joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
mov esi, ecx
call fcn.004103f0
push 0x18
xor ebx, ebx
push str.AlertsFlags
push 0x5812a0
mov dword [esi + 0x9938], ebx
mov dword [esi], 0x5665b8
call fcn.00429030
add esp, 0xc
mov dword [esi + 0x90], eax
mov dword [esi + 0x8c], eax
lea eax, [esp + 0xc]
push 0x5965b8
push str._sprofiles_alerts.ini
push 0xff
push eax
mov dword [esi + 0xc4], 1
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x40df8d
mov eax, dword [esi + 0x9938]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edi
lea edx, [eax + eax*8]
push 1
push 0x250
lea eax, [eax + edx*4]
shl eax, 4
lea ecx, [eax + esi + 0x2e8]
push ecx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x40df76
mov eax, dword [esi + 0x9938]
lea edx, [eax + eax*8]
lea eax, [eax + edx*4]
shl eax, 4
mov byte [eax + esi + 0x2f3], bl
mov eax, dword [esi + 0x9938]
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
shl edx, 4
mov byte [edx + esi + 0x514], bl
mov eax, dword [esi + 0x9938]
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
shl edx, 4
mov dword [edx + esi + 0x528], ebx
mov eax, dword [esi + 0x9938]
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
shl edx, 4
mov dword [edx + esi + 0x530], ebx
mov edx, dword [esi + 0x9938]
inc edx
mov eax, edx
mov dword [esi + 0x9938], edx
cmp eax, 0x40
jge 0x40df76
lea ecx, [eax + eax*8]
push edi
push 1
push 0x250
lea edx, [eax + ecx*4]
shl edx, 4
lea eax, [edx + esi + 0x2e8]
push eax
call ebp
add esp, 0x10
cmp eax, 1
je 0x40dee3
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x40dfc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x40]
mov dword [esi], 0x5665b8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5965b8
push str._sprofiles_alerts.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x40e03f
mov eax, dword [esi + 0x9938]
test eax, eax
jle 0x40e035
lea edx, [eax + eax*8]
push edi
push 1
lea ecx, [esi + 0x2e8]
lea eax, [eax + edx*4]
shl eax, 4
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x90]
cmp ecx, eax
je 0x40e069
push eax
push str.AlertsFlags
push 0x5812a0
call fcn.00428f00
add esp, 0xc
mov ecx, esi
call fcn.00410510
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x412c80
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x412c99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esp + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x412cd8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push 0x80
push ecx
push 0
push 3
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x412cd8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, 0xffffffff
pop esi
setne al
ret 0xc

Function at 0x412cf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [ecx + 4]
mov dword [esp], 0
cmp eax, 0xffffffff
je 0x412d30
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x412d30
mov edx, dword [esp + 0xc]
cmp edx, 1
jb 0x412d30
push esi
lea esi, [esp + 4]
push 0
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop esi
je 0x412d30
mov eax, dword [esp]
pop ecx
ret 8
xor eax, eax
pop ecx
ret 8

Function at 0x412d40
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [ecx + 4]
mov dword [esp], 0
cmp eax, 0xffffffff
je 0x412d80
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x412d80
mov edx, dword [esp + 0xc]
cmp edx, 1
jb 0x412d80
push esi
lea esi, [esp + 4]
push 0
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
je 0x412d80
mov eax, dword [esp]
pop ecx
ret 8
xor eax, eax
pop ecx
ret 8

Function at 0x4221a0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x140
push esi
push edi
xor edi, edi
test eax, eax
jl 0x42229a
cmp eax, 0x63
jg 0x42229a
mov esi, dword [esp + 0x150]
test esi, esi
je 0x42229a
mov eax, dword [esp + 0x154]
test eax, eax
jle 0x42229a
push ebp
push 0x5965b8
dec eax
push str._s_templates.tpl
push eax
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x422285
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x10], 0x10
jne 0x422222
cmp edi, dword [esp + 0x154]
je 0x422235
inc edi
lea ecx, [esp + 0x10]
push ecx
push ebp
call ebx
test eax, eax
je 0x42227d
cmp edi, 0x40
jl 0x422211
jmp 0x42227d
lea edx, [esp + 0x3c]
push 0xfa
push edx
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
movsx eax, byte [esi]
push eax
mov byte [esi + 0xfa], 0
call dword [sym.imp.MSVCRT.dll_toupper]
mov byte [esi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
test ecx, ecx
jle 0x422279
cmp byte [ecx + esi], 0x2e
je 0x422279
dec ecx
test ecx, ecx
jg 0x42226e
mov byte [ecx + esi], 0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov cl, byte [esi]
xor eax, eax
test cl, cl
pop ebp
pop edi
setne al
pop esi
add esp, 0x140
ret 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x140
ret 0xc
Function at 0x429030
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x429053
mov eax, dword [esp + 8]
test eax, eax
je 0x429053
mov edx, dword [esp + 0xc]
push 0x593a90
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x429060
Capabilities:
Read .ini file

Disassembly:
mov edx, dword [esp + 4]
mov byte [0x593890], 0
test edx, edx
je 0x429097
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x429097
mov eax, dword [esp + 0xc]
test eax, eax
je 0x429097
push 0x593a90
push 0x1ff
push 0x593890
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 0x593890
ret

Function at 0x4290a0
Capabilities:
Read .ini file

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
test ecx, ecx
push esi
mov byte [esp + 0xa], 0x20
mov byte [esp + 0xb], 0
je 0x42918d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42918d
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x42918d
mov esi, dword [esp + 0x1c]
cmp esi, 1
jl 0x42918d
push edi
push 0x593a90
push 0x1ff
lea edx, [esp + 0x16]
push 0x593890
push edx
push eax
push ecx
mov byte [0x593890], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x593890
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp eax, esi
jle 0x42911f
mov eax, esi
xor edx, edx
push ebx
test eax, eax
jle 0x429188
mov esi, 0x593891
mov cl, byte [esi - 1]
cmp cl, 0x30
jl 0x42913d
cmp cl, 0x39
jg 0x42913d
add cl, 0xd0
jmp 0x42914a
cmp cl, 0x41
jl 0x42914a
cmp cl, 0x46
jg 0x42914a
add cl, 0xc9
cmp cl, 0x10
jge 0x429188
shl cl, 4
mov byte [edx + ebp], cl
mov cl, byte [esi]
cmp cl, 0x30
jl 0x429166
cmp cl, 0x39
jg 0x429166
add cl, 0xd0
jmp 0x429173
cmp cl, 0x41
jl 0x429173
cmp cl, 0x46
jg 0x429173
add cl, 0xc9
cmp cl, 0x10
jge 0x429188
mov bl, byte [edx + ebp]
add esi, 2
or bl, cl
mov byte [edx + ebp], bl
inc edx
cmp edx, eax
jl 0x42912b
pop ebx
pop esi
pop ebp
pop ecx
ret
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x429260
Capabilities:
Delete directory

Disassembly:
sub esp, 0x12c
lea ecx, [esp + 0x10]
push ebp
push esi
push edi
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x13c]
xor edi, edi
test esi, esi
je 0x4293c4
mov ebp, dword [esp + 0x140]
test ebp, ebp
je 0x4293c4
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
push ebp
push esi
push str._s_s
lea eax, [esp + 0x48]
push 0xff
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x3c]
push edi
push ecx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFileFind::FindFile
cmp eax, 1
jne 0x42939d
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_CFileFind::IsDots
cmp eax, 1
je 0x429392
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x40]
cmp eax, 1
jne 0x429340
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push eax
push esi
push str._s_s
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
push ebp
push edx
call fcn.00429260
add esp, 8
add edi, eax
jmp 0x429392
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CFileFind::GetFileName
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push esi
push str._s_s
push 0xff
push edx
call ebx
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 0x18
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp dword [esp + 0x18], 1
je 0x4292d0
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
call fcn.005628e4
lea eax, [edi + 1]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x12c
ret
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call fcn.005628e4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x12c
ret

Function at 0x4294e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
test eax, eax
push edi
mov dword [esp + 8], 0xfa
je 0x42954f
mov edi, dword [esp + 0x18]
test edi, edi
je 0x42954f
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x42954f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push eax
push edx
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42954f
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x429555
mov byte [esi], 0
pop edi
xor eax, eax
pop esi
pop ecx
ret
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x429560
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x118]
push esi
xor esi, esi
mov dword [esp + 8], 0xfa
test eax, eax
je 0x42962c
mov edx, dword [esp + 0x118]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42962c
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov eax, dword [esp + 0xc]
push esi
push esi
lea ecx, [esp + 0x18]
push esi
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push eax
call edi
test eax, eax
jne 0x429620
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x1c]
push str.Settings
push ecx
call ebp
add esp, 8
test eax, eax
je 0x4295f5
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x4295f6
inc esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x30], 0xfa
call edi
test eax, eax
je 0x4295ce
pop ebp
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x110
ret
Function at 0x429870
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x42990e
mov edi, dword [esp + 0x14]
cmp edi, 1
jle 0x42990e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push edi
push esi
push 0x1002
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42990e
mov eax, str.Control_PanelInternational
mov dword [esp + 0x14], 0xfa
test eax, eax
je 0x42990e
mov ecx, str.sCountry
test ecx, ecx
je 0x42990e
lea edx, [esp + 0x10]
mov byte [esi], 0
push edx
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42990e
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push str.sCountry
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x42990e
mov byte [esi], 0
mov eax, esi
pop edi
pop esi
pop ecx
ret

Function at 0x429920
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov al, byte [ebx]
not ecx
dec ecx
test al, al
jne 0x429941
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp byte [ecx + ebx - 1], 0x5c
jne 0x42994d
mov byte [ecx + ebx - 1], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
call edi
cmp eax, 0xffffffff
jne 0x4299b1
test ebx, ebx
mov esi, ebx
je 0x429995
mov ebp, dword [sym.imp.MSVCRT.dll_strchr]
push 0x5c
push esi
call ebp
mov esi, eax
add esp, 8
test esi, esi
je 0x429995
push ebx
mov byte [esi], 0
call edi
cmp eax, 0xffffffff
jne 0x42998d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4299aa
mov byte [esi], 0x5c
inc esi
test esi, esi
jne 0x429967
push ebx
call edi
cmp eax, 0xffffffff
jne 0x4299b1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4299b1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x42af70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
mov edi, dword [esp + 0x21c]
test edi, edi
je 0x42b141
mov ebx, dword [esp + 0x224]
test ebx, ebx
je 0x42b141
mov eax, dword [esp + 0x228]
test eax, eax
je 0x42b141
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x42b141
mov esi, dword [esp + 0x230]
test esi, esi
je 0x42b141
mov eax, str.Settings
mov byte [0x593890], 0
test eax, eax
je 0x42b008
mov ecx, 0x5937a0
test ecx, ecx
je 0x42b008
push 0x593a90
push 0x1ff
push 0x593890
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x593890
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
jne 0x42b042
mov eax, dword [esp + 0x228]
lea ecx, [esp + 0x10]
push eax
push 0x5965b8
push str._s_s
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x42b08a
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReverseFind
test eax, eax
jl 0x42b05d
push 0
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::SetAt
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0x10]
push 0
push ebp
push 6
push eax
push esi
push 0
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFileDialog::CFileDialog
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x42b12c
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileDialog::GetPathName
mov esi, dword [esp + 0x220]
mov eax, dword [eax]
push esi
push eax
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov edx, str.Settings
mov byte [edi + esi], 0
test edx, edx
je 0x42b0f5
push 0x593a90
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0xcc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret
lea ecx, [esp + 0xcc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
Function at 0x42cdd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, ecx
push ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0x1c], 1
jne 0x42cfb5
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x42cfb5
push esi
push edi
lea edi, [ebx + 0x40]
mov esi, ebx
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x42ce29
test al, al
je 0x42ce25
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x42ce29
add esi, 2
add edi, 2
test al, al
jne 0x42ce01
xor eax, eax
jmp 0x42ce2e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42cfa5
push ebx
push 0x5965b8
push str._sconfig_s.srv
lea eax, [esp + 0x28]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x30]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x1c
test esi, esi
mov dword [esp + 0x10], esi
je 0x42cfa5
push esi
push 1
push 0x160
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [ebx + 0xd4]
add esp, 0x10
test eax, eax
mov dword [esp + 0x14], 0
jle 0x42cf1f
xor ebp, ebp
mov edi, dword [ebx + 0xd0]
or ecx, 0xffffffff
add edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
cmp esi, 0x40
jae 0x42cece
call dword [sym.imp.MSVCRT.dll_rand]
mov edx, dword [ebx + 0xd0]
add edx, ebp
inc esi
cmp esi, 0x40
mov byte [edx + esi - 1], al
jb 0x42ceb6
mov eax, dword [ebx + 0xd0]
or ecx, 0xffffffff
lea edi, [eax + ebp + 0x44]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
cmp esi, 0x40
jae 0x42cf02
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebx + 0xd0]
add ecx, ebp
inc esi
cmp esi, 0x40
mov byte [ecx + esi + 0x43], al
jb 0x42ceea
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0xd4]
inc eax
add ebp, 0xa0
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x42ce9c
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0xd4]
lea edx, [eax + eax*4]
shl edx, 5
push edx
call fcn.004c2e90
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x42cf97
mov eax, dword [ebx + 0xd4]
mov esi, dword [ebx + 0xd0]
mov edi, ebp
lea ecx, [eax + eax*4]
shl ecx, 5
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0xd4]
mov ecx, ebp
lea edx, [eax + eax*4]
shl edx, 5
call fcn.00433990
mov eax, dword [ebx + 0xd4]
mov ecx, dword [esp + 0x10]
push ecx
push 1
lea edx, [eax + eax*4]
shl edx, 5
push edx
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call fcn.004c2eb0
mov esi, dword [esp + 0x24]
add esp, 0x14
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ebp, dword [esp + 0x1c]
add esp, 4
mov ebx, dword [ebx + 0x15c]
test ebx, ebx
jne 0x42cdfc
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x42e140
Capabilities:
Create thread

Disassembly:
sub esp, 0x30c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov edi, ecx
push eax
mov ecx, 0x593d48
call fcn.0042f040
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.0042d8e0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x42e268
cmp byte [esp + 0x31c], bl
jne 0x42e1e2
cmp dword [esi + 0xd4], 2
jl 0x42e19d
push ebx
call dword [sym.imp.MSVCRT.dll_time]
mov edx, dword [esi + 0x118]
add esp, 4
sub eax, edx
cmp eax, 0xe10
jge 0x42e1e2
mov eax, dword [esi + 0xd0]
cmp eax, ebx
je 0x42e1b6
push eax
call fcn.004c2eb0
add esp, 4
mov dword [esi + 0xd0], ebx
mov ecx, dword [esi + 0x15c]
cmp ecx, ebx
je 0x42e1cd
push 1
call fcn.0040ae20
mov dword [esi + 0x15c], ebx
push esi
call fcn.004c2eb0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x30c
ret 4
mov eax, dword [esi + 0xd0]
cmp eax, ebx
je 0x42e1fb
push eax
call fcn.004c2eb0
add esp, 4
mov dword [esi + 0xd0], ebx
mov ecx, dword [esi + 0x15c]
cmp ecx, ebx
je 0x42e212
push 1
call fcn.0040ae20
mov dword [esi + 0x15c], ebx
push esi
call fcn.004c2eb0
mov eax, dword [edi + 0x20]
add esp, 4
cmp eax, ebx
je 0x42e245
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
je 0x42e245
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x20], ebx
cmp dword [edi + 0x20], ebx
jne 0x42e268
lea ecx, [esp + 0xc]
push ecx
push ebx
push edi
push 0x42e280
push 0x3e800
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x20], eax
pop edi
pop esi
pop ebx
add esp, 0x30c
ret 4
Function at 0x42ea30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
mov esi, ecx
call fcn.0042ed10
mov ecx, esi
call fcn.0042f830
mov ecx, esi
call fcn.0042fa30
mov ecx, esi
call fcn.0042f570
mov ecx, esi
call fcn.0042fc20
mov ecx, esi
call fcn.0042f130
mov ecx, esi
call fcn.0042fd10
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 0x1668]
mov ecx, 0x46
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigobjects.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x42eadc
push edi
push 1
push 0x118
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42ead2
mov dword [ebx], 0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebx], 0x190
je 0x42eaf9
mov ecx, 0x46
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x1678], 0xa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
call fcn.0042ffa0
pop edi
pop esi
pop ebx
add esp, 0x100
ret