joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4166f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7ba4
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x60], edi
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp + 8]
cmp ecx, 0x7ed
je 0x416899
cmp dword [edi + 0x90], 0xfffffffe
jne 0x416889
push edi
push 0x102
push dword [edi + 0xf0]
lea ecx, [ebp - 0x134]
mov dword [edi + 0x19c], 1
call sub.mfc140u.dll_CColorDialog::CColorDialog
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov esi, dword [edi + 0x1c0]
xor ebx, ebx
mov dword [ebp - 0x58], 4
mov byte [ebp - 4], 1
cmp dword [esi - 0xc], ebx
je 0x41679f
call sub.mfc140u.dll_AfxGetModuleState
push ebx
push esi
mov ecx, dword [eax + 4]
call sub.mfc140u.dll_CWinApp::GetSectionKey
mov ebx, eax
xor esi, esi
test ebx, ebx
jne 0x4167af
mov dword [ebp + esi*4 - 0x50], 0xffffff
jmp 0x4167e9
push esi
lea eax, [ebp - 0x54]
push str.CUSTOM_COLOR__d
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push dword [ebp - 0x54]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0xffffff
cmove ecx, dword [ebp - 0x5c]
mov dword [ebp + esi*4 - 0x50], ecx
inc esi
cmp esi, 0x10
jl 0x4167a1
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x7c], eax
call sub.mfc140u.dll_CColorDialog::DoModal
cmp eax, 1
jne 0x416810
mov eax, dword [ebp - 0x80]
mov dword [edi + 0xf4], eax
jmp 0x416817
mov dword [ebp + 8], 0x7ed
test ebx, ebx
je 0x416857
xor esi, esi
lea edi, [ebp - 0x50]
push esi
lea eax, [ebp - 0x54]
push str.CUSTOM_COLOR__d
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
add esp, 0xc
push 4
push edi
push 4
push 0
push dword [ebp - 0x54]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc esi
add edi, 4
cmp esi, 0x10
jl 0x416820
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x60]
lea ecx, [ebp - 0x54]
mov dword [edi + 0x19c], 0
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CCommonDialog.virtual_0], vtable.CCommonDialog.0
call fcn.004b4c96
mov ecx, dword [ebp + 8]
cmp ecx, 0x7ed
je 0x416899
mov eax, dword [edi + 0xf4]
jmp 0x4168a5
mov eax, dword [edi + 0xf0]
mov dword [edi + 0xf4], eax
push 0
push eax
mov eax, dword [edi + 0x198]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x19c], 0
jne 0x4168c8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b61c2
mov esp, ebp
pop ebp
ret 4
Function at 0x416c60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x519110]
push esi
mov esi, ecx
mov ecx, 0x64
cmp eax, ecx
push edi
cmovg eax, ecx
mov dword [0x519110], eax
push 0x2d
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0x12
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esi + 0x8c], eax
lea eax, [ebp - 0x118]
push eax
mov dword [esi + 0x90], 0xffffffff
mov dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x198], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0x19c], 0
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x416d2e
cmp dword [ebp - 0x114], 5
ja 0x416d27
jne 0x416d2e
cmp dword [ebp - 0x110], 1
jb 0x416d2e
mov eax, 1
jmp 0x416d30
xor eax, eax
mov dword [esi + 0x1a0], eax
lea ecx, [esi + 0x1a4]
mov dword [ecx], 0
test eax, eax
je 0x416d56
push 0
push ecx
push 0
push 0x1022
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 4
call edi
push 0xd
mov dword [esi + 0x1a8], eax
call edi
cmp dword [esi + 0x1a0], 0
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x1b0], eax
je 0x416d89
push 0x1d
call edi
mov dword [esi + 0x1b0], eax
push ebx
push 0xe
call edi
push 7
mov dword [esi + 0x1b4], eax
call edi
movzx ebx, word [esi + 0x1ac]
mov dword [esi + 0x1b8], eax
movzx eax, byte [esi + 0x1aa]
imul ecx, eax, 0xcf
movzx eax, byte [esi + 0x1ae]
movzx edx, word [esi + 0x1a8]
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
mov eax, ebx
shr eax, 8
shr ecx, 8
movzx edi, cl
shl edi, 8
lea ecx, [eax + eax*2]
mov eax, edx
shr eax, 8
imul eax, eax, 0xcf
shl ecx, 4
add ecx, eax
shr ecx, 8
movzx eax, cl
or edi, eax
movzx eax, dl
imul ecx, eax, 0xcf
movzx eax, bl
shl edi, 8
pop ebx
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
shr ecx, 8
movzx eax, cl
mov ecx, dword [esi + 0x8c]
or edi, eax
mov eax, dword [esi + 0x88]
add ecx, ecx
sub eax, ecx
mov dword [esi + 0x1bc], edi
sub eax, 2
cmp eax, 5
jge 0x416e38
lea eax, [ecx + 7]
mov dword [esi + 0x88], eax
push 0
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a4], 0x1f4
push eax
push 0x1f4
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
lea ecx, [esi + 0xe0]
call sub.mfc140u.dll_CGdiObject::Attach
mov edi, dword [0x519110]
mov eax, 0x300
xor edx, edx
mov word [ebp - 0x2b0], ax
mov word [ebp - 0x2ae], di
test edi, edi
jle 0x416ed9
mov ecx, 0x50f070
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 0x204]
mov byte [ebp + edx*4 - 0x2ac], al
movzx eax, byte [ecx - 0x203]
mov byte [ebp + edx*4 - 0x2ab], al
movzx eax, byte [ecx - 0x202]
mov byte [ebp + edx*4 - 0x2aa], al
mov byte [ebp + edx*4 - 0x2a9], 0
inc edx
cmp edx, edi
jl 0x416ea0
lea eax, [ebp - 0x2b0]
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
push eax
lea ecx, [esi + 0xe8]
call sub.mfc140u.dll_CGdiObject::Attach
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b61c2
mov esp, ebp
pop ebp
ret
Function at 0x425bb0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 8
mov dword [edi + 0xd4], eax
call sub.mfc140u.dll_operator_2
mov esi, eax
add esp, 4
mov dword [esi], edi
mov ecx, dword [edi + 0xd4]
mov dword [esi + 4], ecx
mov ecx, edi
call fcn.00425cc0
lea ecx, [edi + 0xd0]
push ecx
push 0
push esi
push 0x425d50
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [0x58a0f4], eax
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
ret
Function at 0x42e460
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x42e4b8
mov ebx, dword [ebp + 0x10]
nop
push esi
lea eax, [ebp - 0x18]
push str.index_02d
push eax
call fcn.00427d70
add esp, 0xc
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push 0xffffffffffffffff
push str.number
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp byte [esi + 0x58a110], 0
jne 0x42e4b3
cmp eax, ebx
je 0x42e4d7
inc esi
cmp esi, edi
jl 0x42e480
or esi, 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b61c2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x58a110], 1
jmp 0x42e4bb

Function at 0x42e4e0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9824
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x587614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea esi, [eax + 4]
mov dword [eax], vtable.LJob.0
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.LJobInfo.0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x4da790
lea ecx, [esi + 4]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x40]
push 0x4d9cb8
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x28], 0
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push str.Customer_Ink_Setting
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
lea ecx, [ebx + 0x70]
mov dword [ebp - 4], 8
call fcn.0042e670
lea ecx, [ebx + 0x890]
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov eax, dword [0x51aff8]
mov dword [ebx + 0x898], eax
inc dword [0x51aff8]
mov byte [ebp - 4], 0xa
call fcn.00425a30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431e20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9b70
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x587614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
push dword [esi + 0xa4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CJobListView.0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x431e88
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x431e88
push dword [ebp - 0x10]
push dword [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xa0]
mov ecx, 0x58d238
push str.IconSize
push 0x4c21a8
call sub.mfc140u.dll_CWinApp::WriteProfileInt
lea ecx, [esi + 0xb0]
call fcn.004b526e
lea ecx, [esi + 0x98]
mov dword [ecx], vtable.CFont.0
call fcn.00405970
mov ecx, esi
call fcn.004b52f8
mov eax, dword [ebp + 8]
test al, 1
je 0x431efb
test al, 4
jne 0x431eed
push esi
call sub.mfc140u.dll_Ordinal_1513
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xb8
push esi
call fcn.00404f80
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43d040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
or dword [ebp - 0x28], 1
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x100
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43d0c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
or dword [ebp - 0x28], 1
mov eax, 5
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x100
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43eaf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bad02
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043f0d0
test eax, eax
je 0x43ebe0
mov eax, dword [0x58cfd8]
mov edi, dword [0x58a0fc]
push dword [eax + 0x894]
call fcn.00473090
add esp, 4
lea ecx, [ebp - 0x28]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push esi
mov dword [ebp - 4], 0
call fcn.00466030
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0048ca20
push dword [edi + 0x658]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
push 0x58cfe8
push str._sInkChannels_s_s.CNN
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
xor esi, esi
add esp, 0x20
cmp dword [edi + 0x660], esi
jle 0x43ebc7
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
lea eax, [ebp - 0x24]
push str.index_02d
push eax
call fcn.00427d70
add esp, 0xc
lea eax, [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push str.number
push eax
call ebx
cmp eax, 6
jl 0x43ebfc
inc esi
cmp esi, dword [edi + 0x660]
jl 0x43eb97
mov esi, 1
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b61c2
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x43ebcc
Function at 0x442b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb09c
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [0x5821c0]
je 0x442c48
lea ecx, [ebp - 0x320]
mov dword [0x5821c0], eax
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0xb9
lea ecx, [ebp - 0x320]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
push 0
push 0
push dword [ebp - 0x320]
mov ecx, esi
call sub.mfc140u.dll_CWnd::MessageBoxW
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x58cfe8
call fcn.0048cbe0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x31c]
push str.__sPMP.EXE____s_
push eax
call fcn.00421150
add esp, 0x1c
mov ecx, 0x58d238
call fcn.00481d70
push 5
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x320]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b61c2
mov esp, ebp
pop ebp
ret 4
Function at 0x44e840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push esi
push edi
push str.RT_RCDATA
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x44e8a6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44e8a6
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
xor esi, esi
test edi, edi
je 0x44e89f
push dword [ebx]
call sub.mfc140u.dll_operator_1
push dword [ebx]
mov esi, eax
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x10
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x451430
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc5a8
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x587614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0xe4]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x147
push dword [esi + 0x230]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
lea ecx, [esi + 0x210]
call sub.mfc140u.dll_CComboBox::GetLBText
push dword [ebp - 0xe4]
lea eax, [ebp - 0xe0]
push 0x58cfe8
push str._sMargin_s.msf
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
add esp, 0x10
lea eax, [ebp - 0xdc]
push dword [ebp - 0xe0]
push 0x64
push eax
push str.ERROR
push str.LeftTop
push 0x4de070
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xdc]
push str._lf__lf
push eax
call fcn.00408820
add esp, 0x10
cmp eax, 2
jne 0x451553
movsd xmm0, qword [ebp - 0xec]
sub esp, 8
movsd qword [esp], xmm0
call fcn.0048c8b0
movsd xmm0, qword [ebp - 0xf4]
fstp qword [esi + 0xa8]
movsd qword [esp], xmm0
call fcn.0048c8b0
add esp, 8
mov ecx, esi
fstp qword [esi + 0xb0]
push 0
call sub.mfc140u.dll_CWnd::UpdateData
lea ecx, [ebp - 0xe0]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xe4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b61c2
mov esp, ebp
pop ebp
ret
Function at 0x46e030
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x58ae80], 0
jne 0x46e07f
push str.STP_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [0x58ae80], 1
test eax, eax
je 0x46e07f
push 0
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
push str.04.08.20
push str.5.0.0_rc2
push str.Gutenprint__s__s_n
mov dword [0x58ae7c], eax
call fcn.0046e310
add esp, 0x18
mov eax, dword [0x58ae7c]
test dword [ebp + 8], eax
je 0x46e0b4
push esi
mov esi, dword [ebp + 0xc]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
push 0
push esi
push eax
call fcn.00421140
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x46e0c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x58ae80], 0
jne 0x46e10f
push str.STP_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [0x58ae80], 1
test eax, eax
je 0x46e10f
push 0
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
push str.04.08.20
push str.5.0.0_rc2
push str.Gutenprint__s__s_n
mov dword [0x58ae7c], eax
call fcn.0046e310
add esp, 0x18
mov eax, dword [0x58ae7c]
test dword [ebp + 8], eax
je 0x46e1d5
push dword [ebp + 0xc]
call fcn.0046f6b0
add esp, 4
test eax, eax
je 0x46e1d5
push ebx
push esi
push edi
mov edi, 0x40
push edi
call dword [0x581fc4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46e1d7
call fcn.00421140
mov ecx, eax
mov dword [ebp + 8], ecx
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push dword [ebp + 0x10]
or eax, 1
push 0xffffffffffffffff
push ebx
push dword [ecx + 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov esi, eax
add esp, 0x1c
test esi, esi
mov eax, 0xffffffff
cmovs esi, eax
test esi, esi
js 0x46e188
cmp esi, edi
jl 0x46e1ae
push ebx
call dword [0x581fcc]
add edi, edi
lea eax, [esi + 1]
test esi, esi
cmovns edi, eax
push edi
call dword [0x581fc4]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x46e1d7
mov ecx, dword [ebp + 8]
jmp 0x46e156
push esi
mov esi, dword [ebp + 0xc]
push ebx
push esi
call fcn.0046f680
add esp, 4
push eax
push esi
call fcn.0046f6b0
add esp, 4
call eax
push ebx
call dword [0x581fcc]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push str.Virtual_memory_exhausted._n
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
add esp, 0xc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x46e3c0
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x58ae80], 0
jne 0x46e40c
push str.STP_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [0x58ae80], 1
test eax, eax
je 0x46e40c
push 0
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
push str.04.08.20
push str.5.0.0_rc2
push str.Gutenprint__s__s_n
mov dword [0x58ae7c], eax
call fcn.0046e310
add esp, 0x18
mov eax, dword [0x58ae7c]
ret

Function at 0x476890
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x587614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push 0
mov dword [ebp - 0x1c], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x146
push dword [ebx + 0x678]
call esi
test eax, eax
jle 0x4769fc
push 1
mov ecx, ebx
call sub.mfc140u.dll_CWnd::UpdateData
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0
push 0
push 0x147
push dword [ebx + 0x678]
mov byte [ebp - 4], 1
call esi
test eax, eax
js 0x4769e1
lea eax, [ebx + 0x6d8]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0xdc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00423800
add esp, 0xc
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [esi]
push 4
push str..CNN
mov dword [ebp - 0x1c], 1
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor esi, esi
cmp dword [ebx + 0xa8], esi
jle 0x4769d4
lea edi, [ebx + 0x630]
nop dword [eax]
push esi
lea eax, [ebp - 0x14]
push str.index_02d
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
add esp, 0xc
push dword [ebp - 0x10]
push 6
push str.number
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
lea edi, [edi + 4]
inc esi
cmp esi, dword [ebx + 0xa8]
jl 0x4769a0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0
mov ecx, ebx
call sub.mfc140u.dll_CWnd::UpdateData
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret