joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x429ff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040b940
push 0x81
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.0040b9c0
test eax, eax
je 0x406082
mov eax, dword [esp + 0x10]
push 2
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov esi, eax
test esi, esi
je 0x406082
lea ecx, [esp + 8]
call fcn.0040f760
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
push ecx
push 8
lea ecx, [edi + 0x1a4]
call fcn.00425a50
test eax, eax
je 0x40603b
mov edx, dword [esi + 4]
push 0
push 0x8014
push edx
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 4]
push eax
push 0x8014
push 0
push ecx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [edi + 0xb8]
lea edx, [esp + 0x14]
push edx
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 4]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
push edi
push edx
push eax
push 2
mov ecx, esi
call sub.MFC42.DLL_CMenu::TrackPopupMenu
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call fcn.00428ee4
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040b970
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4061d0
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x42a02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
lea ecx, [esp]
call fcn.0040f760
mov eax, str.control_mmsys.cpl
mov dword [esp + 0xf4], 0
test eax, eax
je 0x406213
push str.control_mmsys.cpl
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.control_mmsys.cpl
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::AssignCopy
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x5c]
cmp eax, 4
jne 0x40624c
cmp dword [esp + 0x60], 0x5a
jne 0x406270
push 0x4374c8
jmp 0x406267
jbe 0x406270
cmp eax, 5
jne 0x406262
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x406262
push 0x4374c8
jmp 0x406267
push 0x4374c4
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_1
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0x44
mov word [esp + 0x6c], 5
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 4]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00428ee4
mov ecx, dword [esp + 0xf0]
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x40b9c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push eax
call fcn.0040f850
add esp, 4
mov ebp, eax
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [esp + 0x14]
mov edi, dword [eax + 8]
and esi, 0xffff
push ebp
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x40ba1a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectA]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CMenu::Attach
test eax, eax
jne 0x40ba32
push esi
push 4
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CMenu::Attach
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x40bb00
Capabilities:
Check os version

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0xa8]
push str.Unknown
mov ecx, ebp
mov dword [esi + 8], edi
call fcn.00428fc8
lea ebx, [esi + 0xc]
mov dword [esi + 4], edi
mov ecx, 0x27
xor eax, eax
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebx], 0x9c
call edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40bb4f
push ebx
mov dword [ebx], 0x94
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
sub ecx, 0
mov dword [esi + 4], eax
je 0x40bcd7
dec ecx
je 0x40bc56
dec ecx
je 0x40bb81
push str.Undetermined
mov ecx, ebp
call fcn.00428fc8
jmp 0x40bcea
mov eax, dword [esi + 0x10]
sub eax, 3
je 0x40bc3e
dec eax
je 0x40bc26
dec eax
je 0x40bba8
push str.Undetermined
mov ecx, ebp
call fcn.00428fc8
jmp 0x40bcea
mov eax, dword [esi + 0x14]
sub eax, 0
je 0x40bc0e
dec eax
je 0x40bbc4
push str.Undetermined
mov ecx, ebp
call fcn.00428fc8
jmp 0x40bcea
push str.WinXP
mov ecx, ebp
call fcn.00428fc8
mov eax, dword [esp + 0x10]
mov dword [esi + 8], 4
test eax, eax
je 0x40bcea
test byte [esi + 0xa5], 2
je 0x40bbfd
push str._Home_Edition
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
jmp 0x40bcea
push str._Professional
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
jmp 0x40bcea
push str.Win2000
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 3
jmp 0x40bcea
push str.WinNT4
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 2
jmp 0x40bcea
push str.WinNT_3.51
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 1
jmp 0x40bcea
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x40bcc2
cmp ecx, 0xa
je 0x40bc8a
cmp ecx, 0x5a
je 0x40bc75
push str.Undetermined
mov ecx, ebp
call fcn.00428fc8
jmp 0x40bcea
push str.WinME
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 8
jmp 0x40bcea
cmp eax, 0x7ce
jne 0x40bca6
push str.Win98
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 6
jmp 0x40bcea
cmp eax, 0x8ae
jb 0x40bcea
push str.Win98SE
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 7
jmp 0x40bcea
push str.Win95
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 5
jmp 0x40bcea
push str.Win31
mov ecx, ebp
call fcn.00428fc8
mov dword [esi + 8], 9
mov al, byte [esi + 0x20]
add esi, 0x20
test al, al
je 0x40bd08
push 0x437510
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push esi
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40c140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42aa48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x42e14c
mov dword [esp + 0x18], 0
call fcn.0040c290
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov edi, dword [esi + 0x2c]
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
jne 0x40c1c9
mov dword [esp + 8], 0x42e138
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
push ecx
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
test eax, eax
jne 0x40c20c
mov dword [esp + 8], 0x42e138
lea ecx, [esp + 8]
mov dword [esp + 0x18], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
neg eax
sbb eax, eax
and eax, edx
test esi, esi
jne 0x40c222
xor ecx, ecx
jmp 0x40c225
mov ecx, dword [esi + 4]
push 3
push eax
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
test eax, eax
mov dword [esp + 8], 0x42e138
jne 0x40c263
lea ecx, [esp + 8]
mov dword [esp + 0x18], 3
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 8]
mov dword [esp + 0x18], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40c2d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, edx
jne 0x40c2e8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [ecx + 0x10]
mov edi, eax
imul eax, edx
imul edi, esi
mov esi, dword [esp + 0x18]
lea ebx, [edi + esi]
cmp ebx, eax
jl 0x40c307
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, esi
lea edi, [eax + ebx*4]
mov eax, dword [esp + 0x1c]
cmp esi, eax
jge 0x40c347
mov ebp, dword [ecx + 0x28]
cmp ebp, dword [edi]
jne 0x40c2fe
inc edx
add edi, 4
cmp edx, eax
jl 0x40c31a
cmp esi, eax
jge 0x40c347
sub eax, esi
lea edx, [ebx*4]
mov esi, eax
mov eax, dword [ecx + 0x24]
add eax, edx
add edx, 4
mov ebx, dword [eax]
xor ebx, 1
dec esi
mov dword [eax], ebx
jne 0x40c335
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x40ce20
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x42ac60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
push esi
push edi
push eax
push 1
push 0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CPen::CPen
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], 0
push ecx
push 1
push 0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CPen::CPen
mov edi, dword [esp + 0x34]
lea edx, [esp + 0x14]
push edx
mov ecx, edi
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CDC::SelectObject
mov esi, dword [esp + 0x38]
mov ebx, eax
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
dec eax
push eax
push ecx
push edx
mov ecx, edi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
dec eax
push edx
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
dec edx
dec eax
push edx
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
dec ecx
dec edx
push ecx
push edx
mov ecx, edi
call sub.MFC42.DLL_CDC::LineTo
push ebx
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov esi, 0x42e138
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0xc], 0x42e124
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 3
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x40f180
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x40f2b6
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x400
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CSliderCtrl::GetRange
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0xd8]
sub edx, ecx
test eax, eax
mov dword [esp + 8], edx
je 0x40f248
mov eax, dword [esi + 0x190]
mov edx, dword [esi + 0x5c]
mov edi, dword [esi + 0x188]
sub eax, edx
sub eax, edi
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fidiv dword [esp + 8]
fimul dword [esp + 0xc]
fadd dword [0x42eb8c]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x28]
add eax, edi
pop edi
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x5c]
add edx, eax
mov dword [ecx + 0xc], edx
mov eax, dword [esi + 0x58]
cdq
sub eax, edx
mov edx, dword [esi + 0x184]
sar eax, 1
sub edx, eax
lea eax, [edx + 2]
mov dword [ecx], eax
mov edx, dword [esi + 0x58]
add edx, eax
pop esi
mov dword [ecx + 8], edx
add esp, 0x1c
ret 4
mov eax, dword [esi + 0x18c]
mov edi, dword [esi + 0x184]
mov edx, dword [esi + 0x58]
sub eax, edi
sub eax, edx
mov ecx, dword [esi + 0x188]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x5c]
fild dword [esp + 0x10]
cdq
fidiv dword [esp + 8]
mov edi, dword [esp + 0x28]
sub eax, edx
sar eax, 1
sub ecx, eax
lea eax, [ecx + 2]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x5c]
add edx, eax
mov dword [edi + 0xc], edx
fild dword [esp + 0xc]
fmul st(1)
fadd dword [0x42eb8c]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esi + 0x184]
add eax, ecx
mov dword [edi], eax
mov edx, dword [esi + 0x58]
add edx, eax
mov dword [edi + 8], edx
pop edi
fstp st(0)
pop esi
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x40fd90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ae20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 8]
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
test edi, edi
je 0x40fe98
mov ecx, dword [ebp + 0xc]
mov eax, ecx
and ecx, 0xf
shr eax, 4
inc eax
mov edi, ecx
mov ecx, dword [ebp + 8]
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x40fe98
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40fe98
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40fe98
test edi, edi
jle 0x40fe21
xor edx, edx
dec edi
mov dx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40fe15
xor edi, edi
mov di, word [esi]
add esi, 2
test edi, edi
jle 0x40fe98
lea eax, [edi + edi + 2]
mov dword [ebp - 4], 0
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov word [ebx + edi*2], 0
push ebx
call sub.MFC42.DLL_CString::operator_2
test ebx, ebx
je 0x40fe72
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410d26
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42b04a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x20]
mov dword [esp + 8], esi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 0xc
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x14], 0xd
mov dword [esi], 0x42edf8
call fcn.00410f50
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4160a0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x104]
call fcn.0041b810
test eax, eax
je 0x4160f7
push 0
push 4
push 0
push 0
push esi
push 0x416100
mov dword [esi + 0x6c], 0xfffffffe
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x120], eax
je 0x4160f7
mov dword [eax + 0x28], 1
mov eax, dword [esi + 0x120]
mov dword [esi + 0xb0], 0
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret

Function at 0x416240
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x120]
test eax, eax
je 0x41629b
mov ecx, dword [esi + 0x104]
lea eax, [esp + 4]
push 1
push eax
mov dword [esi + 0xb0], 1
call fcn.0041b980
mov eax, dword [esi + 0x120]
test eax, eax
je 0x41629b
mov ecx, dword [eax + 0x2c]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esi + 0x120]
test esi, esi
je 0x41629b
mov edx, dword [esi + 0x2c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
Function at 0x417a84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42b6f7
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
mov ebx, dword [esp + 0xcc]
push ebp
push esi
mov esi, ecx
push edi
push ebx
mov dword [esi + 0x40], ebx
call fcn.00417610
push ebx
mov ecx, esi
mov dword [esi + 0x44], eax
call fcn.004178d0
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
je 0x417c6c
mov ecx, esi
call fcn.00417c90
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push 0x70
mov dword [esp + 0xd0], 0
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov byte [esp + 0xcc], 1
je 0x417ae8
mov ecx, eax
call fcn.00412240
mov edi, eax
jmp 0x417aea
xor edi, edi
test edi, edi
mov byte [esp + 0xcc], 0
je 0x417c58
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x44]
push 0xffffffffffffffff
push eax
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
mov ecx, edi
call fcn.004125c0
mov ebp, dword [esp + 0xd4]
test eax, eax
je 0x417b52
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x20]
push eax
push 0
push 0x180
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0x74]
mov ebx, eax
push edx
push ebx
mov ecx, ebp
call sub.MFC42.DLL_CCheckListBox::SetCheck
mov eax, dword [ebp + 0x20]
push 0xffffffffffffffff
push ebx
push 0x19a
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x48]
xor ebx, ebx
lea ecx, [esp + 0x1c]
push ebx
push ecx
push edx
mov dword [esp + 0x28], 0xa8
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.WINMM.dll_mixerGetLineInfoA]
cmp eax, ebx
jne 0x417c58
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x417c58
lea eax, [esi + 0x78]
mov dword [esp + 0x18], eax
push 0x70
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0xcc], 2
je 0x417bc3
mov ecx, eax
call fcn.00412240
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x417bcf
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x14]
test edi, edi
mov byte [esp + 0xcc], 0
je 0x417c58
mov ecx, dword [esi + 0x48]
mov edx, dword [esi + 0x44]
mov eax, dword [esp + 0xd8]
push ebx
push ecx
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, edi
call fcn.004125c0
test eax, eax
je 0x417c38
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x20]
push edx
push 0
push 0x180
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x18]
mov edi, eax
mov edx, dword [ecx]
mov ecx, ebp
push edx
push edi
call sub.MFC42.DLL_CCheckListBox::SetCheck
mov eax, dword [ebp + 0x20]
push ebx
push edi
push 0x19a
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [esp + 0x14]
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
inc ebx
add ecx, 4
cmp ebx, eax
mov dword [esp + 0x18], ecx
jl 0x417b9a
lea ecx, [esp + 0x10]
mov dword [esp + 0xcc], 0xffffffff
call fcn.00428ee4
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret 8
Function at 0x41ba50
Capabilities:
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x42bd37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00428ecc
lea ebx, [esi + 0x4c]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0x50]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x54]
mov byte [esp + 0x1c], 2
call fcn.0040f760
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 3
call fcn.0041b780
push 0x43828c
mov ecx, ebp
mov byte [esp + 0x20], 4
mov dword [esi], 0x42f530
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
call fcn.00428fc8
push 0x43828c
mov ecx, ebx
call fcn.00428fc8
push 0x117
lea ecx, [esi + 0x54]
call fcn.0040f770
call sub.MFC42.DLL_AfxGetModuleState
push 0x1ca
push 0xe
push 0x1ca
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.USER32.dll_LoadIconA]
push eax
call ebx
mov dword [esi + 0x68], eax
call sub.MFC42.DLL_AfxGetModuleState
push 0x1cb
push 0xe
push 0x1cb
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call ebx
mov dword [esi + 0x6c], eax
call sub.MFC42.DLL_AfxGetModuleState
push 0x1c9
push 0xe
push 0x1c9
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call ebx
push edi
push edi
mov ecx, esi
mov dword [esi + 0x70], eax
mov dword [esi + 0x48], edi
call fcn.0041c330
test eax, eax
je 0x41bb73
mov ecx, esi
call fcn.0041bc80
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41be10
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push 0
push 0
push esi
push 0x41beb0
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x78], eax
jne 0x41be2f
pop esi
ret
mov dword [eax + 0x28], 1
mov eax, dword [esi + 0x78]
mov dword [esi + 0x64], 1
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret

Function at 0x41be60
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push 0
push 0
push esi
push 0x41c060
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x74], eax
jne 0x41be7f
pop esi
ret
mov dword [eax + 0x28], 1
mov eax, dword [esi + 0x74]
mov dword [esi + 0x60], 1
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret

Function at 0x41c4c0
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push 0
push 0
push esi
push 0x41c3e0
mov dword [esi + 0x5c], 0
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x41c4e6
pop esi
ret
mov dword [eax + 0x28], 1
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x5c], 1
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret