joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494f20
Capabilities:
Read file via mapping

Disassembly:
push ecx
push esi
push str.CZ_LD_QMSwapFile
push 0xa2c
push 0
push 4
push 0
mov esi, ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 0xa90], eax
jne 0x494f58
push 0xffffffffffffffff
push eax
push 0xbb
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push 0
jne 0x494fa4
push str.QueueManager
push str.QueueManagerName
lea eax, [esp + 0x10]
push 0x54aebc
push eax
mov ecx, esi
call fcn.004950b0
mov ecx, dword [esp + 4]
push ecx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
lea ecx, [esp + 4]
neg esi
sbb esi, esi
inc esi
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [esi + 0xa90]
push 0
push 0
push 6
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
jne 0x494fcf
push 0xffffffffffffffff
push eax
push 0xbc
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
pop esi
pop ecx
ret
push edi
mov ecx, 0x28b
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4950b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50cbc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], 0
lea eax, [esi + 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x94]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esi + 0x94]
mov ebp, dword [sym.imp.MSVCRT.dll_free]
push edx
mov dword [esp + 0x24], 1
call ebp
mov eax, dword [esp + 0x3c]
add esp, 4
test eax, eax
je 0x495117
push eax
jmp 0x49511c
push str.General
mov edi, dword [sym.imp.MSVCRT.dll__strdup]
call edi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
add esp, 4
mov dword [esi + 0x94], eax
mov eax, dword [esp + 0x34]
push eax
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CWinApp::GetProfileStringA
mov ecx, dword [esi + 0x94]
mov byte [esp + 0x20], 2
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call edi
lea ecx, [esi + 0xa4c]
mov dword [esi + 0x94], eax
add esp, 8
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
Function at 0x495340
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50cc16
push eax
mov dword fs:[0], esp
sub esp, 0x408
push esi
mov esi, dword [esp + 0x41c]
push edi
push esi
mov edi, ecx
push str.PacsDataSource.ODBC
call fcn.004d8550
add esp, 8
test eax, eax
je 0x495455
add edi, 0xe8
lea ecx, [esp + 8]
push edi
call sub.MFC42.DLL_CString::CString_2
push str.SmitPlatform.ini
lea ecx, [esp + 0xc]
mov dword [esp + 0x41c], 0
call sub.MFC42.DLL_CString::operator_2
mov al, byte [0x54aebc]
mov ecx, 0xff
mov byte [esp + 0x10], al
xor eax, eax
lea edi, [esp + 0x11]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 8]
push ecx
push 0x400
stosw word es:[edi], ax
push edx
push 0x54aebc
push str.DataSource
push str.System
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x495400
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004c8322
jmp 0x495441
push 0
push str.DSNPacs
push str.DataSource
lea ecx, [esp + 0x18]
push 0x54aebc
push ecx
mov ecx, 0x54b128
call fcn.004950b0
push eax
mov ecx, esi
mov byte [esp + 0x41c], 1
call fcn.004c830a
lea ecx, [esp + 0xc]
mov byte [esp + 0x418], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x418], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x410]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x414
ret 4
Function at 0x495940
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x50ccd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push str.SvDoctor.EXE
push str.SvDoctor_file_name
lea eax, [esp + 0x20]
push 0x54aebc
push eax
call fcn.004950b0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push 0x54b210
push edx
mov dword [esp + 0x80], ebx
call sub.MFC42.DLL_operator_3
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x78], 2
call fcn.004c830a
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x28]
push edx
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x28], ecx
push ebx
push ebx
mov dword [esp + 0x34], ecx
push ebx
push ebx
mov dword [esp + 0x40], ecx
push ebx
push 0x104
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x50], ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
jne 0x495a57
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x74], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x74], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x496470
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50ce28
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xa74]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x54]
lea ecx, [esi + 0xa00]
push ebx
push 0x54aebc
push 3
push str.QueueManager
call fcn.00473500
test eax, eax
je 0x4965c0
mov eax, dword [esi + 0x10c]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jl 0x4964ee
cmp dword [esp + 0x34], 0x1400000
jle 0x4964ee
mov eax, dword [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x10c]
push 0x547008
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x4965c0
lea ecx, [esp + 0x54]
call sub.MFC42.DLL_CString::CString_3
lea edx, [esp + 0xc]
mov dword [esp + 0x4c], 0
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x1a]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x16]
and eax, 0xffff
push ebx
push eax
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1e]
push eax
mov eax, dword [esp + 0x20]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x74]
push str._04d._02d._02d__02d:_02d:_02d._03d__s_n
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x28
lea ecx, [esp + 0x54]
push 0x546fdc
push 0x545eac
call sub.MFC42.DLL_CString::Replace
mov edx, dword [esp + 0x54]
push edi
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
lea ecx, [esp + 0x54]
mov dword [esp + 0x4c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0xa6c]
lea ecx, [esi + 0xa6c]
call dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4

Function at 0x496630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50ce48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0xc]
push str._s_:____ld___r_n
push edx
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
je 0x496688
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 4]
mov ecx, esi
push eax
call fcn.004965f0
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x497820
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x50d0f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
mov dword [esp + 0x168], 0
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [esp + 0x170]
lea ecx, [esp + 0x10]
push esi
mov byte [esp + 0x16c], 1
call fcn.004c8322
lea eax, [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x542a7c
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x4978b6
push 0x542a7c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_2
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4978ec
lea ecx, [esp + 0x14]
mov byte [esp + 0x168], al
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x168], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4979bb
lea ecx, [esp + 0x20]
push ecx
push 0x543088
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x497991
mov esi, dword [esp + 0x178]
mov edi, dword [esp + 0x174]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call fcn.004c830a
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42.DLL_CString::operator_2
test byte [esp + 0x20], 0x10
je 0x49797e
cmp byte [esp + 0x4c], 0x2e
je 0x49797e
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
call fcn.00415d90
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.00415d90
cmp dword [esi + 8], 0x3e8
jge 0x49798a
lea ecx, [esp + 0x20]
push ecx
push ebp
call ebx
test eax, eax
jne 0x49791b
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0x168], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x168], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x15c
ret 0xc
Function at 0x4988d0
Capabilities:
Resume thread

Disassembly:
mov dword [ecx + 0x70], 1
mov eax, dword [ecx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x49b9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50d6b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 8]
sub esp, 0x14
mov esi, esp
lea eax, [esp + 0x34]
mov dword [esp + 0x20], esp
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
push ecx
lea ecx, [esi + 4]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esp + 0x3c]
push ebp
mov dword [esi + 8], edx
mov eax, dword [esp + 0x44]
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x10], ecx
mov ecx, edi
mov byte [esp + 0x30], 0
call fcn.0049bd20
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x10
ret 0x14
Function at 0x4a2b00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50e3c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi + 8]
sub esp, 0x10
mov dword [esp + 0x24], 0
mov eax, esp
mov dword [esp + 0x18], esp
mov dword [eax], ecx
mov dx, word [esp + 0x30]
mov word [eax + 4], dx
mov cx, word [esp + 0x32]
mov word [eax + 6], cx
mov dx, word [esp + 0x34]
lea ecx, [esp + 0x38]
mov word [eax + 8], dx
push ecx
lea ecx, [eax + 0xc]
call sub.MFC42.DLL_CString::CString_2
push edi
mov ecx, esi
call fcn.004a33d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x4a3fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50e5a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x34]
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_3
push esi
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 1
call fcn.00472160
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [esi], 0x51bfa0
mov dword [esi + 0x78], eax
mov ecx, dword [edi]
lea edx, [edi + 4]
mov dword [esi + 0x28], ecx
push edx
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.004a40e0
mov eax, dword [edi + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
push edx
mov ecx, ebx
call fcn.004c8322
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x7c], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x4a5950
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50e7ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x51c000
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_3
mov dword [esi + 0x24], 0x5165a4
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], 0x515c40
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x54]
push edi
mov ecx, ebx
mov byte [esp + 0x1c], 6
call sub.MFC42.DLL_CSyncObject::CSyncObject
mov dword [ebx], 0x514ca0
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x51bffc
mov dword [esi + 0x4c], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a5ec0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x50e96f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebp
xor ebp, ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0x515c40
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x6c], 1
call fcn.004a5c20
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x64], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x70]
mov byte [esp + 0x64], 3
call sub.MFC42.DLL_CString::CString_3
movsx eax, word [esp + 0x78]
movsx edx, word [esp + 0x74]
movsx ecx, word [esp + 0x7c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
movsx eax, word [esp + 0x84]
movsx edx, word [esp + 0x80]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], eax
movsx ecx, word [esp + 0x88]
movsx eax, word [esp + 0x90]
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ecx
movsx edx, word [esp + 0x8c]
movsx ecx, word [esp + 0x94]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], edx
movsx eax, word [esp + 0x9c]
movsx edx, word [esp + 0x98]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x54], eax
movsx ecx, word [esp + 0xa0]
mov eax, dword [esp + 0x20]
xor edi, edi
cmp eax, ebp
mov byte [esp + 0x64], 4
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], ecx
jle 0x4a6025
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x70]
lea eax, [edx + edi*4]
push eax
call fcn.004c830a
lea ecx, [esp + 0x70]
push ecx
mov ecx, esi
call fcn.004a5d00
cmp eax, ebp
jl 0x4a600e
mov edx, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x70]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x10]
push edx
jmp 0x4a6013
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jl 0x4a5fcf
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x64], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x64], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x64], 1
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x18], 0x515c40
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x64], 5
cmp eax, ebp
je 0x4a6097
mov edx, dword [esp + 0x20]
push edx
push eax
call sub.MFC42.DLL_DestructElements
mov eax, dword [esp + 0x1c]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x5c
ret 0x38
Function at 0x4a64e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50ea28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::TrimRight
push 0x2d
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Find_1
mov esi, eax
test esi, esi
jge 0x4a6566
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
add eax, 2
mov esi, eax
jmp 0x4a6608
lea edx, [esp + 0x10]
push esi
push edx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.004c830a
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
inc esi
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Mid_1
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.004c830a
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::TrimRight
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 8]
mov ecx, dword [esp + 8]
test eax, eax
jne 0x4a65ee
mov edx, dword [ecx - 8]
test edx, edx
jne 0x4a65ee
mov esi, 2
jmp 0x4a6608
test eax, eax
jne 0x4a65f9
mov esi, 3
jmp 0x4a6608
mov eax, dword [ecx - 8]
xor edx, edx
test eax, eax
setne dl
add edx, 4
mov esi, edx
lea eax, [esp + 0x14]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
dec esi
cmp esi, 3
ja case.default.0x4a6618
jmp dword [esi*4 + 0x4a66e0]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.004c830a
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
push edx
call fcn.004c830a
jmp case.default.0x4a6618
push str.000000
lea ecx, [esp + 0x10]
call fcn.004c8322
push str.235959
lea ecx, [esp + 0xc]
call fcn.004c8322
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov ecx, edi
call fcn.004a6180
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
mov ecx, edi
call fcn.004a6180
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x1c
push str.000000
lea ecx, [esp + 0x10]
jmp 0x4a6654