - 0x24], 0xd491e5a9
mov dword [ebp - 0x20], 0x5179c287
sub dword [ebp - 0x20], 0x52d7e59
mov dword [ebp - 0x1c], 0x7526912d
add dword [ebp - 0x1c], 0x8ad96ed3
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x76ad1c12
sub dword [ebp - 0x28], 0x23ab2bc
mov dword [ebp - 0x24], 0xf37e308
sub dword [ebp - 0x24], 0xcdcb8193
mov dword [ebp - 0x20], 0xd416422d
sub dword [ebp - 0x20], 0x70a6d5c1
mov dword [ebp - 0x1c], 0x1b41d04
sub dword [ebp - 0x1c], 0x1b41d04
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c51e
push 0
call eax
mov ecx, 0x1b609148
add ecx, 0xe49fba77
mov edx, eax
mov ebx, 0x442600
add ebx, dword [ebp - 0x18]
mov edi, 0x2ff0d173
mov dword [ebp - 0x10], 0xc7f99f5
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0x661e9d9
xor esi, edi
mov dword [ebp - 4], 0xe8aa5177
mov dword [edx], esi
xor dword [ebp - 8], 0x7631160d
add edx, 0xd59915cd
sub edx, 0xd59915c9
add ebx, 0xa3e80aeb
sub ebx, 0xa3e80ae7
loop 0x42c21e
add eax, 0x121cf
mov ebx, eax
add eax, 0x5d2f1042
add eax, 0xa2d0efc3
mov ecx, 0x2738e552
sub ecx, 0x26f8e552
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x42e764
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c4b0]
jne 0x42e76e
repz ret
jmp fcn.0042f000
Function at 0x42ee33
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x436140
call fcn.0042e950
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x43cb24], ebx
jne 0x42ebd6
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x43cb20
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x42ec10
cmp eax, esi
jne 0x42ec03
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x42ec13
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x42ebea
xor esi, esi
inc esi
mov eax, dword [0x43cb1c]
cmp eax, esi
jne 0x42ec26
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x42ec61
mov eax, dword [0x43cb1c]
test eax, eax
jne 0x42ec5b
mov dword [0x43cb1c], esi
push 0x432410
push 0x432404
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x42ec61
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42ed73
mov dword [0x43c754], esi
mov eax, dword [0x43cb1c]
cmp eax, esi
jne 0x42ec85
push 0x432400
push 0x4323e4
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x43cb1c], 2
cmp dword [ebp - 0x20], ebx
jne 0x42ec92
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x43cb28], ebx
je 0x42ecb3
push 0x43cb28
call main
pop ecx
test eax, eax
je 0x42ecb3
push ebx
push 2
push ebx
call dword [0x43cb28]
mov eax, dword [sym.imp.MSVCR100.dll__wcmdln]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x42ed14
cmp cx, bx
je 0x42eccf
cmp dword [ebp - 0x1c], ebx
jne 0x42ed14
movzx ecx, word [eax]
cmp cx, bx
je 0x42ece4
cmp ecx, 0x20
ja 0x42ece4
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x42eccf
test byte [ebp - 0x40], 1
je 0x42ecf0
movzx ecx, word [ebp - 0x3c]
jmp 0x42ecf3
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x43c750], eax
cmp dword [0x43c744], ebx
jne 0x42ed59
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp ecx, 0x22
jne 0x42ed24
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x42ecba
cmp dword [0x43c754], ebx
jne 0x42ed67
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x43c750]
call fcn.0042e995
ret
call main
jmp 0x42eba8