joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52cdc0
Capabilities:
Check for time delay via gettickcount
Read and send data from client to server
Read file via mapping
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov edx, ecx
push edi
test esi, esi
mov dword [esp + 0x10], edx
je 0x52ce6e
cmp dword [esi + 0x44], 0xffffffff
je 0x52ce6e
mov ecx, dword [esi + 0x28]
mov ebp, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
mov ebx, dword [esi + 0x24]
sub ebp, ecx
mov dword [esp + 0x20], 0
sbb ebx, eax
mov eax, dword [edx + 0x78]
mov edi, dword [eax + 0x5664]
mov eax, edi
cdq
push edx
push eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
call fcn.00573cd0
sub edi, eax
test ebx, ebx
jl 0x52ce7a
jg 0x52ce1f
test ebp, ebp
jbe 0x52ce7a
mov eax, edi
cdq
cmp ebx, edx
jl 0x52ce34
jg 0x52ce2c
cmp ebp, eax
jbe 0x52ce34
mov ebp, eax
mov dword [esp + 0x18], edx
jmp 0x52ce38
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x10]
push 0
push ebp
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x5660]
cdq
push edx
push eax
mov eax, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x28]
push eax
call fcn.00573cd0
mov ebp, dword [esi + 0x40]
mov ecx, dword [esi + 8]
add eax, ebp
mov edx, dword [ecx + 8]
push eax
push edx
call sub.WSOCK32.dll_send
test eax, eax
jge 0x52ce7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x20]
mov edi, dword [esi + 0x28]
cdq
add edi, eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], edi
mov ecx, dword [esi + 0x2c]
adc ecx, edx
mov dword [esi + 0x2c], ecx
mov ecx, dword [esi + 0x28]
mov edi, dword [esi + 0x2c]
cmp ecx, eax
jne 0x52ceb8
cmp edi, dword [esi + 0x24]
jne 0x52ceb8
mov edx, dword [esi + 0x18]
mov ebp, dword [esp + 0x10]
xor eax, eax
cmp edx, 0x62
setne al
add eax, 7
mov dword [esi + 0x58], eax
jmp 0x52cf27
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp + 0x78]
mov eax, dword [edx + 0x5660]
cdq
push edx
push eax
push edi
push ecx
call fcn.00573cd0
or eax, edx
jne 0x52cf27
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [ebp + 0x78]
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x24]
sub edi, eax
mov eax, dword [edx + 0x5660]
cdq
sbb ecx, ebx
cmp ecx, edx
jl 0x52cf07
jg 0x52cf01
cmp edi, eax
jbe 0x52cf07
mov dword [esp + 0x18], edx
jmp 0x52cf0d
mov eax, edi
mov dword [esp + 0x18], ecx
mov edx, dword [esi + 0x48]
push eax
mov eax, dword [esi + 0x28]
mov ecx, ebx
push eax
push ebx
push 4
push edx
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 8]
mov edx, eax
sub edx, dword [ecx + 0x20]
cmp edx, 0x3e8
jb 0x52cf52
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 0x20]
push 0
push esi
push 0x471
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
Function at 0x531f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58cfc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0x593718
mov dword [esp + 0x10], esi
push 0x186
push 4
push 0x186
mov dword [esp + 0x30], esi
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CMenu::Attach
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov ebp, eax
push ebp
push 3
call fcn.004a1110
push 0x5e63bc
push ebp
call fcn.004a0fd0
add esp, 0x10
cmp eax, 0xffffffff
je 0x532041
mov ecx, dword [ebp + 4]
push ebx
push eax
push ecx
call esi
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov ebx, eax
mov eax, dword [edi + 0x78]
xor esi, esi
mov ecx, dword [eax + 0x5ea0]
test ecx, ecx
jle 0x532040
cmp esi, 0xa
jge 0x532040
mov edx, dword [eax + 0x5e9c]
lea eax, [esi + 0x8008]
mov ecx, dword [edx + esi*4]
push ecx
push eax
push 0
push eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [edi + 0x78]
inc esi
cmp esi, dword [eax + 0x5ea0]
jl 0x532011
pop ebx
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0
push edi
push edx
push eax
push 2
mov ecx, ebp
call sub.MFC42.DLL_CMenu::TrackPopupMenu
mov dword [esp + 0xc], 0x593718
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CMenu::DestroyMenu
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x544d50
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58e608
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
push eax
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esi + 0xc0]
xor ecx, ecx
test edi, edi
jle 0x544da1
mov edx, dword [esi + 0xc4]
mov esi, dword [edx]
test esi, esi
je 0x544d99
cmp dword [esi + 0x64], eax
je 0x544dc8
inc ecx
add edx, 4
cmp ecx, edi
jl 0x544d8e
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esi + 0xf4]
test eax, eax
jne 0x544dd6
xor edi, edi
jmp 0x544ddd
mov edi, dword [esi + 0xf8]
inc edi
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov ecx, dword [eax + 0x174]
push ecx
call ebx
cmp edi, eax
jl 0x544e1b
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x174]
push edx
call ebx
mov esi, dword [esi + 0xfc]
lea edi, [esi + 1]
cmp edi, eax
jl 0x544e1b
mov edi, 1
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 0
push edi
mov eax, dword [eax + 0x174]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4

Function at 0x544e60
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x58e647
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], 1
push eax
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esi + 0xc0]
xor ecx, ecx
test edi, edi
jle 0x544ebb
mov edx, dword [esi + 0xc4]
mov esi, dword [edx]
test esi, esi
je 0x544eb3
cmp dword [esi + 0x64], eax
je 0x544ef6
inc ecx
add edx, 4
cmp ecx, edi
jl 0x544ea8
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_5
mov ecx, dword [esp + 0x24]
lea edx, [esi + 0x32]
push ecx
add esi, 0x6c
push edx
push esi
lea eax, [esp + 0x14]
push str._s__s__r_nIP:_s
push eax
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x34]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
jmp 0x544ed3
Function at 0x544f50
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58e668
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x1c]
push eax
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esi + 0xc0]
xor ecx, ecx
test edi, edi
jle 0x544f97
mov esi, dword [esi + 0xc4]
mov edx, esi
mov ebx, dword [edx]
cmp dword [ebx + 0x64], eax
je 0x544fbe
inc ecx
add edx, 4
cmp ecx, edi
jl 0x544f88
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
mov esi, dword [esi + ecx*4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
jmp 0x544faa

Function at 0x546640
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x546656
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov di, word [esi + 0xc]
mov cx, word [esi + 4]
mov eax, edi
mov word [esp + 0xa], cx
and eax, 0xffff
and ecx, 0xffff
imul eax, ecx
mov edx, dword [esi + 8]
mov ecx, eax
imul ecx, edx
mov dword [esp + 0xc], edx
push 1
cdq
and edx, 7
push 0
add eax, edx
lea edx, [esp + 0x10]
push 0
push edx
shr ecx, 3
sar eax, 3
mov word [esp + 0x26], di
mov edi, dword [sym.imp.WINMM.dll_waveInOpen]
push 0xffffffffffffffff
push 0
mov word [esp + 0x20], 1
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], ax
mov word [esp + 0x30], 0
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x5466cd
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [0x5f4448]
mov ecx, dword [esi + 0x18]
push 0x20000
push eax
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esi + 0x10]
push 0xffffffffffffffff
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x5466f8
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov dword [esi + 0x28], 1
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x546710
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x54672a
call fcn.00546760
mov eax, dword [esi + 0x24]
test eax, eax
je 0x54672a
xor eax, eax
pop esi
ret
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x5464b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x546749
pop esi
ret
mov eax, 1
mov dword [esi + 0x24], eax
pop esi
ret
Function at 0x546760
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x546770
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5467cd
mov eax, dword [esi + 0x18]
push ebx
push ebp
push edi
push 0
push 0
push 0x12
push eax
mov edi, 0x32
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
cmp dword [esp + 0x10], 0x103
jne 0x5467c3
push 0xa
call ebp
dec edi
jne 0x54679b
mov eax, dword [esi + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop ebp
mov dword [esi + 0x1c], 0
pop ebx
mov dword [esi + 0x24], 0
mov eax, 1
pop esi
pop ecx
ret

Function at 0x546880
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x546894
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.WINMM.dll_waveInReset]
test eax, eax
mov dword [esi + 0x14], eax
je 0x5468ac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x140
call sub.MFC42.DLL_operatornew
mov ebp, dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esp, 4
mov dword [esi + 0x20], eax
xor ebx, ebx
mov edi, dword [esi + 0x20]
mov ecx, 8
xor eax, eax
add edi, ebx
rep stosd dword es:[edi], eax
push 0x3c0
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 0x20]
add esp, 4
mov dword [ecx + ebx], eax
mov edx, dword [esi + 0x20]
push 0x20
mov dword [edx + ebx + 4], 0x3c0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x10]
add eax, ebx
push eax
push ecx
call ebp
test eax, eax
mov dword [esi + 0x14], eax
jne 0x5468a5
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x10]
add edx, ebx
push 0x20
push edx
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
mov dword [esi + 0x14], eax
jne 0x5468a5
add ebx, 0x20
cmp ebx, 0x140
jb 0x5468c4
mov eax, 1
pop edi
mov dword [esi + 0x2c], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x546c50
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
je 0x546c6a
call fcn.00546ca0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x546c6a
xor eax, eax
pop esi
ret
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x546b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x546c89
pop esi
ret
mov eax, 1
mov dword [esi + 0x44], eax
pop esi
ret
Function at 0x546ca0
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x546cb0
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x18]
test eax, eax
je 0x546d0d
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push edi
push 0
push 0
push 0x12
push eax
mov edi, 0x32
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
cmp dword [esp + 0x10], 0x103
jne 0x546d03
push 0xa
call ebp
dec edi
jne 0x546cdb
mov eax, dword [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop ebp
mov dword [esi + 0x18], 0
pop ebx
mov dword [esi + 0x44], 0
mov eax, 1
pop esi
pop ecx
ret

Function at 0x550c60
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x58f4f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
push edi
mov esi, ecx
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 1
call fcn.005736b4
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x59b990
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x8c
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
mov dword [ebp], esi
mov edx, dword [esp + 0x40]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax - 8]
cmp eax, 0x80
jl 0x550d0d
lea ecx, [esp + 0xc]
push 0x7f
push ecx
lea ecx, [esp + 0x4c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], 3
call fcn.00572d3c
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
mov edi, dword [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x58]
push ebp
push 0x550b70
mov dword [ebp + 0x88], ecx
call sub.MFC42.DLL_AfxBeginThread
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x18]
mov byte [esp + 0x38], 1
push eax
mov dword [esp + 0x14], 0x59b990
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSyncObject::CSyncObject
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
Function at 0x555de0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fe9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::CString_5
lea edi, [esi + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_5
lea ebx, [esi + 0x1c]
mov byte [ebp - 4], 2
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString_5
push 0x5f3788
lea ecx, [esi + 4]
mov byte [ebp - 4], 6
mov dword [esi], 0x5ba1d8
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp + 0xc]
lea ecx, [esi + 0x28]
push eax
call fcn.00572d3c
mov ecx, dword [ebp + 8]
lea eax, [esi + 8]
push 0x5f3788
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
push 0x5f3788
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x10]
lea eax, [esi + 8]
xor ebx, ebx
push edx
push eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x555ed3
xor edi, edi
jmp 0x555f05
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp + 8], eax
add eax, 3
and al, 0xfc
call fcn.00573b80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov edi, esp
push ebx
push ebx
push eax
push edi
push 0xffffffffffffffff
push ecx
push ebx
push ebx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
lea ecx, [esi + 4]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x24]
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5567b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x5567e3
push esi
call fcn.0055aab0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x5567dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x556869
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x556852
mov eax, dword [esi + 8]
test eax, eax
je 0x556807
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x55684e
cmp eax, 2
je 0x556852
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5567fa
cmp eax, 3
je 0x55682d
cmp eax, 1
jne 0x5567fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5567fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5567fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.005568a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x556889
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x12
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.005568a0
add esp, 4
pop esi
ret
Function at 0x559b30
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.0055b960
push 0x50
push edi
mov dword [esp + 0x18], eax
call fcn.0055b910
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x559b74
push edi
call fcn.004edf50
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x35
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.00559c70
mov dword [esi + 4], fcn.00559dc0
mov dword [esi + 8], fcn.00559e70
mov dword [esi + 0xc], fcn.00559f20
mov dword [esi + 0x10], 0x559fd0
mov dword [esi + 0x14], 0x55a040
mov dword [esi + 0x18], 0x55a0b0
mov dword [esi + 0x1c], 0x55a240
mov dword [esi + 0x20], 0x55a430
mov dword [esi + 0x24], fcn.0055a620
mov dword [esi + 0x28], 0x55a720
mov eax, dword [esp + 0xc]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x3c]
mov ecx, 2
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x559bcf
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], 0x50
push str.JPEGMEM
mov dword [edi + 4], esi
call sub.MSVCRT.dll_getenv
add esp, 4
cmp eax, ebx
je 0x559c5f
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call sub.MSVCRT.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x559c5f
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x559c28
cmp al, 0x4d
jne 0x559c4c
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret