joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x286a46e7
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x791f28d8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x55402c
Capabilities:
Packed with generic packer

Disassembly:
inc edi
push eax
inc ecx
inc esp
inc esp
dec ecx
dec esi
inc edi
pop eax
pop eax
push eax
inc ecx
inc esp
inc esp
dec ecx
dec esi
inc edi
push eax
inc ecx
inc esp
inc esp
dec ecx
dec esi
inc edi
pop eax
pop eax
push eax
inc ecx
inc esp
inc esp
dec ecx
dec esi
inc edi
push eax
inc ecx
inc esp
inc esp
add eax, dword [eax]
add byte [eax], al
cld
iretd
stc
jb 0x55405d
pop ebx
lodsd eax, dword [esi]
cld
scasb al, byte es:[edi]
imul esi, dword [ecx - 0x159e125f], 0xf87dfdd3
ret
stosb byte es:[edi], al
aas
jge 0x553fdb
pop ebx
popfd
jmp 0xdabf8e4e
pushal
jb 0x554065
and byte [ebx], 0x56
pop ss
mov dl, 0xe8
daa
add byte [eax], al
add bh, cl
jg 0x5540b4
call fcn.00554091
iretd
xchg ebx, eax
xor edi, dword [ecx + 0x26]
int3
in al, 0x3e
scasd eax, dword es:[edi]
mov cs, word [ebp + 0x2a]
mov eax, 0xc308bf4d
jl 0x554044
or ecx, dword [eax]
add dh, byte [ecx]
jle 0x55413d
or byte [edx], al
xor dword [esi + 0x76], edi
mov byte [0x2ef759d1], al
inc ecx
adc dh, ch
cmp dword [ebx], 0
jmp 0x5540ec
sbb eax, 0x6337468a
xchg edi, eax
invalid
je 0x55427e
stc
jb 0x5540fc
pop ebp
arpl dx, ax
cmp al, 0x3f
pop eax
push esi
mov ecx, ebx
jb 0x55412c
jo 0x5540d5
jecxz 0x55413e
push ss
invalid
mov ebp, 0x9a1aced1
pop ebx
or bl, byte [edi + esi*4]
sbb bl, byte [edx - 0x48e3f5a5]
fild qword [ebx + ebp*8]
call 0x926d0bd8
jb 0x5540b7
idiv byte [ebx + eax*4 + 0x2eeb04c3]
jecxz 0x5540c2
add ebx, 4
jmp 0x55415f
push 0x23b6f3b5
sub al, 0xd6
jns 0x554117
inc esi
add al, 0xbb
int1
scasb al, byte es:[edi]
or al, 0x1f
mov ebx, 0x1f0caef1
invalid
mov eax, dword [ebx]
jmp 0x55417f
add eax, ebx
clc
jae 0x5541aa
sahf
cmp eax, 0x5ceec2b5
jo 0x55411a
fsqrt
mov ecx, 0x6f7dad86
loop 0x5541f5
pop ecx
dec ecx
dec esp
jge 0x5541cd
push 0x29
arpl word [ecx + 0x36], ax
and byte [edx - 0x1259c08], dh
jmp 0x8c1c47fe
mov edx, dword [ebx + 4]
jmp 0x5541c9
sub dword [eax], 0x45ef6ad5
out dx, eax
inc ebp
jmp 0x5541e2
invalid
add eax, 4
jmp 0x5541fc
pushal
out dx, al
xor cl, byte [ebp + 0x37]
stc
cmpsd dword [esi], dword es:[edi]
sub edx, 1
clc
jae 0x55420e
push esp
mov cl, 0x5e
jns 0x554276
test eax, 0xdbb712db
inc edi
jne 0x5541ad
jmp 0x554228
add ebx, 8
jmp 0x554233
sub dword [ecx], 1
stc
jb 0x554252
jle 0x5541d2
adc dword [eax - 0x2a0cc81b], ecx
pop esi
in al, 0xe3
ret
jne 0x55412f
jmp 0x554279
clc
or dl, byte [esi + 0x25e8]
add bl, ch
pop es
loope 0x55429b
call fcn.005542a3
jmp 0x554287
dec ebx
push eax
fimul word [edi]
frstor dword [ecx - 7]
popal
stc
jb 0x55429e
into
bound edx, qword [ecx]
mov al, 0xff
stc
or cl, bl
fimul word [edi]
jmp 0x554294
por mm7, mm5
add eax, 0xee2232aa
out dx, al
and eax, 0xbec9e95f
hlt
jmp loc.004a016c

Function at 0x554091
Capabilities:
Packed with generic packer

Disassembly:
pop ebx
jmp 0x554099
add ebx, 0xffffff96
jmp 0x5540cf
Function at 0x401118
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x42ffc0
sub esp, 0x8c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.Control_PanelDesktop
push 0x80000001
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430034
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.WheelScrollLines
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x430029
push 0xa
lea edx, [esp + 0x14]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x8c
ret
Function at 0x40132f
Capabilities:
Inspect load icon resource

Disassembly:
jmp 0x45cf80
sub esp, 0x40
push esi
push edi
mov edi, ecx
call sub.MFC42.DLL_AfxGetModuleState
push 0x99
push 0xe
push 0x99
call sub.MFC42.DLL_AfxFindResourceHandle
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push eax
call esi
push 0x86
push 0xe
push 0x86
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x87
push 0xe
push 0x87
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x9e
push 0xe
push 0x9e
mov dword [esp + 0x1c], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x9d
push 0xe
push 0x9d
mov dword [esp + 0x20], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x92
push 0xe
push 0x92
mov dword [esp + 0x24], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x90
push 0xe
push 0x90
mov dword [esp + 0x28], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x9c
push 0xe
push 0x9c
mov dword [esp + 0x2c], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x9b
push 0xe
push 0x9b
mov dword [esp + 0x30], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x98
push 0xe
push 0x98
mov dword [esp + 0x34], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x85
push 0xe
push 0x85
mov dword [esp + 0x38], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x91
push 0xe
push 0x91
mov dword [esp + 0x3c], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x88
push 0xe
push 0x88
mov dword [esp + 0x40], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x97
push 0xe
push 0x97
mov dword [esp + 0x44], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x8b
push 0xe
push 0x8b
mov dword [esp + 0x48], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0x9a
push 0xe
push 0x9a
mov dword [esp + 0x4c], eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call esi
push 0
push 0x10
lea esi, [edi + 0xf0]
push 0x20
push 0x10
push 0x10
mov ecx, esi
mov dword [esp + 0x58], eax
call sub.MFC42.DLL_CImageList::Create
test eax, eax
je 0x45d186
mov eax, dword [edi + 0xf4]
push ebx
push ebp
push 0xf0f0f0
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
lea ebx, [esp + 0x10]
mov ebp, 0x10
mov ecx, dword [ebx]
mov edx, dword [edi + 0xf4]
push ecx
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add ebx, 4
dec ebp
jne 0x45d14a
pop ebp
pop ebx
test esi, esi
je 0x45d16b
mov esi, dword [esi + 4]
mov eax, dword [edi + 0x118]
push esi
push 0
push 0x1109
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call sub.MFC42.DLL_CImageList::FromHandle
pop edi
pop esi
add esp, 0x40
ret
Function at 0x40137f
Capabilities:
Read .ini file

Disassembly:
jmp 0x449ff0
push 0xffffffffffffffff
push 0x466160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0045f748
lea ecx, [esp + 4]
mov dword [esp + 0x54], 0
call fcn.0045f748
mov ecx, esi
mov byte [esp + 0x54], 1
call fcn.00402793
test eax, eax
jl 0x44a167
push eax
lea eax, [esp + 0x30]
push str.data_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [0x479cac]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x2c]
push ecx
push 0x3c
push edx
push 0
push eax
push str.FreqRange
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x44a167
mov ecx, dword [esp + 0xe]
push edi
push ecx
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Insert
mov edx, dword [esp + 0x13]
lea ecx, [esp + 0xc]
push edx
push 1
call sub.MFC42.DLL_CString::Insert
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 2
call sub.MFC42.DLL_CString::Insert
mov ecx, dword [esp + 0x11]
push ecx
push 3
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Insert
mov edx, dword [esp + 0x16]
lea ecx, [esp + 8]
push edx
push 0
call sub.MFC42.DLL_CString::Insert
mov eax, dword [esp + 0x17]
lea ecx, [esp + 8]
push eax
push 1
call sub.MFC42.DLL_CString::Insert
mov ecx, dword [esp + 0x14]
push ecx
push 2
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Insert
mov edx, dword [esp + 0x15]
lea ecx, [esp + 8]
push edx
push 3
call sub.MFC42.DLL_CString::Insert
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push eax
call edi
lea eax, [eax + eax*4]
mov edx, dword [esp + 0xc]
push edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 4
mov dword [esi + 0x82298], ecx
call edi
lea eax, [eax + eax*4]
add esp, 8
lea ecx, [esp + 8]
mov byte [esp + 0x58], 0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 4
mov dword [esi + 0x82294], eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
lea ecx, [esp + 4]
mov dword [esi + 0x82298], 0x989680
mov dword [esi + 0x82294], 0x55d4a80
mov byte [esp + 0x54], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x40150a
Capabilities:
Read .ini file

Disassembly:
jmp 0x45c9c0
push 0xffffffffffffffff
push 0x467830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
mov dword [esp + 0x10], ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0045f748
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
xor edi, edi
mov dword [esp + 0x70], edi
push edi
lea eax, [esp + 0x20]
push 0x478670
push eax
call ebp
mov ecx, dword [0x479cb0]
add esp, 0xc
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push ecx
push 0x3c
push edx
push 0
push eax
push str.TreeMainMenu
call ebx
test eax, eax
je 0x45cb24
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 1
call fcn.0045f76c
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x479cb8]
push str.D600
push eax
call esi
add esp, 8
test eax, eax
je 0x45cad8
mov eax, dword [0x479cb8]
push str.PX700
push eax
call esi
add esp, 8
test eax, eax
je 0x45cad8
mov eax, dword [0x479cb8]
push str.A_85T
push eax
call esi
add esp, 8
test eax, eax
je 0x45cad8
mov eax, dword [0x479cb8]
push str.LS_35
push eax
call esi
add esp, 8
test eax, eax
je 0x45cad8
mov eax, dword [0x479cb8]
push 0x4787d0
push eax
call esi
add esp, 8
test eax, eax
je 0x45cad8
mov eax, dword [0x479cb8]
push str.IC_DP2
push eax
call esi
add esp, 8
test eax, eax
jne 0x45cadd
cmp edi, 3
je 0x45cb17
test edi, edi
jne 0x45caef
push 0x479ce0
lea ecx, [esp + 0x14]
call fcn.0045f76c
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0
push 0
mov eax, dword [ecx + edi*4 + 0x138]
push 0
push 0
push 0
push edx
push 1
push eax
add ecx, 0xf8
call sub.MFC42.DLL_CTreeCtrl::SetItem
inc edi
cmp edi, 0x7d0
jl 0x45ca01
lea ecx, [esp + 0x10]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x401d8e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x43f2f0
push 0xffffffffffffffff
push 0x465370
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x20]
call fcn.00401316
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.0045f748
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0045f748
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.0045f748
mov ecx, ebp
mov byte [esp + 0x30], 3
call fcn.00401b40
mov esi, dword [ebp + 0xbeb8]
mov ecx, dword [0x479cc8]
mov eax, 1
inc esi
cmp ecx, eax
mov dword [esp + 0x14], eax
jl 0x43f403
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.GroupList_d
push ecx
call sub.MFC42.DLL_CString::Format
mov edi, 1
add esp, 0xc
cmp esi, edi
jl 0x43f3d8
lea edx, [esp + 0x1c]
push edi
push edx
lea ecx, [esp + 0x2c]
call fcn.00401ac3
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 4
call fcn.0045f76c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call ebx
add esp, 8
test eax, eax
je 0x43f3d8
inc edi
cmp edi, esi
jle 0x43f394
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x43f402
mov eax, dword [esp + 0x18]
mov ecx, dword [0x479cc8]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jle 0x43f374
pop ebx
lea ecx, [esp + 0xc]
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.00401dd9
mov edi, 1
push 0
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.00402e91
inc edi
cmp edi, 0x20
jle 0x43f417
lea edx, [esp + 0x18]
push esi
push edx
lea ecx, [esp + 0x28]
call fcn.00401ac3
mov ecx, dword [ebp + 0x9f88]
mov eax, dword [eax]
push 0xffff0002
push ecx
push 0
push 0
push 0
push 0
push 0
push eax
push 1
lea ecx, [ebp + 0x9f24]
mov byte [esp + 0x54], 5
call sub.MFC42.DLL_CTreeCtrl::InsertItem
lea ecx, [esp + 0x18]
mov dword [ebp + esi*4 + 0x2000], eax
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
mov ecx, ebp
call fcn.0040255e
mov ecx, ebp
call fcn.00401b54
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.00402ed2
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x401de3
Capabilities:
Read .ini file

Disassembly:
jmp 0x448670
push 0xffffffffffffffff
push 0x465f2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call fcn.0045f748
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
push eax
push 0x478670
push ecx
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x479cb0]
mov edx, dword [esp + 0x4c]
add esp, 0xc
lea ecx, [esp + 4]
mov esi, dword [edx]
push eax
push 0x3e8
push 0x3e8
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x18]
push 0x479a40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov esi, dword [esp + 0x3c]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x401ded
Capabilities:
Read .ini file

Disassembly:
jmp 0x448550
push 0xffffffffffffffff
push 0x465eef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.0045f748
mov ecx, dword [esp + 0x24]
mov edx, dword [0x479cb0]
mov eax, dword [esp + 0x28]
push edx
mov edi, dword [ecx]
push 0x3e8
mov esi, dword [eax]
push 0x3e8
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x479a40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x479398
push 0x479394
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
push 0x479254
push 0x479390
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401f41
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x43f560
push 0xffffffffffffffff
push 0x4653c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.0045f748
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.0045f748
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.0045f748
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 2
call fcn.00402c9d
mov ecx, ebp
mov byte [esp + 0x30], 3
call fcn.00401b40
mov esi, dword [ebp + 0xbeb4]
mov ecx, dword [0x479cc4]
mov eax, 1
inc esi
cmp ecx, eax
mov dword [esp + 0x14], eax
jl 0x43f673
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.Zone_d
push ecx
call sub.MFC42.DLL_CString::Format
mov edi, 1
add esp, 0xc
cmp esi, edi
jl 0x43f648
lea edx, [esp + 0x1c]
push edi
push edx
lea ecx, [esp + 0x2c]
call fcn.00402b9e
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 4
call fcn.0045f76c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call ebx
add esp, 8
test eax, eax
je 0x43f648
inc edi
cmp edi, esi
jle 0x43f604
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x43f672
mov eax, dword [esp + 0x18]
mov ecx, dword [0x479cc4]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jle 0x43f5e4
pop ebx
lea ecx, [esp + 0xc]
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.004027a7
mov edi, 1
push 0
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.00402cbb
inc edi
cmp edi, 0x10
jle 0x43f687
lea edx, [esp + 0x18]
push esi
push edx
lea ecx, [esp + 0x28]
call fcn.00402b9e
mov ecx, dword [ebp + 0x9f8c]
mov eax, dword [eax]
push 0xffff0002
push ecx
push 0
push 0
push 0
push 0
push 0
push eax
push 1
lea ecx, [ebp + 0x9f24]
mov byte [esp + 0x54], 5
call sub.MFC42.DLL_CTreeCtrl::InsertItem
lea ecx, [esp + 0x18]
mov dword [ebp + esi*4 + 0x3f40], eax
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
mov ecx, ebp
call fcn.0040255e
mov ecx, ebp
call fcn.00401b54
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 2
call fcn.0040146a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x402293
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x41ad30
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x14b
push eax
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IDS_NONE
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
push ecx
call fcn.004027f2
mov edx, dword [eax]
mov eax, dword [esi + 0x20]
add esp, 8
push edx
push 0
push 0x143
push eax
call edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push str.BINDATA
push 0x94
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ebp, 0x32
mov ecx, dword [esi + 0x20]
push ebx
push 0
push 0x143
push ecx
call edi
add ebx, 8
dec ebp
jne 0x41adac
push str.BINDATA
push 0x95
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ebp, 0x68
mov edx, dword [esi + 0x20]
push ebx
push 0
push 0x143
push edx
call edi
add ebx, 8
dec ebp
jne 0x41ade9
push str.BINDATA
push 0x96
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ebp, 0x68
mov eax, dword [esi + 0x20]
push ebx
push 0
push 0x143
push eax
call edi
add ebx, 8
dec ebp
jne 0x41ae26
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40254a
Capabilities:
Read .ini file

Disassembly:
jmp 0x44ace0
mov eax, dword [esp + 4]
sub esp, 0x40
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x28]
push str.data_d
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x479cac]
add esp, 0xc
lea eax, [esp + 4]
lea ecx, [esp + 0x24]
push edx
push 0x20
push eax
push 0
push ecx
push str.FreqRange
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x44ad3d
push 8
lea edx, [esp + 8]
push 0
push edx
call fcn.00401a37
mov eax, dword [esp + 0x10]
add esp, 0xc
mov dword [esi + 0x2068], eax
mov ecx, esi
call fcn.0040137f
mov ecx, esi
call fcn.00401357
pop esi
add esp, 0x40
ret 4
Function at 0x4027f2
Capabilities:
Read .ini file

Disassembly:
jmp 0x448430
push 0xffffffffffffffff
push 0x465eb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
lea ecx, [esp + 4]
mov dword [esp + 0x14], 1
call fcn.0045f748
mov eax, dword [0x479cb0]
mov esi, dword [esp + 0x20]
push eax
push 0x3e8
push 0x3e8
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x479a40
push esi
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x479398
push 0x479394
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
push 0x479254
push 0x479390
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret