joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8e0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
dec eax
push ebp
push esi
cmp eax, 5
push edi
mov esi, ecx
ja case.0x40c8f5.4
jmp dword [eax*4 + 0x40ca6c]
lea ebx, [esi + 0x188]
push 0
mov ecx, ebx
call fcn.004203c0
lea ebp, [esi + 0x294]
push 0
mov ecx, ebp
call fcn.004203c0
lea edi, [esi + 0x7c]
push 1
mov ecx, edi
jmp 0x40c994
lea edi, [esi + 0x7c]
push 0
mov ecx, edi
call fcn.004203c0
lea ebp, [esi + 0x294]
push 0
mov ecx, ebp
call fcn.004203c0
lea ebx, [esi + 0x188]
push 1
mov ecx, ebx
jmp 0x40c994
lea edi, [esi + 0x7c]
push 0
mov ecx, edi
call fcn.004203c0
lea ebx, [esi + 0x188]
push 0
mov ecx, ebx
call fcn.004203c0
lea ebp, [esi + 0x294]
push 1
jmp 0x40c992
lea edi, [esi + 0x7c]
push 0
mov ecx, edi
call fcn.004203c0
lea ebx, [esi + 0x188]
push 0
mov ecx, ebx
call fcn.004203c0
lea ebp, [esi + 0x294]
push 0
mov ecx, ebp
call fcn.004203c0
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40c9e8
mov eax, dword [esp + 0x18]
xor edx, edx
shr eax, 4
div dword [esi + 0x68]
mov eax, dword [esi + 0x64]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40c9e8
mov ecx, dword [edx + 8]
mov eax, dword [esp + 0x18]
cmp ecx, eax
je 0x40c9c9
mov edx, dword [edx]
test edx, edx
jne 0x40c9b6
jmp 0x40c9e8
test edx, edx
je 0x40c9e8
mov edx, dword [edx + 0xc]
push 5
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x5c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x40ca11
lea ecx, [esp + 0x10]
push ecx
push eax
lea ecx, [esi + 0x60]
call fcn.0040d980
test eax, eax
je 0x40ca11
mov eax, dword [eax + 0xc]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x5c], edx
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + 0x20]
push 0
push ecx
push 0x1f59
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xf
push 0xf
mov ecx, edi
call fcn.00420050
push 0xf
push 0x4e
mov ecx, ebx
call fcn.00420050
push 0xf
push 0x8d
mov ecx, ebp
call fcn.00420050
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40cbf0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x440158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_1
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
push str.Config.ini
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 2
call fcn.00402e00
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push edx
push 0x12c
push 0x12c
mov byte [esp + 0x28], 4
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x453ea0
push str.HomePage
push str.QQBattleNet
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 0x3a0]
call fcn.00417100
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40e370
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push str.QQBattleNet_ActiveMainWin
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ebx, eax
mov eax, dword [esi + 0x2a8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x2a4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40e40f
mov eax, dword [esi + 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.QQBattle_MainFrame
push 0
push 0
mov dword [esi + 0x2a4], 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40e3e1
pop edi
pop esi
xor al, al
pop ebx
ret
mov ecx, esi
call fcn.0040f7f0
cmp eax, 2
push 0
jne 0x40e3ff
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
xor al, al
pop ebx
ret
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x40f7f0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push 0x446228
mov dword [esp + 8], 1
call fcn.0040ed70
mov esi, eax
add esp, 4
test esi, esi
je 0x40f82e
push edi
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push esi
call dword [edi + 0x1c]
mov eax, dword [esi]
lea ecx, [esp + 8]
push ecx
push esi
call dword [eax + 0x6c]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x4113f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
sub eax, 0x3f3
mov esi, ecx
je 0x4114e8
dec eax
je 0x411483
sub eax, 2
jne 0x41155a
push 0
lea ecx, [esi + 0x36c]
call fcn.004203c0
push 0
lea ecx, [esi + 0x478]
call fcn.004203c0
push 1
lea ecx, [esi + 0x584]
call fcn.004203c0
push 0
lea ecx, [esi + 0x7c]
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esi + 0x694]
test ecx, ecx
jne 0x41144d
xor eax, eax
jmp 0x411450
mov eax, dword [ecx + 0x20]
mov edx, dword [esi + 0x690]
push 0
cmp edx, eax
jne 0x411468
call sub.MFC42.DLL_CWnd::ShowWindow
push 1
jmp 0x411553
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, dword [esi + 0x690]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
jmp 0x411553
push 0
lea ecx, [esi + 0x36c]
call fcn.004203c0
push 1
lea ecx, [esi + 0x478]
call fcn.004203c0
push 0
lea ecx, [esi + 0x584]
call fcn.004203c0
push 5
lea ecx, [esi + 0x7c]
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esi + 0x694]
test ecx, ecx
jne 0x4114c2
xor eax, eax
jmp 0x4114c5
mov eax, dword [ecx + 0x20]
mov edx, dword [esi + 0x690]
push 0
cmp edx, eax
jne 0x4114d8
call sub.MFC42.DLL_CWnd::ShowWindow
jmp 0x411551
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [esi + 0x690]
push 0
push ecx
jmp 0x41154b
push 1
lea ecx, [esi + 0x36c]
call fcn.004203c0
push 0
lea ecx, [esi + 0x478]
call fcn.004203c0
push 0
lea ecx, [esi + 0x584]
call fcn.004203c0
push 0
lea ecx, [esi + 0x7c]
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esi + 0x694]
test ecx, ecx
jne 0x411527
xor eax, eax
jmp 0x41152a
mov eax, dword [ecx + 0x20]
cmp dword [esi + 0x690], eax
jne 0x41153b
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
jmp 0x411551
push 0
call sub.MFC42.DLL_CWnd::ShowWindow
mov edx, dword [esi + 0x690]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.00412110
push 0xf
push 0xf
lea ecx, [esi + 0x36c]
call fcn.00420050
push 0xf
push 0x4e
lea ecx, [esi + 0x478]
call fcn.00420050
pop esi
ret 4
Function at 0x411581
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esi
mov esi, ecx
test esi, esi
jne 0x41158c
xor eax, eax
jmp 0x41158f
mov eax, dword [esi + 0x20]
mov ebp, dword [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_SetParent]
lea eax, [esi + 0x694]
test eax, eax
je 0x4115a8
mov eax, dword [eax + 0x20]
mov ecx, dword [esi + 0x690]
cmp ecx, eax
je 0x4115bb
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push edi
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x9fc]
lea edi, [esi + 0x9f4]
xor eax, eax
xor edx, edx
div ecx
mov ecx, dword [edi + 4]
test ecx, ecx
mov ebx, edx
je 0x4115fe
mov eax, dword [ecx + ebx*4]
test eax, eax
je 0x4115fa
cmp dword [eax + 8], 1
je 0x4115f6
mov eax, dword [eax]
test eax, eax
jne 0x4115e8
jmp 0x4115fa
test eax, eax
jne 0x41162a
test ecx, ecx
jne 0x41160b
mov eax, dword [edi + 8]
push 1
push eax
mov ecx, edi
call fcn.0040d9c0
mov ecx, edi
call fcn.0040da30
mov dword [eax + 4], ebx
mov dword [eax + 8], 1
mov ecx, dword [edi + 4]
mov edx, dword [ecx + ebx*4]
mov dword [eax], edx
mov ecx, dword [edi + 4]
mov dword [ecx + ebx*4], eax
mov dword [eax + 0xc], ebp
mov eax, dword [esi + 0x9e4]
mov edx, dword [esi + 0x9ec]
mov ecx, dword [esi + 0x9e0]
sub edx, eax
push 1
push edx
mov edx, dword [esi + 0x9e8]
sub edx, ecx
push edx
push eax
push ecx
push ebp
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esi + 0x9f0]
pop edi
cmp eax, 1
pop ebx
je 0x411667
push 0
jmp 0x411669
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3f3
mov ecx, esi
mov dword [esi + 0x690], ebp
call fcn.004113f0
pop esi
pop ebp
ret 4

Function at 0x412030
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov esi, ecx
push 0
push ebx
mov dword [esi + 0x9d4], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x9fc]
lea edi, [esi + 0x9f4]
mov eax, 0x3f
xor edx, edx
div ecx
mov ecx, dword [edi + 4]
test ecx, ecx
mov ebp, edx
je 0x412087
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x412083
cmp dword [eax + 8], 0x3f6
je 0x41207f
mov eax, dword [eax]
test eax, eax
jne 0x41206e
jmp 0x412083
test eax, eax
jne 0x4120b3
test ecx, ecx
jne 0x412094
mov eax, dword [edi + 8]
push 1
push eax
mov ecx, edi
call fcn.0040d9c0
mov ecx, edi
call fcn.0040da30
mov dword [eax + 4], ebp
mov dword [eax + 8], 0x3f6
mov ecx, dword [edi + 4]
mov edx, dword [ecx + ebp*4]
mov dword [eax], edx
mov ecx, dword [edi + 4]
mov dword [ecx + ebp*4], eax
mov dword [eax + 0xc], ebx
mov eax, dword [esi + 0x9e4]
mov edx, dword [esi + 0x9ec]
mov ecx, dword [esi + 0x9e0]
sub edx, eax
push 1
push edx
mov edx, dword [esi + 0x9e8]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [esi + 0x9f0], 0x3f6
je 0x4120ef
push 0
jmp 0x4120f1
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00410ef0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x412110
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00412150
test eax, eax
je 0x412144
mov eax, dword [esi + 0x9d4]
test eax, eax
je 0x412144
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x41213b
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4

Function at 0x4123e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push 0x440bf8
push eax
mov dword fs:[0], esp
sub esp, 0x44
test edx, edx
push ebp
je 0x412522
mov ebp, dword [esp + 0x60]
test ebp, ebp
je 0x412522
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x14]
lea esi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x6c]
mov cl, byte [esp + 0x7c]
mov dword [esp + 0x14], eax
mov byte [esp + 0x28], cl
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, esi
mov dword [esp + 0x24], 0x2bc
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0
mov edx, ecx
mov esi, edi
mov edi, eax
mov dword [esp + 0xc], 0x4453e0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x60]
lea ecx, [esp + 0x14]
push esi
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x60], 0
call sub.MFC42.DLL_CFont::CreatePointFontIndirect
mov edx, dword [esi]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call dword [edx + 0x30]
push 1
mov ecx, esi
mov edi, eax
call sub.MFC42.DLL_CDC::SetBkMode
mov eax, dword [esp + 0x78]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x38]
push ebp
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x64]
mov edx, dword [esi]
mov byte [esp + 0x58], 1
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x74]
push eax
mov eax, dword [esp + 0x7c]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x64]
lea ecx, [esp + 0x64]
mov byte [esp + 0x58], 0
call sub.MFC42.DLL_CString::CString
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x30]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0xc], 0x444ed8
mov dword [esp + 0x58], 2
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 0x20
mov ecx, dword [esp + 0x48]
xor al, al
pop ebp
mov dword fs:[0], ecx
add esp, 0x50
ret 0x20
Function at 0x4153d0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x4153e5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x4153e7
xor eax, eax
mov ecx, dword [esi + 0x58]
pop esi
cmp ecx, 1
jne 0x4153fb
mov ecx, dword [eax + 0xe0]
jmp fcn.00407c00
cmp ecx, 2
jne 0x41540b
mov ecx, dword [eax + 0xe0]
jmp fcn.00407a90
cmp ecx, 3
jne 0x41541b
mov ecx, dword [eax + 0xe0]
jmp fcn.00407d70
cmp ecx, 4
jne 0x41542b
mov ecx, dword [eax + 0xe0]
jmp fcn.00407d80
cmp ecx, 5
jne 0x41543b
mov ecx, dword [eax + 0xe0]
jmp fcn.00407e40
ret

Function at 0x416290
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
lea eax, [esp]
push str._QBNET_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x40c]
lea ecx, [esp + 0x410]
push ecx
push edx
lea eax, [esp + 0x18]
push 0x3f8
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x18
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x400
ret

Function at 0x417e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4413c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [esp + 0x30]
push 0x2010
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov edi, eax
test edi, edi
je 0x417ead
push edi
mov ecx, esi
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
je 0x417ea6
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x417e9f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esp + 0x30]
mov dword [esi + 8], eax
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov ecx, esi
call sub.MFC42.DLL_CGdiObject::Detach
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x41f4e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x441ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0041fcb0
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call fcn.0041eb50
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov ecx, 6
xor eax, eax
lea edi, [esi + 0x18]
mov dword [esi], 0x447f54
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x420770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44206e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x14]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [ecx + 4], eax
mov dword [ecx], 0x4453e0
mov dword [esi + 0x1c], 0x4453f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0xa
push eax
push 0x4520b4
push 0x5a
mov byte [esp + 0x1c], 2
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_CFont::CreatePointFont
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x42bbd0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x30
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
test eax, eax
jne 0x42bbe6
mov al, 1
pop edi
add esp, 0x30
ret 8
push ebx
push ebp
push esi
push 0xd
mov dword [esp + 0x20], 9
xor esi, esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x20]
push esi
push esi
push 0x1200
push eax
mov byte [esp + 0x23], 1
call ebx
xor ebp, ebp
mov dword [esp + 0x18], eax
test eax, eax
jle 0x42bc71
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x1203
push edx
call ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
add esi, eax
mov eax, 1
shl eax, cl
test dword [edi + 0x48], eax
je 0x42bc68
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
sub edx, eax
cmp ecx, edx
jle 0x42bc68
add eax, esi
cmp ecx, eax
jge 0x42bc68
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x42bc21
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 8

Function at 0x42d770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x442e8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x38]
mov ecx, ebx
call sub.MFC42.DLL_CDC::CDC
lea edx, [esi + 0xc]
xor eax, eax
mov ecx, 0xb
mov edi, edx
mov dword [esi], 0x4486e8
push eax
rep stosd dword es:[edi], eax
push eax
lea eax, [esi + 8]
push eax
push 0
push edx
push 0
mov dword [esp + 0x30], 0
mov dword [edx], 0x28
mov dword [esi + 0x10], 0x1f4
mov dword [esi + 0x14], 0x32
mov word [esi + 0x18], 1
mov word [esi + 0x1a], 0x20
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push 0
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esi + 4]
test eax, eax
je 0x42d80d
mov ecx, dword [esi + 0x3c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x42d80f
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x48], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42dc27
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x442eeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x1c]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [esp + 0x1c], ebx
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov cx, word [esp + 0x24]
mov dword [esi + 0x14], eax
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], edx
mov word [esi + 4], bx
mov word [esi + 6], bx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x42dce6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x442f29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x448720
xor edi, edi
mov dword [esi + 4], 0x448718
mov dword [esp + 0x14], edi
mov ecx, 0x11
mov eax, 0xa
mov dword [esi + 8], 0x4459a0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], 0x448704
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 3
call fcn.00434f20
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edi
mov dword [esi + 0x24], edi
mov dword [esi], 0x4486f4
mov dword [esi + 4], 0x4486ec
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42f3c6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x443079
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x448764
xor edi, edi
mov dword [esi + 4], 0x44875c
mov dword [esp + 0x14], edi
mov ecx, 0x11
mov eax, 0xa
mov dword [esi + 8], 0x4459a0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], 0x448704
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 3
call fcn.00435190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edi
mov dword [esi + 0x24], edi
mov dword [esi], 0x44874c
mov dword [esi + 4], 0x448744
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x430570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4431a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov eax, 0x44734c
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov ebx, dword [sym.imp.GDI32.dll_CreateRectRgn]
push edi
push edi
push edi
push edi
mov byte [esp + 0x34], 1
call ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
cmp dword [esp + 0x30], edi
jle 0x430640
push ebp
mov ebp, dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [esp + 0x38]
xor esi, esi
test eax, eax
jle 0x430636
mov eax, dword [esp + 0x30]
push esi
push edi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [esp + 0x3c]
jne 0x43062d
lea ecx, [esi + 1]
lea edx, [edi + 1]
push ecx
push edx
push esi
push edi
call ebx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
mov edx, dword [esp + 0x14]
push 2
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x14]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
push edx
call ebp
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [esp + 0x38]
inc esi
cmp esi, eax
jl 0x4305d8
mov eax, dword [esp + 0x34]
inc edi
cmp edi, eax
jl 0x4305ce
pop ebp
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Detach
mov edi, 0x444ed8
mov esi, eax
mov dword [esp + 0xc], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0xc], 0x444eec
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 3
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10