joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adf7c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004adf04
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4adff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf24
test al, al
je 0x4adfe0
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push 3
push 1
push 0xf01ff
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004adee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adffd
mov eax, dword [ebp - 8]
call fcn.004adf14
ret

Function at 0x4ae008
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004adf04
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ae08d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf24
test al, al
jne 0x4ae077
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf6c
mov ebx, eax
test ebx, ebx
je 0x4ae070
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x4ae069
mov dword [ebp - 4], 2
jmp 0x4ae070
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.004adee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae094
mov eax, dword [ebp - 8]
call fcn.004adf14
ret

Function at 0x4ae09c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
call fcn.004adf04
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ae136
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004adf24
test al, al
jne 0x4ae120
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004adf3c
test al, al
jne 0x4ae119
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004adf6c
mov ebx, eax
test ebx, ebx
je 0x4ae110
lea eax, [ebp - 4]
push eax
push 1
push ebx
call sub.advapi32.dll_StartServiceA
test eax, eax
je 0x4ae109
mov dword [ebp - 8], 2
jmp 0x4ae110
mov dword [ebp - 8], 3
mov eax, ebx
call fcn.004adee8
jmp 0x4ae120
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae13d
mov eax, dword [ebp - 0xc]
call fcn.004adf14
ret
Function at 0x4ae148
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004adf04
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ae1de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf24
test al, al
jne 0x4ae1c8
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf54
test al, al
jne 0x4ae1c1
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004adf6c
mov ebx, eax
test ebx, ebx
je 0x4ae1b8
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4ae1b1
mov dword [ebp - 4], 2
jmp 0x4ae1b8
mov dword [ebp - 4], 3
mov eax, ebx
call fcn.004adee8
jmp 0x4ae1c8
mov dword [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae1e5
mov eax, dword [ebp - 8]
call fcn.004adf14
ret

Function at 0x4ae1f0
Capabilities:
Query service status

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
xor ebx, ebx
test eax, eax
jbe 0x4ae218
call fcn.004adf6c
mov esi, eax
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4ae211
mov ebx, dword [esp + 4]
mov eax, esi
call fcn.004adee8
mov eax, ebx
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x4ae220
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4ae3c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4ae3dc
call fcn.00404a18
mov ecx, dword [ebp - 8]
mov edx, 0x4ae3f4
mov eax, 0x4ae408
call fcn.004926f4
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x4ae3dc
call fcn.00404a18
mov eax, dword [ebp - 0xc]
call fcn.00404bcc
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x4ae367
push 0x4ae410
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4ae367
push 0x4ae428
call eax
mov esi, eax
test esi, esi
je 0x4ae367
push 0x30
mov ecx, 0x4ae528
mov edx, 0x4ae530
mov eax, dword [0x4b3800]
mov eax, dword [eax]
call fcn.00477e10
call fcn.00492ce0
push esi
push 0
push 0x1fffff
call sub.kernel32.dll_OpenThread
test eax, eax
je 0x4ae367
push eax
call sub.kernel32.dll_SuspendThread
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x4ae574
call fcn.00404a18
mov ecx, dword [ebp - 0x10]
mov edx, 0x4ae58c
mov eax, 0x4ae408
call fcn.004926f4
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x4ae574
call fcn.00404a18
mov eax, dword [ebp - 0x14]
call fcn.00404bcc
mov ecx, eax
mov edx, 0x4ae598
mov eax, 0x4ae5a8
call fcn.004adf7c
test eax, eax
je 0x4ae367
mov eax, 0x4ae5a8
call fcn.004ae09c
test eax, eax
je 0x4ae367
mov eax, 0x4ae5a8
call fcn.004ae148
mov eax, 0x4ae5a8
call fcn.004ae008
push ebx
call sub.kernel32.dll_FreeLibrary_1
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x4ae3dc
call fcn.00404a18
mov eax, dword [ebp - 0x18]
call fcn.00492340
mov edx, dword [0x4b3414]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, 0x4ae574
call fcn.00404a18
mov eax, dword [ebp - 0x1c]
call fcn.00492340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae3c9
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404730
ret
Function at 0x4b07e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov ebx, eax
lea edi, [ebp - 0x119]
xor eax, eax
push ebp
push 0x4b0a13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor ecx, ecx
mov edx, 0x105
call fcn.0040318c
push 0
mov eax, ebx
call fcn.0045e618
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov dl, 1
mov eax, dword [0x418200]
call fcn.004038c8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x44]
test ebx, ebx
je 0x4b098f
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0x105
mov ecx, edi
xor edx, edx
mov eax, esi
call fcn.004a6b08
lea eax, [ebp - 0x120]
mov edx, edi
mov ecx, 0x105
call fcn.0040497c
mov eax, dword [ebp - 0x120]
push eax
lea edx, [ebp - 0x124]
mov eax, dword [0x4b3800]
mov eax, dword [eax]
call fcn.00478290
mov edx, dword [ebp - 0x124]
pop eax
call fcn.00404b18
je 0x4b097d
lea edx, [ebp - 0x12c]
xor eax, eax
call fcn.00402b00
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.00409894
mov eax, dword [ebp - 0x128]
push eax
lea eax, [ebp - 0x134]
mov edx, edi
mov ecx, 0x105
call fcn.0040497c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409894
mov edx, dword [ebp - 0x130]
pop eax
call fcn.00404b18
jne 0x4b097d
lea eax, [ebp - 0x138]
mov edx, edi
mov ecx, 0x105
call fcn.0040497c
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4b097d
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x13c]
call fcn.00409114
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4b087c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b09f5
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
xor eax, eax
push ebp
push 0x4b09e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea ecx, [ebp - 0x140]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x140]
call fcn.00409164
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b09ed
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x4b09a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0a1a
lea eax, [ebp - 0x140]
mov edx, 9
call fcn.00404730
ret
Function at 0x402c18
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040419c
test esi, esi
jne 0x402c4f
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.0040428c
jmp 0x402c70
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402ab4
mov dword [esp], eax
test esi, esi
je 0x402c70
cmp dword [ebx], 0
je 0x402c70
dec esi
jmp 0x402c57
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4036b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40e018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40374c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40372c
xor eax, eax
push ebp
push 0x403725
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403768
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40372c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40e018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40e018], ax
mov esp, ebp
pop ebp
ret

Function at 0x404018
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f044], 0
je 0x404079
cmp word [0x40f218], 0xd7b2
jne 0x404041
cmp dword [0x40f220], 0
jbe 0x404041
mov eax, 0x40f214
call dword [0x40f230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40e064
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4040a0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40e024], 0
jne 0x404095
push 0
push 0x40e05c
push 0x40e064
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4054e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40554a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403140
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405534
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405551
lea eax, [ebp - 0x10]
call fcn.0040419c
ret

Function at 0x4085d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408609
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040428c
jmp 0x408612
mov eax, ebx
mov edx, esi
call fcn.004041f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40861c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40863d
mov al, byte [esp]
jmp 0x40863f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x408cd4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x408b3c
mov eax, dword [0x40e454]
cmp byte [eax], 0
je 0x408d50
mov eax, dword [0x40e3a4]
call fcn.00403034
call fcn.004029b0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406a1c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x408d98
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x408d86
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40e384]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40f660]
call fcn.00404e88
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40999c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x409a00
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406838
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a07
lea eax, [ebp - 0xc]
call fcn.0040419c
ret

Function at 0x40bb74
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x40bc18
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov word [0x40f7f0], ax
mov ax, word [0x40f7f0]
and ax, 0x3ff
movzx eax, ax
mov dword [0x40f7f4], eax
movzx eax, word [0x40f7f0]
shr eax, 0xa
mov dword [0x40f7f8], eax
push 0x104
lea eax, [ebp - 0x104]
push eax
push 5
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.004043f0
mov eax, dword [ebp - 0x108]
xor edx, edx
call fcn.00406838
mov dword [0x40f7fc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc1f
lea eax, [ebp - 0x108]
call fcn.0040419c
ret
Function at 0x401930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4176b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 1
call fcn.004166fc
mov esi, dword [esi + 0x1c]
push 1
lea eax, [esp + 0x10]
push 0
push eax
push 0x422128
push esi
mov byte [esp + 0x3c], 2
call fcn.004148e0
mov eax, dword [esp + 0x28]
add esp, 0x14
test eax, eax
jle 0x4019b1
dec eax
push eax
push 0
call fcn.00414790
mov ecx, dword [esp + 0x18]
add esp, 8
lea edx, [ecx + eax*4]
lea ecx, [esp + 4]
push edx
call fcn.00416708
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::TrimRight
mov esi, dword [esp + 0x30]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.00416714
mov dword [esp + 8], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 4]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x403080
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x417a7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov dl, byte [edi + 8]
mov byte [esi + 8], dl
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x14]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
call fcn.00416714
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00416714
lea ecx, [edi + 0x1c]
mov byte [esp + 0x14], 1
push ecx
lea ecx, [esi + 0x1c]
call fcn.00416714
mov edx, dword [edi + 0x20]
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 2
mov dword [esi + 0x20], edx
call fcn.00416714
mov cl, byte [edi + 0x28]
mov byte [esp + 0x14], 3
mov byte [esi + 0x28], cl
mov dl, byte [edi + 0x29]
mov byte [esi + 0x29], dl
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov cl, byte [edi + 0x2b]
lea edx, [edi + 0x2c]
mov byte [esi + 0x2b], cl
push edx
lea ecx, [esi + 0x2c]
call fcn.00416714
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [esp + 0x18], 4
call fcn.00416714
lea ecx, [edi + 0x34]
mov byte [esp + 0x14], 5
push ecx
lea ecx, [esi + 0x34]
call fcn.00416714
mov edx, dword [edi + 0x38]
add edi, 0x50
mov dword [esi + 0x38], edx
mov eax, dword [edi - 0x14]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi - 0x10]
mov dword [esi + 0x40], ecx
mov edx, dword [edi - 0xc]
mov dword [esi + 0x44], edx
mov eax, dword [edi - 8]
mov dword [esi + 0x48], eax
mov ecx, dword [edi - 4]
mov byte [esp + 0x14], 6
mov dword [esi + 0x4c], ecx
push edi
lea ecx, [esi + 0x50]
call fcn.00416714
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x404cf7
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x422d50
jmp 0x404ce0
push 0xffffffffffffffff
push 0x417c25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString_3
mov ecx, edi
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CString::Empty
mov ecx, esi
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x404da0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x417c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x14]
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 0x24]
mov byte [esp + 0x1c], 2
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 6
call sub.MFC42.DLL_CString::CString_3
or ebp, 0xffffffff
push str.15_15_10_10_10_10_20_30_40_60_70_80_70_80_70_70_60_50_40_30_50_50_40_20
mov ecx, edi
mov byte [esp + 0x20], 7
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x20], ebx
call fcn.00416726
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x28], 1
mov byte [esi + 0x29], bl
mov byte [esi + 0x2a], bl
mov byte [esi + 0x2b], bl
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407030
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4182d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0
lea esi, [edi + 0xd0]
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xbc]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xb8]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xb4]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xb0]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CSpinButtonCtrl::CSpinButtonCtrl
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x407d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x418677
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [edi + 0x80]
push esi
push esi
push 0x1004
push eax
mov byte [esp + 0x30], 2
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
cmp ebp, esi
jle 0x407df8
push ebx
lea ebx, [edi + 0x60]
push esi
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::GetCheck
test eax, eax
je 0x407df2
push esi
mov ecx, edi
call fcn.00406ce0
test eax, eax
je 0x407df2
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx - 8]
mov ecx, 0x422d8c
test edx, edx
je 0x407dcd
mov ecx, 0x4222bc
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x14]
push edx
push ecx
push str._s_d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
inc esi
cmp esi, ebp
jl 0x407da0
pop ebx
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00416714
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 4