joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4428e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x550d97
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push eax
push 0x3f5
push 1
push 1
mov ecx, esi
call dword [sym.imp.libUI.module_public:_void___thiscall_CUIWin7Dialog::constructor_int__int__unsigned_int__class_CWnd__]
mov dword [esp + 0x20], 0
lea ecx, [esi + 0x160]
mov dword [esi], vtable.CWndSetStatus.0
call dword [0x55a6c4]
mov byte [esp + 0x20], 1
lea ecx, [esi + 0x164]
push ecx
call fcn.00480490
mov byte [esp + 0x20], 2
lea edx, [esi + 0x17c]
push edx
call fcn.00401680
mov byte [esp + 0x20], 3
push 0
push 0
lea ecx, [esi + 0x1d0]
call dword [sym.imp.libUI.module_public:_void___thiscall_CUISeparator::constructor_enum_CUISeparator::eThemeControl__enum_CUISeparator::eDisabledThemeStyle_]
mov byte [esp + 0x20], 4
lea eax, [esi + 0x230]
push eax
call fcn.0040ac00
mov byte [esp + 0x20], 5
push str.wtwWindows
lea ecx, [esp + 0x18]
mov dword [esi + 0x14c], 0
call dword [0x55a504]
mov byte [esp + 0x20], 6
mov eax, dword [0x5c6f7c]
push 0x55ae9c
push 0x42c
lea ecx, [esp + 0x1c]
push ecx
call fcn.00504820
push eax
lea ecx, [esp + 0x14]
call dword [0x55a504]
mov byte [esp + 0x20], 7
push str.wtwWindows
lea ecx, [esp + 0x10]
call dword [0x55a504]
mov byte [esp + 0x20], 8
mov eax, dword [0x5c6f7c]
push str.Stan
push 0x42b
lea edx, [esp + 0x14]
push edx
call fcn.00504820
push eax
lea ecx, [esp + 0x30]
call dword [0x55a504]
mov byte [esp + 0x20], 9
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call dword [sym.imp.libUI.module_public:_void___thiscall_CUIWin7Dialog::SetHeaders_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const___class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
mov byte [esp + 0x20], 8
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x20], 7
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x20], 6
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x20], 5
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esi + 0x15c], 0
mov dword [esp + 0x20], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x4481c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x535bac
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 0x14]
add ecx, 0x30
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x4482b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54bcf4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x78]
mov dword [esi], vtable.CWndChatChild.0
mov dword [edi], vtable.CWndChatChild.1.0
mov dword [esp + 0x1c], 0xd
lea ecx, [esi + 0xfa8]
call fcn.00402840
mov byte [esp + 0x1c], 0xc
lea ecx, [esi + 0xea8]
call fcn.00401790
mov byte [esp + 0x1c], 0xb
lea ecx, [esi + 0xea0]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x1c], 0xa
lea ecx, [esi + 0xe38]
call fcn.00417f00
mov cl, 9
mov byte [esp + 0x1c], cl
lea eax, [esi + 0xdf0]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
lea ecx, [eax + 8]
call fcn.00417f00
mov byte [esp + 0x1c], 8
lea eax, [esi + 0xdd8]
push eax
call fcn.0044c5e0
mov byte [esp + 0x1c], 7
lea ecx, [esi + 0x790]
call fcn.0040fb30
mov byte [esp + 0x1c], 6
lea ecx, [esi + 0x77c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov cl, 5
mov byte [esp + 0x1c], cl
lea eax, [esi + 0x73c]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
lea ecx, [eax + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov cl, 4
mov byte [esp + 0x1c], cl
lea eax, [esi + 0x6fc]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
lea ecx, [eax + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov cl, 3
mov byte [esp + 0x1c], cl
lea eax, [esi + 0x6bc]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
lea ecx, [eax + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x1c], 2
lea ecx, [esi + 0x66c]
push ecx
call fcn.0044c580
mov byte [esp + 0x1c], 1
lea ecx, [esi + 0xa0]
call dword [sym.imp.libUI.module_public_virtual:_void___thiscall_CPPToolTip::destructor_void_]
mov byte [esp + 0x1c], 0
push edi
call fcn.00529880
mov dword [esp + 0x1c], 0xffffffff
mov ecx, esi
call dword [sym.imp.libUI.module_public_virtual:_void___thiscall_CUIDialog::destructor_void_]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x45a2b0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
call sub.mfc90u.dll_CDialog::OnInitDialog
push 0x10
call sub.mfc90u.dll_new
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
mov eax, dword [esi + 0x20]
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [esi + 0x20]
push 0x447
push ecx
call ebx
mov dword [edi], eax
mov edx, dword [esi + 0x20]
push 0x43f
push edx
call ebx
mov dword [edi + 8], eax
lea eax, [esp + 0xc]
push eax
push 0
push edi
push 0x45a230
push 0
add esi, 0x74
push 0
mov dword [edi + 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x45c2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x542d45
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 1
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x10], 0
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x10], 0xffffffff
add esi, 0xc
push esi
call fcn.004590e0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x45c4f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x542d45
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea eax, [esi + 0xc]
push eax
call fcn.004d3aa0
mov dword [esp + 0x10], 0
lea ecx, [esi + 0x2c]
call dword [0x55a6c4]
mov byte [esp + 0x10], 1
lea ecx, [esi + 0x30]
call dword [0x55a6c4]
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x470a49
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x440
mov ebx, ecx
call sub.mfc90u.dll_CWnd::GetDlgItem
mov esi, eax
test esi, esi
je 0x470aa3
mov eax, dword [esp + 0x14]
add eax, 0xfffffb4f
cmp ax, 8
ja 0x470aa3
mov ecx, dword [esi + 0x20]
push 3
push 0xffffffffffffffff
push 0x100c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
cmp ebp, 0xffffffff
jle 0x470aa3
push ebp
mov ecx, esi
call sub.mfc90u.dll_CListCtrl::GetItemData
mov edi, eax
mov ecx, edi
call fcn.004deb80
test eax, eax
je 0x470aa3
movzx ecx, word [esp + 0x14]
lea edx, [ecx - 0x4b1]
cmp edx, 5
ja case.0x470a14.1205
jmp dword [edx*4 + 0x470abc]
push 1
mov ecx, eax
call fcn.004df920
jmp case.0x470a14.1205
push 0
mov ecx, eax
call fcn.004df920
jmp case.0x470a14.1205
mov edx, dword [0x5c6f48]
push 2
push edx
call fcn.004df510
jmp case.0x470a14.1205
push edi
call fcn.004df800
jmp case.0x470a14.1205
push ebp
mov ecx, esi
call sub.mfc90u.dll_CListCtrl::GetItemData
mov ecx, eax
call fcn.004deb80
mov eax, dword [eax + 0x68]
mov ecx, dword [ebx + 0x20]
push 5
push 0
push 0
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebx + 0x20]
push 0
push 0xa
add ebp, 0xbb8
push ebp
push edx
mov dword [ebx + 0xd4], 1
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebp
mov dword [ebx + 0xd4], 0
mov eax, 1
pop ebx
ret 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov ecx, ebx
call sub.mfc90u.dll_CWnd::OnCommand
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x471360
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x550f9b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.libUI.module_protected_virtual:_int___thiscall_CUIScalableDialog::OnInitDialog_void_]
push str.wtwOptions
lea ecx, [esp + 0x14]
call dword [0x55a504]
mov dword [esp + 0x20], 0
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [0x5c6f7c]
push 0x41d
lea ecx, [esp + 0x18]
push ecx
call fcn.005026d0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov edx, dword [esi + 0xec]
push 0
push str.explorer
push edx
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
push str.wtwOptions
lea ecx, [esp + 0x14]
call dword [0x55a504]
mov dword [esp + 0x20], 1
push 0xffffffffffffffff
push 0xaa
push 0
push 0x5702f4
push 0x419
lea eax, [esp + 0x24]
push eax
mov eax, dword [0x5c6f7c]
lea edi, [esi + 0xcc]
call fcn.00504820
push eax
push 0
mov ecx, edi
call sub.mfc90u.dll_CListCtrl::InsertColumn
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push str.wtwOptions
lea ecx, [esp + 0x14]
call dword [0x55a504]
mov dword [esp + 0x20], 2
mov eax, dword [0x5c6f7c]
push 0xffffffffffffffff
push 0xc8
push 0
push str.Bramka
push 0x41a
lea ecx, [esp + 0x24]
push ecx
call fcn.00504820
push eax
push 1
mov ecx, edi
call sub.mfc90u.dll_CListCtrl::InsertColumn
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov edx, dword [esi + 0xec]
push 0x10820
push 0
push 0x1036
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x481100
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x54e618
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5c403c]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push ebp
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
xor ebx, ebx
push 0x24c
lea eax, [esp + 0x24]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x28], ebx
call sub.MSVCR90.dll_memset
push edi
lea ecx, [esp + 0x28]
push ecx
mov edi, str..pbook.xml
call fcn.0040f2b0
add esp, 0x14
mov dword [esp + 0x278], ebx
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or ebp, 0xffffffff
mov edi, eax
mov dword [esp + 0x278], ebp
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [esi + 0x20]
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x14b
push eax
call ebx
push str.wtwSMS
lea ecx, [esp + 0x18]
call dword [0x55a504]
mov dword [esp + 0x278], 1
mov eax, dword [0x5c6f7c]
push str._Ksi
push 0x3fa
lea ecx, [esp + 0x1c]
push ecx
call fcn.00504820
mov edx, dword [esi + 0x20]
push eax
push 0
push 0x143
push edx
call ebx
mov dword [esp + 0x278], ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
cmp edi, ebp
je 0x481225
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x48]
push eax
push 0
push 0x143
push ecx
call ebx
lea edx, [esp + 0x1c]
push edx
push edi
call ebp
test eax, eax
jne 0x481200
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00532776
add esp, 0x26c
ret
Function at 0x48d950
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x54a176
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0051bf40
push 0x55ae9c
lea ecx, [esp + 0x28]
call dword [0x55a504]
mov dword [esp + 0x30], 0
push str.isFavourite
lea ecx, [esp + 0x24]
call dword [0x55a504]
mov byte [esp + 0x30], 1
mov eax, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call dword [0x55a504]
mov byte [esp + 0x30], 2
mov ecx, dword [esi + 8]
push ecx
lea ecx, [esp + 0x1c]
call dword [0x55a504]
mov byte [esp + 0x30], 3
lea edx, [esp + 0x24]
push edx
lea ebp, [esi + 0x10]
push ebp
lea eax, [esp + 0x20]
push eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x28]
call fcn.004b1480
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov byte [esp + 0x30], 0
mov ecx, edi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
or edi, 0xffffffff
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
call dword [0x55a6c4]
mov dword [esp + 0x30], 4
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp]
mov eax, dword [esi + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push str._s__d__s
push ecx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov eax, dword [0x5c7044]
add esp, 0x14
add eax, 0x810
lea ecx, [esp + 0x14]
call fcn.00414e50
mov esi, eax
test esi, esi
je 0x48dac1
and dword [esi + 0x98], 0xfffcffff
push str.IC_Fav
lea ecx, [esp + 0x28]
call dword [0x55a504]
mov byte [esp + 0x30], 5
lea edx, [esp + 0x24]
push edx
mov eax, esi
call fcn.00418810
mov byte [esp + 0x30], 4
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [0x5c7044]
add eax, 0x810
mov dword [eax + 0x118], 1
call fcn.00412400
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x498e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x555a99
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0
push 0
push 0x498730
push str.WTW_PropertiesAddPages
call fcn.004ad690
push 0x34
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.wtwOther
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0x34
mov dword [esp + 0x30], 0x498c40
call dword [0x55a504]
mov dword [esp + 0x48], 0
mov eax, dword [0x5c6f7c]
push str.Group
push 0x3fc
lea ecx, [esp + 0x10]
push ecx
call fcn.00504820
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0
lea edx, [esp + 0x10]
push edx
push str.WTW_PropertiesStaticPageAdd
push 0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x20], str.GROUP_0_Properties
mov dword [esp + 0x30], 0x3e8
mov dword [esp + 0x48], str.GROUP
call fcn.004b3e40
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
add esp, 0x48
ret

Function at 0x4997e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x556289
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x38
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, dword [0x5c7044]
mov edx, dword [ecx + 0x20]
mov eax, 0x280
add esp, 0xc
push str.wtwOther
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0x38
mov dword [esp + 0x20], 0x499510
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0x3e0002
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], str.WTW_ConfigWizard
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x1e0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0x1fe
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x258
call dword [0x55a504]
mov dword [esp + 0x50], 0
push str.First_configuration_wizard
push 0x411
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x5c6f7c]
call fcn.00504820
mov dword [esp + 0x14], eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [0x5c6f98]
push ecx
lea edx, [esp + 0x10]
push 0
push edx
call fcn.00513090
add esp, 0xc
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x49ed10
Capabilities:
Access peb ldr_data
Get ntdll base address
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x534c52
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [0x5c6edc]
lea ecx, [esp + 0x10]
call dword [sym.imp.libWTW.module_public:_void___thiscall_wtw::CString::constructor_void_]
mov dword [esp + 0x28], 0
lea ecx, [esp + 0xc]
call dword [0x55a6c4]
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x10]
push str.SELECT_settings_page_id_FROM_addon_index_WHERE_guid_s_
push edx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
lea ecx, [esi + 4]
call dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CConnection::executeAndRead_wchar_t_const___class_wtw::CString__]
lea ecx, [esp + 0x10]
call dword [sym.imp.libWTW.module_public:_unsigned_long_int___thiscall_wtw::CString::getLength_void_const]
test eax, eax
je 0x49ede4
lea ecx, [esp + 0x10]
call dword [sym.imp.libWTW.module_public:_wchar_t_const____thiscall_wtw::CString::c_str_void_const]
mov ecx, dword [esp + 0x34]
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov byte [esp + 0x28], 0
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
mov byte [esp + 0x28], 0
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.libWTW.module_public_virtual:_void___thiscall_wtw::CString::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
Function at 0x4ac6c0
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x542338
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov eax, esi
call fcn.004a6e70
mov dword [esp + 0x20], 0
mov ecx, dword [0x5c6ed0]
mov edi, dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CConnection::executeAndRead_wchar_t_const___int__]
lea eax, [esp + 0x14]
push eax
push str.SELECT_COUNT___FROM_sqlite_master_WHERE_namestatusNotes2_
mov dword [esi], vtable.CDescriptionManager.0
call edi
cmp dword [esp + 0x14], 0
mov ebx, dword [sym.imp.libWTW.module_public:_long_int___thiscall_wtw::db::CConnection::executeNoRead_wchar_t_const__]
jne 0x4ac731
mov ecx, dword [0x5c6ed0]
push str.CREATE_TABLE_statusNotes2____id__INTEGER_PRIMARY_KEY_AUTOINCREMENT____text__TEXT____extra__TEXT___
call ebx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x5c6ed0]
push str.SELECT_COUNT___FROM_sqlite_master_WHERE_namestatusNotes_
call edi
cmp dword [esp + 0x14], 1
jne 0x4ac764
mov ecx, dword [0x5c6ed0]
push str.INSERT_INTO_statusNotes2_id__text__extra__SELECT__FROM_statusNotes_
call ebx
mov ecx, dword [0x5c6ed0]
push str.DROP_TABLE_statusNotes_
call ebx
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ace10
mov dword [esp + 0x20], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8