joyce8/EMBER2024-capa huggingface dataset:
Function at 0x23a061d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
push ebx
push 2
lea eax, [esp + 8]
push eax
push 0x100c
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x10]
push ecx
push edi
call ebx
add word [esp + 0x14], 7
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCR90.dll__wtoi]
mov edx, dword [edi]
mov ecx, 0xffff
sub ecx, eax
mov ax, word [esp + 0x18]
add ax, cx
mov word [esp + 0x18], ax
movzx eax, ax
mov dword [esi], edx
mov ecx, dword [edi + 4]
cdq
mov dword [esi + 4], ecx
mov ecx, 7
idiv ecx
add esp, 4
push 0xffffffffffffffff
push 0xff676980
mov eax, edx
imul eax, eax, 0x15180
cdq
push edx
push eax
call fcn.23a444c0
add dword [esi], eax
adc dword [esi + 4], edx
lea edx, [esp + 0x10]
push edx
push esi
call ebx
xor ecx, ecx
xor edx, edx
mov word [esp + 0x1a], cx
lea ecx, [esp + 8]
mov word [esp + 0x1c], dx
xor eax, eax
push ecx
lea edx, [esp + 0x14]
push edx
mov word [esp + 0x20], ax
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop ebx
add esp, 0x20
ret
Function at 0x23a06610
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov esi, eax
call fcn.23a06750
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
je 0x23a06654
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x23a0664e
call ebx
push eax
mov eax, dword [esi]
push eax
push str.CloseHandle_0x_08X__failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_char_const__]
add esp, 0xc
mov dword [esi], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x23a06698
call ebx
mov edi, eax
test edi, edi
je 0x23a06698
push edi
push ebp
push str.open___s___failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_wchar_t_const__]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x23a066cd
call ebx
push eax
push 0x480
push str.d:_build_temporary_activitymon20_sources_actbasic.._actBasic_advapi.h
lea ecx, [esp + 0x1c]
call fcn.23a01340
push 0x23a677b8
lea edx, [esp + 0x14]
push edx
call sub.MSVCR90.dll__CxxThrowException
push 0
push eax
push 0
push 2
mov dword [esi + 4], eax
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x23a06708
call ebx
mov esi, eax
push esi
push str.CreateFileMapping___failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_char_const__]
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esi + 4]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x23a0673f
call ebx
mov esi, eax
push esi
push str.MapViewOfFile___failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_char_const__]
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret 4
Function at 0x23a070b0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x23a499f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x18]
call fcn.23a01080
mov dword [esp + 0x3c], 0
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov ecx, dword [eax]
push ecx
push 0x5c
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_last_of_wchar_t__unsigned_int_const]
mov edx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
lea ecx, [esp + 0x14]
cmp eax, dword [edx]
jne 0x23a07122
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
jmp 0x23a07129
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::resize_unsigned_int_]
cmp dword [esp + 0x28], 0
je 0x23a071d7
mov eax, dword [esp + 0x18]
mov ebp, 8
cmp dword [esp + 0x2c], ebp
jae 0x23a07147
lea eax, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call ebx
test eax, eax
je 0x23a0716c
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
jmp 0x23a071eb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
cmp esi, 0xb7
je 0x23a07156
cmp esi, 3
jne 0x23a071b9
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x23a07191
lea eax, [esp + 0x18]
push eax
call fcn.23a070b0
add esp, 4
test al, al
je 0x23a071d7
call edi
mov esi, eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x23a071b0
lea eax, [esp + 0x18]
push 0
push eax
call ebx
test eax, eax
jne 0x23a07156
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x23a071c7
lea eax, [esp + 0x18]
push esi
push eax
push str.CreateDirectory___s___failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_wchar_t_const__]
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.23a41d28
add esp, 0x2c
ret
Function at 0x23a07b40
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x23a44568
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
je 0x23a07b8d
add esi, 0x1c
mov ecx, dword [esp + 0x34]
push esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
push 0x5c
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.MSVCR90.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x23a07b6f
add eax, 2
push eax
lea ecx, [esp + 0xc]
call fcn.23a01080
mov ecx, dword [esp + 0x34]
lea eax, [esp + 8]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
Function at 0x23a0a6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44a08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x23a0a717
mov ecx, dword [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 4]
push ecx
lea ecx, [esp + 0xc]
call fcn.23a01080
mov ecx, dword [esp + 0x34]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [esp + 4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret 4

Function at 0x23a0ad50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x23a44b01
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.XTToolkitPro.dll_public:_void___thiscall_CXTPCalendarEvent::constructor_class_CXTPCalendarData__]
mov ecx, esi
mov dword [esp + 0x28], 0
mov dword [esi], vtable.CCalendarEvent.0
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
mov ecx, dword [esp + 0x30]
push 3
push ecx
lea ecx, [esp + 0x18]
mov edi, eax
call sub.mfc90u.dll_COleVariant::COleVariant
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x5c]
push str.actEvntType
mov ecx, edi
mov byte [esp + 0x30], 1
call eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x23a0af40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44b98
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
push eax
mov esi, ecx
push 2
mov dword [esp + 0x24], esi
call fcn.23a0ad50
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
mov dword [esi], vtable.CCalendarService.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x4c], 1
call fcn.23a0a6c0
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
xor ecx, ecx
mov word [esp + 0xc], cx
push eax
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_COleVariant::operator
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0xc]
push eax
push str.actService
mov ecx, edi
mov byte [esp + 0x50], 2
call edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.23a41d28
add esp, 0x40
ret 0x14
Function at 0x23a0b0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44c08
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
push eax
mov esi, ecx
push 0
mov dword [esp + 0x24], esi
call fcn.23a0ad50
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
mov dword [esi], vtable.CCalendarSession.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x4c], 1
call fcn.23a0a6c0
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
xor ecx, ecx
mov word [esp + 0xc], cx
push eax
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_COleVariant::operator
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0xc]
push eax
push str.actSessionBlock
mov ecx, edi
mov byte [esp + 0x50], 2
call edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.23a41d28
add esp, 0x40
ret 8
Function at 0x23a0b2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44c78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
push eax
mov esi, ecx
push 3
mov dword [esp + 0x24], esi
call fcn.23a0ad50
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
mov dword [esi], vtable.CCalendarDevice.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x4c], 1
call fcn.23a0a6c0
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
xor ecx, ecx
mov word [esp + 0xc], cx
push eax
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_COleVariant::operator
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0xc]
push eax
push str.actDevice
mov ecx, edi
mov byte [esp + 0x50], 2
call edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.23a41d28
add esp, 0x40
ret 8
Function at 0x23a0b450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
push eax
mov esi, ecx
push 4
mov dword [esp + 0x24], esi
call fcn.23a0ad50
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
mov dword [esi], vtable.CCalendarComment.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x4c], 1
call fcn.23a0a6c0
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
xor ecx, ecx
mov word [esp + 0xc], cx
push eax
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_COleVariant::operator
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0xc]
push eax
push str.actComment
mov ecx, edi
mov byte [esp + 0x50], 2
call edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.23a41d28
add esp, 0x40
ret 8
Function at 0x23a0b600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a44d58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x23a7ca94]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
push eax
mov esi, ecx
push 1
mov dword [esp + 0x24], esi
call fcn.23a0ad50
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
mov dword [esi], vtable.CCalendarIdle.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x4c], 1
call fcn.23a0a6c0
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_class_CXTPCalendarCustomProperties____thiscall_CXTPCalendarEvent::GetCustomProperties_void_const]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
xor ecx, ecx
mov word [esp + 0xc], cx
push eax
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_COleVariant::operator
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0xc]
push eax
push str.actIdle
mov ecx, edi
mov byte [esp + 0x50], 2
call edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.23a41d28
add esp, 0x40
ret 8
Function at 0x23a170e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x23a46069
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.XTToolkitPro.dll_public:_void___thiscall_CXTPControlGalleryItem::constructor_void_]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 0
mov dword [esi], vtable.CGalleryTypeColor.0
mov dword [esi + 0x20], eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
push eax
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x58], eax
neg eax
sbb eax, eax
mov dword [esi + 0x5c], ecx
and eax, 2
neg ecx
sbb ecx, ecx
and ecx, 2
lea eax, [eax + ecx + 0xd]
mov edx, 0x11
push eax
push edx
mov ecx, esi
call dword [sym.imp.XTToolkitPro.dll_public:_void___thiscall_CXTPControlGalleryItem::SetSize_class_CSize_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x23a18f20
Capabilities:
Query service status

Disassembly:
mov eax, dword [esp + 4]
push edi
mov edi, ecx
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x23a18f3b
xor eax, eax
pop edi
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov esi, eax
push esi
push edx
push str.QueryServiceStatus_0x_08X__failed_with_0x_08X_error
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_char_const__]
add esp, 0xc
mov eax, esi
pop esi
pop edi
ret 4

Function at 0x23a1fb40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a46e08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x10]
call fcn.23a0fc10
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.23a1fa40
cmp byte [esp + 0x38], 0
je 0x23a1fb9c
test al, al
je 0x23a1fb9c
mov al, 1
jmp 0x23a1fb9e
xor al, al
mov edx, dword [esi]
mov edx, dword [edx + 0x170]
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call edx
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.23a0fb90
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4