joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412402
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41242e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4124cb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4124f5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412470
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4124fa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4124f5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15a2346a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x42607413
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x406010
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x44cd66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x354
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x88
lea edi, [esp + 0x144]
mov dword [esp + 0x140], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
call fcn.0044b6f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x36c], ebx
call fcn.0044b6f4
push ebx
push 2
mov byte [esp + 0x374], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x406132
mov edi, dword [esp + 0x374]
mov dword [esp + 0x18], 0x128
mov ecx, edi
call sub.MFC42.DLL_CString::MakeLower
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40612b
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x140]
push ecx
push edx
mov ecx, ebp
call fcn.00405fd0
cmp eax, ebx
je 0x4060f9
lea eax, [esp + 0x160]
lea ecx, [esp + 0x10]
push eax
call fcn.0044b82c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::MakeLower
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x40610a
lea edx, [esp + 0x18]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40612b
jmp 0x4060b2
lea eax, [esp + 0x260]
lea ecx, [esp + 0x14]
push eax
call fcn.0044b82c
lea ecx, [esp + 0x14]
push ecx
lea ecx, [ebp + 0x5398]
call fcn.004079c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov byte [esp + 0x36c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x36c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x360
ret 4
Function at 0x406840
Capabilities:
Get mac address on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44ce36
push eax
mov eax, 0x280c
mov dword fs:[0], esp
call fcn.0044c330
push edi
lea ecx, [esp + 4]
call fcn.0044b6f4
mov edi, dword [esp + 0x2820]
mov dword [esp + 0x2818], 0
mov ecx, edi
call sub.MFC42.DLL_CString::Empty
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x10], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40695a
push ebp
push esi
lea esi, [esp + 0x18]
xor ebp, ebp
xor edx, edx
xor eax, eax
mov dl, byte [esi + 0x199]
mov al, byte [esi + 0x198]
xor ecx, ecx
push edx
mov cl, byte [esi + 0x197]
push eax
xor edx, edx
push ecx
mov dl, byte [esi + 0x196]
xor eax, eax
mov al, byte [esi + 0x195]
xor ecx, ecx
mov cl, byte [esi + 0x194]
push edx
push eax
push ecx
lea edx, [esp + 0x24]
push str._.2X__.2X__.2X__.2X__.2X__.2X
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [edi]
add esp, 0x20
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x406907
push 0x2c
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Insert
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::operator
inc ebp
cmp ebp, 3
jae 0x40691f
mov esi, dword [esi]
test esi, esi
jne 0x4068a9
mov edx, dword [edi]
pop esi
pop ebp
mov eax, dword [edx - 8]
cmp eax, 0x35
jle 0x40695a
lea eax, [esp + 0xc]
push 0x35
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, edi
mov byte [esp + 0x281c], 1
call fcn.0044b81a
lea ecx, [esp + 0xc]
mov byte [esp + 0x2818], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x2818], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2810]
pop edi
mov dword fs:[0], ecx
add esp, 0x2818
ret 4
Function at 0x406a90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x44ce4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x406b08
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x406af8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x406b1a
jmp 0x406b0c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x406bb5
push ecx
jmp 0x406baf
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x406b80
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.00406a90
mov ebx, eax
cmp ebx, edi
jne 0x406bd1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x406b42
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x406b93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x406bb5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x406be0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x406bb7

Function at 0x4079c0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
sub esp, 0x118
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, ecx
mov eax, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
je 0x407a00
test byte [esp + 0x18], 0x10
je 0x4079f4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4079fc
push esi
mov ecx, edi
call fcn.00407a50
test eax, eax
jne 0x407a36
mov eax, dword [edi + 4]
test eax, eax
je 0x407a1f
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
pop esi
add esp, 0x118
ret 4
mov edi, dword [edi + 8]
mov esi, dword [esi]
push edi
push esi
push 0x466290
push 0x466288
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
add esp, 0x118
ret 4
Function at 0x407c90
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x4662ac]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x407ca7
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x407ce8
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x466354]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x407d1c
mov cl, byte [esp + edx + 0x50]
jmp 0x407d20
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x407d11
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x407d3e
mov cl, byte [esp + edx + 0x50]
jmp 0x407d42
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x407d33
xor edx, edx
mov eax, 0x4662bc
xor ecx, ecx
mov cl, byte [edx + 0x466364]
cmp byte [esp + ecx + 0x18], 0
je 0x407d6d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x46637c]
cmp byte [esp + ecx + 0x18], 0
je 0x407d84
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x407d54
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x407cdb
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.00407dd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x40e380
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44db48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
lea ecx, [esp + 8]
call fcn.0044b6f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0044b6f4
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.0044b6f4
push 0x47527c
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0044b81a
push 0x466c50
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
push 0x466c48
lea ecx, [esp + 0x10]
call fcn.0044b82c
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
push eax
push 0x8dd
push esi
push ecx
push 0x466c3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov edi, eax
mov al, byte [esi + 0x8b]
test al, al
jne 0x40e423
mov byte [esi + 0x8b], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x40e530
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44db88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea ecx, [esp + 4]
call fcn.0044b6f4
push 0x47527c
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.0044b81a
push 0x466c50
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
push eax
push 0x95
push ecx
push str.UserInfo
push str.UserInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40e650
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44dbe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0044b6f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.0044b6f4
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.0044b6f4
push 0x47527c
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.0044b81a
push 0x466c50
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x14]
push eax
push 0x808
push 0x46815c
push 0x466c98
push str.Find2
push str.Search2CZ
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x46815c
lea ecx, [esp + 0x14]
mov byte [eax + 0x46815c], 0
call fcn.0044b82c
mov ecx, 0x468f28
xor esi, esi
call sub.MFC42.DLL_CStringList::RemoveAll
xor ebp, ebp
push esi
push 0x40
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find_2
mov edi, eax
test edi, edi
jl 0x40e775
mov ecx, edi
lea edx, [esp + 0x18]
sub ecx, esi
push ecx
push esi
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.0044b81a
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
lea esi, [edi + 1]
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::TrimRight
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40e76d
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x468f28
call sub.MFC42.DLL_CStringList::AddTail
inc ebp
cmp ebp, 0x14
jl 0x40e6fb
jmp 0x40e7cd
lea edx, [esp + 0x1c]
push esi
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.0044b81a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::TrimRight
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40e7cd
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x468f28
call sub.MFC42.DLL_CStringList::AddTail
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x40e8b0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44dc30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0044b6f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.0044b6f4
push 0x47527c
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.0044b81a
push 0x466c50
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov ebx, 0x473170
xor eax, eax
mov esi, ebx
lea ebp, [eax + 1]
lea eax, [esp + 0x14]
push ebp
push str.FindCond_.1d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add esp, 0xc
push ecx
push 0x168
push 0x473310
push edx
push 0x466c3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
xor edx, edx
mov ecx, 0x473319
test eax, eax
je 0x40e967
cmp byte [ecx - 1], 0
je 0x40e95c
cmp byte [ecx], 0
jbe 0x40e95c
inc edx
add ecx, 0x48
cmp ecx, 0x473481
jl 0x40e94c
test edx, edx
jle 0x40e99a
cmp dword [esi], 0
jne 0x40e97f
push 0x168
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi], eax
mov edi, dword [esi]
add esi, 4
mov dword [esp + 0x18], esi
mov ecx, 0x5a
mov esi, 0x473310
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
jmp 0x40e9af
mov eax, dword [ebx]
test eax, eax
je 0x40e9af
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebx], 0
add ebx, 4
mov eax, ebp
cmp ebx, 0x4731a4
jl 0x40e910
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40eb20
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44dc81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0044b6f4
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xf0], ebx
call fcn.0044b6f4
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], 1
call fcn.0044b6f4
push 0x47527c
lea ecx, [esp + 0x18]
mov byte [esp + 0xf4], 2
call fcn.0044b81a
push 0x466c50
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
mov ecx, 0x468fc8
call sub.MFC42.DLL_CStringList::RemoveAll
mov ecx, 0x468fa8
call sub.MFC42.DLL_CStringList::RemoveAll
mov ecx, 0x468f88
call sub.MFC42.DLL_CStringList::RemoveAll
mov ecx, 0x468f68
call sub.MFC42.DLL_CStringList::RemoveAll
mov ecx, 0x468f48
call sub.MFC42.DLL_CStringList::RemoveAll
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor esi, esi
lea edi, [esi + 1]
lea eax, [esp + 0x18]
push edi
push str.Domain_.1d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add esp, 0xc
lea edx, [esp + 0x1c]
push ecx
push 0xc8
push edx
push 0x466cb0
push eax
push 0x466c3c
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + eax + 0x1c], bl
push ecx
lea ecx, [esp + 0x14]
call fcn.0044b82c
cmp esi, ebx
jl 0x40ec29
cmp esi, 0xa
jge 0x40ec2e
lea edx, [esp + 0x10]
mov ecx, 0x468fa8
push edx
call sub.MFC42.DLL_CStringList::AddTail
cmp esi, 0xa
jl 0x40ec42
cmp esi, 0x14
jge 0x40ec47
lea eax, [esp + 0x10]
mov ecx, 0x468fc8
push eax
call sub.MFC42.DLL_CStringList::AddTail
cmp esi, 0x14
jl 0x40ec5b
cmp esi, 0x1e
jge 0x40ec60
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x468f88
call sub.MFC42.DLL_CStringList::AddTail
cmp esi, 0x1e
jl 0x40ec74
cmp esi, 0x28
jge 0x40ec79
lea edx, [esp + 0x10]
mov ecx, 0x468f68
push edx
call sub.MFC42.DLL_CStringList::AddTail
cmp esi, 0x28
jl 0x40ec8d
cmp esi, 0x32
jge 0x40ec8d
lea eax, [esp + 0x10]
mov ecx, 0x468f48
push eax
call sub.MFC42.DLL_CStringList::AddTail
mov esi, edi
cmp esi, 0x32
jl 0x40ebc9
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0xf0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xe8]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0xe4
ret
Function at 0x411320
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x95c], 0x12
jne 0x411364
push 0
lea ecx, [esi + 0x834]
call sub.MFC42.DLL_CWnd::ShowWindow
push 0
push 0x10000000
push 0
lea ecx, [esi + 0x38c]
call sub.MFC42.DLL_CWnd::ModifyStyle
mov eax, dword [esi + 0x3ac]
push 0x505
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [esi + 0x3ac]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb
push ecx
call edi
mov edx, dword [esi + 0x3ac]
push 0
push 0
push 0x184
push edx
call edi
mov eax, dword [esi + 0x3ac]
push 0x466cec
push 0
push 0x180
push eax
call edi
mov ecx, dword [esi + 0x3ac]
push 0x466d2c
push 0
push 0x180
push ecx
call edi
mov edx, dword [esi + 0x3ac]
push 0x466d28
push 0
push 0x180
push edx
call edi
mov eax, dword [esi + 0x3ac]
push 0x466cf0
push 0
push 0x180
push eax
call edi
mov ecx, dword [esi + 0x3ac]
push 0x466d24
push 0
push 0x180
push ecx
call edi
mov dword [esi + 0x95c], 0xd
mov edx, dword [esi + 0x3ac]
push 0
push 1
push 0xb
push edx
call edi
mov eax, dword [esi + 0x3ac]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
ret

Function at 0x425de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x4590e8
lea ecx, [esi + 0xfc]
mov dword [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xf0]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0xdc]
mov dword [esp + 0xc], edi
mov dword [edi], 0x45508c
mov ecx, edi
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x455078
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov dword [edi], 0x45508c
mov ecx, edi
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x455078
lea edi, [esi + 0x28]
mov dword [esp + 0xc], edi
mov dword [edi], 0x45508c
mov ecx, edi
mov byte [esp + 0x18], 9
call sub.MFC42.DLL_CGdiObject::DeleteObject
add esi, 0x20
mov dword [edi], 0x455078
mov dword [esp + 0xc], esi
mov dword [esi], 0x45508c
mov ecx, esi
mov dword [esp + 0x18], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x455078
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x426280
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, ecx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x4262e7
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
jne 0x4262e7
push 0xffffffffffffffff
push eax
push 0xef21
call sub.MFC42.DLL_AfxMessageBox_1
pop edi
mov dword [ebx + 0x100], 0xfffffffe
pop esi
xor eax, eax
pop ebx
add esp, 0x9c
ret
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp eax, edx
jne 0x426314
push 0xffffffffffffffff
push edx
push 0xef21
call sub.MFC42.DLL_AfxMessageBox_1
pop edi
mov dword [ebx + 0x100], 0xfffffffe
pop esi
xor eax, eax
pop ebx
add esp, 0x9c
ret
lea edi, [ebx + 0x38]
mov ecx, 0x27
lea esi, [esp + 0xc]
mov eax, 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x48]
sub ecx, edx
je 0x426364
dec ecx
je 0x426357
dec ecx
jne 0x426364
mov ecx, dword [ebx + 0x3c]
cmp ecx, 4
ja 0x426342
mov dword [ebx + 0xec], eax
cmp ecx, 5
jne 0x42636a
pop edi
mov dword [ebx + 0xec], eax
pop esi
pop ebx
add esp, 0x9c
ret
mov ecx, dword [ebx + 0x3c]
cmp ecx, 4
ja 0x426364
jne 0x426364
mov ecx, dword [ebx + 0x40]
mov dword [ebx + 0xec], edx
pop edi
pop esi
pop ebx
add esp, 0x9c
ret