joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2e68
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f303a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00406584
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x506908]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.00480ad4
test eax, eax
jne 0x4f301f
xor eax, eax
push ebp
push 0x4f3014
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.004921f8
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x4f2ef9
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x4f2f26
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x4f2f48
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x4f2fbe
sub eax, 0xe9
je 0x4f2f62
sub eax, 0x19
je 0x4f2ffd
jmp 0x4f2fb7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f2f79
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x4f2f8c
call fcn.00404b68
jmp 0x4f301f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4f2fa3
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406584
jmp 0x4f2eed
call fcn.00404b68
jmp 0x4f301f
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.004921f8
lea eax, [ebp - 4]
call fcn.00406eb8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00406584
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.004a3388
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00490390
inc ebx
jmp 0x4f2eed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f301b
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3041
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4f8a5c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f8ae0
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4f8ac8
mov ebx, esi
test ebx, ebx
je 0x4f8a8e
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004064d4
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4f8afc
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x4f8aca
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8ae7
lea eax, [ebp - 8]
call fcn.00406438
ret

Function at 0x4fd068
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fd1ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4fd1c4
mov edx, ebx
call fcn.00406914
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4fd185
xor eax, eax
push ebp
push 0x4fd17e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4fd1e0
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040e498
test eax, eax
jne 0x4fd14f
test byte [ebp - 0x258], 0x10
jne 0x4fd14f
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406640
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406914
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x4fd141
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4fd0d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd185
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd1b2
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fd1ec
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4fd2ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0047f5d8
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4fd308
call fcn.0040e76c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4fd28c
test esi, 0x10
jne 0x4fd2bc
test esi, 1
je 0x4fd28c
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4fd2b6
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x4fd2c9
inc edi
cmp edi, 0xa
je 0x4fd2c9
inc ebx
cmp ebx, 0x3e8
jne 0x4fd22d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd2f3
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4fdd6c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fde14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fde30
push ebx
push 0x4fde40
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069f8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4fddf2
mov eax, dword [0x506e7c]
mov eax, dword [eax + 0x1a8]
call fcn.004fdcc4
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fde1b
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fe7b4
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fe9a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0048067c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00485ec0
test al, al
jne 0x4fe821
xor eax, eax
push ebp
push 0x4fe817
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004863b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fe821
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x50e16c]
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4fe850
mov eax, dword [0x506e7c]
mov eax, dword [eax + 0x1a4]
call fcn.004fdcc4
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x50ab50]
push eax
push 0
mov ecx, 0x4fe9b0
mov edx, 0x4fe9b4
xor eax, eax
call fcn.0040a124
mov dword [ebp - 8], eax
push 0x4fde84
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x50e198], eax
xor eax, eax
push ebp
push 0x4fe96b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x506e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00480050
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4fe9d0
call fcn.0040e76c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0047ff30
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406854
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fdd6c
mov dword [ebp - 0xc], eax
call fcn.004fde48
test al, al
jne 0x4fe94b
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4fe929
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe972
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x4ffcf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4fffaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x506e6c]
mov eax, dword [eax]
mov edx, 0x4fffc4
call fcn.0047c43c
push 5
mov eax, dword [0x506e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4fff71
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e1f64
lea eax, [ebp - 0x10]
call fcn.004804f4
mov eax, dword [ebp - 0x10]
call fcn.0040e218
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00480050
mov edx, dword [ebp - 0x14]
mov eax, 0x50e16c
call fcn.00406448
call fcn.004fe07c
lea ecx, [ebp - 0x18]
mov edx, 0x4fffe4
mov eax, dword [0x50e16c]
call fcn.0047f134
mov edx, dword [ebp - 0x18]
mov eax, 0x50e170
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x4ffffc
mov eax, dword [0x50e16c]
call fcn.0047f134
mov edx, dword [ebp - 0x1c]
mov eax, 0x50e174
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50e16c]
mov dl, 1
mov eax, dword [0x481d1c]
call fcn.0048205c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ffe48
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0048201c
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.00481ff4
cmp dword [ebp - 0xc], 0x67734d49
je 0x4ffe23
mov cl, 1
xor edx, edx
mov eax, dword [0x50e174]
call fcn.004832e0
jmp 0x4ffe32
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50e16c]
call fcn.004832e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffe4f
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5b6b4100
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1ab856b2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40aeb0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b078
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x50
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov esi, ecx
add eax, 0xfffff830
mov ecx, eax
imul ecx, ecx, 0x1a4
push edi
lea edi, [ecx + esi]
mov cl, byte [edi + 0x1d0]
test cl, cl
jne 0x40af1e
test ebp, ebp
jne 0x40af1e
mov edx, dword [edi + 0xc0]
push 1
push ebp
push edx
mov byte [edi + 0x1d0], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret 8
test eax, eax
jl 0x40b076
mov ecx, dword [esi + 0x52b0]
cmp eax, ecx
jge 0x40b076
cmp eax, ecx
jge 0x40b071
mov edx, dword [esi + 0x52ac]
shl eax, 6
add eax, edx
push eax
lea ecx, [esp + 0x20]
call fcn.00407e80
cmp dword [esp + 0x28], 0x22
mov dword [esp + 0x64], 0
jne 0x40b00e
mov eax, dword [esi + 0x546c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40af7f
lea eax, [esp + 0xc]
push eax
call fcn.00409c40
test al, al
jne 0x40af91
mov edx, dword [edi + 0xc0]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
add eax, 4
mov dword [esp + 0xc], eax
add eax, 0x7d
mov dword [esp + 0x10], ecx
add ecx, 0x7d
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x18], ecx
push eax
mov ecx, esi
call fcn.0040a530
mov ecx, dword [sym.imp.MFC71.DLL_CWnd::wndTopMost]
push 3
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esi + 0x52bc]
call sub.MFC71.DLL_CWnd::SetWindowPos
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push 1
sub edx, eax
push edx
mov edx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esi + 0x52bc]
call sub.MFC71.DLL_CWnd::MoveWindow
mov ecx, dword [esi + 0x52bc]
push 5
call sub.MFC71.DLL_CWnd::ShowWindow
jmp 0x40b01f
mov ecx, dword [esi + 0x98]
push ebp
lea eax, [esp + 0x20]
push eax
call fcn.00414000
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x40b03f
mov ecx, dword [edi + 0xc0]
push 1
push 0
push ecx
mov byte [edi + 0x1d0], 0
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x34]
call dword [0x43f434]
lea ecx, [esp + 0x30]
call dword [0x43f434]
lea ecx, [esp + 0x2c]
call dword [0x43f434]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret 8
call fcn.00439dbc
mov edx, dword [str.ToolBar]
push eax
push str.Appointed_unjust_index____d_
push 0x64
push edx
push 0x7c
push 0x240
push str..DarwinToolBar.cpp
push 0
push 0x47f138
call dword [sym.imp.LogEx.dll_public_virtual:_void___cdecl_LOG::Logger::PrintLog_enum_LOG::MsgKind__char_const___unsigned_long_int__unsigned_short_int__char_const___int__char_const__]
mov ecx, dword [esp + 0x80]
add esp, 0x24
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x5c
ret 8
Function at 0x4120e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43b9c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::StringLength]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [0x43f434]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x412340
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x47f070]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x110], eax
push str.Menu.ini
add ecx, 4
push ecx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x100
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push str.menu
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0x110]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a16b
add esp, 0x108
ret 0xc

Function at 0x4123e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x47f070]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x110], eax
push str.ToolTip.ini
add ecx, 4
push ecx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x100
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push str.button_tooltip
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0x110]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a16b
add esp, 0x108
ret 0xc
Function at 0x412480
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x47f070]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x110], eax
push str.Menu.ini
add ecx, 4
push ecx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x100
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push str.rootname
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0x110]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a16b
add esp, 0x108
ret 0xc

Function at 0x412520
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x47f070]
xor eax, esp
push ebx
push esi
push edi
mov esi, ecx
push str.Measure.ini
mov dword [esp + 0x54], eax
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x441bbc
push str.length
push str.Footer
call ebx
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
lea ecx, [esi + 0x28]
call dword [0x43f528]
push str.Measure.ini
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x441ba8
push str.angle
push str.Footer
call ebx
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
lea ecx, [esi + 0x2c]
call dword [0x43f528]
push str.Measure.ini
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x441b9c
push str.area
push str.Footer
call ebx
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
lea ecx, [esi + 0x30]
call dword [0x43f528]
push str.Measure.ini
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004120e0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x441b90
push str.measure
push 0x441b80
call ebx
lea ecx, [esp + 0xc]
call dword [0x43f434]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCR71.dll_atoi]
add esp, 4
cmp eax, 2
jne 0x41268c
fld qword [str.ffffff9_Type]
pop edi
fstp qword [esi + 0x38]
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0043a16b
add esp, 0x48
ret
fld qword [0x43fe68]
mov ecx, dword [esp + 0x50]
pop edi
fstp qword [esi + 0x38]
pop esi
pop ebx
xor ecx, esp
call fcn.0043a16b
add esp, 0x48
ret