joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
lea edx, [esp]
mov eax, 0x4485a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
xor ebp, ebp
mov bl, byte [esi]
xor ecx, ecx
mov cl, byte [eax]
add ebp, 0x40
add edx, 4
mov cl, byte [ecx + edi]
xor cl, bl
xor ebx, ebx
mov bl, byte [eax + 1]
shl cl, 5
mov bl, byte [ebx + edi]
inc eax
xor bl, byte [esi + 1]
inc esi
shl bl, 3
add cl, bl
inc eax
xor ebx, ebx
inc esi
mov bl, byte [eax]
mov bl, byte [ebx + edi]
xor bl, byte [esi]
shl bl, 2
add cl, bl
inc eax
xor ebx, ebx
inc esi
mov bl, byte [eax]
mov bl, byte [ebx + edi]
xor bl, byte [esi]
shl bl, 1
add cl, bl
inc eax
xor ebx, ebx
inc esi
mov bl, byte [eax]
mov bl, byte [ebx + edi]
xor bl, byte [esi]
add cl, bl
inc eax
xor ebx, ebx
inc esi
mov bl, byte [eax]
mov bl, byte [ebx + edi]
xor bl, byte [esi]
shl bl, 4
add cl, bl
inc eax
mov byte [esp + 0x34], cl
inc esi
mov ecx, dword [esp + 0x34]
and ecx, 0xff
mov cl, byte [ecx + ebp + 0x448628]
mov byte [esp + 0x38], cl
mov ecx, dword [esp + 0x38]
and ecx, 0xff
cmp ebp, 0x200
mov ecx, dword [ecx*4 + 0x448868]
mov dword [edx - 4], ecx
jl 0x403c7a
mov eax, dword [esp + 0x3c]
mov ecx, 0x4485d0
sub ecx, eax
mov esi, 0x20
xor edx, edx
mov dl, byte [ecx + eax]
inc eax
dec esi
mov dl, byte [esp + edx + 0x10]
mov byte [eax - 1], dl
jne 0x403d27
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x403e20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x80
mov ecx, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x20]
mov eax, dword [esp + 0x9c]
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ebx, [eax + 0x2d0]
mov ebp, 0x10
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x50]
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x70]
push ecx
push edx
push ebx
call fcn.00403c60
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x70]
mov dl, byte [esp + eax + 0x30]
xor cl, dl
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x20
jl 0x403e7f
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x403e5b
mov eax, dword [esp + 0x98]
mov ecx, 8
lea esi, [esp + 0x10]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x20]
mov ecx, 8
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x405c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43b84f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
xor esi, esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [0x44a758]
mov dword [esp + 0x38], 1
cmp dword [eax - 8], esi
je 0x405cad
push eax
lea eax, [esp + 0x14]
push 0x448a1c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1e], ecx
push edx
mov dword [esp + 0x26], ecx
mov byte [esp + 0x3c], 2
mov dword [esp + 0x2a], ecx
mov word [esp + 0x20], si
mov word [esp + 0x2e], cx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x26]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x28]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x2a]
push edx
mov edx, dword [esp + 0x2a]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x24]
push 0x448a00
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x20
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x44]
mov byte [esp + 0x38], 3
cmp eax, esi
je 0x405d5e
cmp byte [eax], 0
je 0x405d5e
push eax
lea ecx, [esp + 0xc]
push 0x448a1c
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push edx
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 4
call sub.MFC42.DLL_CString::FormatV
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 8]
lea edx, [esp + 0x44]
push ecx
push eax
push edx
mov byte [esp + 0x44], 5
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x44], 6
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x44]
mov byte [esp + 0x38], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x38], 8
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x406f00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push esi
mov esi, dword [esp + 0x2c]
push edi
push eax
push esi
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
cmp eax, 0xffffffff
jne 0x406f25
pop edi
or eax, eax
pop esi
add esp, 0x24
ret
push 0x1b6
push 0x8000
push esi
call dword [sym.imp.MSVCRT.dll__open]
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x406f48
pop edi
or eax, eax
pop esi
add esp, 0x24
ret
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x406f6f
push edi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x24
ret
mov edx, dword [esp + 0x1c]
push edx
push esi
push edi
call dword [sym.imp.MSVCRT.dll__read]
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp eax, ecx
je 0x406fa1
push edi
call dword [sym.imp.MSVCRT.dll__close]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x24
ret
push ebx
push ebp
push edi
call dword [sym.imp.MSVCRT.dll__close]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x40]
add esp, 4
xor edi, edi
lea eax, [ecx + 1]
xor ebp, ebp
cdq
sub eax, edx
mov dword [esp + 0x38], ebp
sar eax, 1
sub ebx, eax
add ebx, 0x204
test ecx, ecx
jle 0x4070dd
lea eax, [ecx + 1]
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jge 0x4070dd
test edi, edi
jne 0x40703e
and ecx, 0x80000001
jns 0x406ff6
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x40703e
mov al, byte [esi]
cmp al, 0x41
jb 0x407023
cmp al, 0x61
jb 0x407006
sub al, 0x20
mov byte [esi], al
xor eax, eax
mov al, byte [esi]
sub eax, 0x37
and eax, 0x8000000f
jns 0x407019
dec eax
or eax, 0xfffffff0
inc eax
and al, 0xf
mov byte [ebx + ebp], al
jmp 0x4070cb
and eax, 0xff
mov ecx, 0xa
sub eax, 0x30
cdq
idiv ecx
and dl, 0xf
mov byte [ebx + ebp], dl
jmp 0x4070cb
mov al, byte [edi + esi]
cmp al, 0x41
jb 0x407067
cmp al, 0x61
jb 0x40704e
sub al, 0x20
mov byte [edi + esi], al
xor edx, edx
mov dl, byte [edi + esi]
mov ecx, edx
sub ecx, 0x37
and ecx, 0x8000000f
jns 0x407079
dec ecx
or ecx, 0xfffffff0
inc ecx
jmp 0x407079
and eax, 0xff
mov ecx, 0xa
sub eax, 0x30
cdq
idiv ecx
mov ecx, edx
mov al, byte [edi + esi + 1]
and ecx, 0xf
shl ecx, 4
cmp al, 0x41
jb 0x4070ae
cmp al, 0x61
jb 0x407091
sub al, 0x20
mov byte [edi + esi + 1], al
xor edx, edx
mov dl, byte [edi + esi + 1]
sub edx, 0x37
and edx, 0x8000000f
jns 0x4070a7
dec edx
or edx, 0xfffffff0
inc edx
and dl, 0xf
add dl, cl
jmp 0x4070c7
and eax, 0xff
mov ebp, 0xa
sub eax, 0x30
cdq
idiv ebp
mov ebp, dword [esp + 0x38]
and dl, 0xf
add dl, cl
mov byte [ebx + ebp], dl
inc edi
mov ecx, dword [esp + 0x24]
inc edi
inc ebp
cmp edi, ecx
mov dword [esp + 0x38], ebp
jl 0x406fd5
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x407100
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1070
call fcn.0043b050
mov eax, dword [esp + 0x1074]
push esi
push 0x448b20
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x407132
or eax, 0xffffffff
pop esi
add esp, 0x1070
ret
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.00401780
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 0x1000
lea edx, [esp + 0x84]
push 1
push edx
call edi
add esp, 0x14
test eax, eax
je 0x407185
push eax
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004036b0
push esi
push 0x1000
lea edx, [esp + 0x8c]
push 1
push edx
call edi
add esp, 0x1c
test eax, eax
jne 0x40715c
lea eax, [esp + 8]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00403770
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edi, dword [esp + 0x108c]
mov ecx, 5
lea esi, [esp + 0x14]
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
add esp, 0x1070
ret
Function at 0x4074e0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
push edi
xor edx, edx
mov ecx, 6
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov word [esp + 0x18], 0x10
mov dword [esp + 0xc], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
add esp, 0x20
ret
Function at 0x412200
Capabilities:
Accept command line arguments
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c817
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString_2
mov bl, 4
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x44a754
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0043ac24
push esi
lea ecx, [esp + 0x10]
call fcn.0043ac24
mov eax, dword [esp + 0xc]
push 0x3a
lea ecx, [esp + 0x10]
mov esi, dword [eax - 8]
call sub.MFC42.DLL_CString::ReverseFind
sub esi, eax
lea ecx, [esp + 0x18]
inc esi
push esi
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 5
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 6
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x90]
push ecx
lea ecx, [esp + 0x14]
call fcn.0043ac24
push 0x2e
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea edx, [esp + 0x1c]
push eax
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov byte [esp + 0x2c], 7
push 0x448db4
push eax
lea eax, [esp + 0x20]
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 8
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x412384
lea edx, [esp + 8]
lea ecx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::operator_2
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x4129d0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x43c86b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebp
push esi
push 0
mov esi, ecx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push ebp
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412add
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
mov ebx, eax
call fcn.0043abe8
mov eax, dword [esp + 0x10]
push 0x448e80
push eax
mov dword [esp + 0x14c], 0
call edi
add esp, 8
test eax, eax
je 0x412a8f
mov ecx, dword [esp + 0x10]
push 0x448e70
push ecx
call edi
add esp, 8
test eax, eax
je 0x412a8f
mov edx, dword [esp + 0x10]
push 0x448e68
push edx
call edi
add esp, 8
test eax, eax
je 0x412a8f
mov eax, dword [esp + 0x10]
push 0x448e5c
push eax
call edi
add esp, 8
test eax, eax
jne 0x412abf
push 0x448e70
mov ecx, esi
call fcn.00412b00
push 0x448e68
mov ecx, esi
call fcn.00412b00
push 0x448e5c
mov ecx, esi
call fcn.00412b00
push 0x448e80
mov ecx, esi
call fcn.00412b00
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
test ebx, ebx
jne 0x412a1d
pop edi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x412b00
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43c896
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412bf6
mov ecx, dword [esp + 0x14c]
push ecx
lea ecx, [esp + 0x10]
call fcn.0043abe8
lea ecx, [esp + 0xc]
mov dword [esp + 0x144], ebx
call sub.MFC42.DLL_CString::MakeLower
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x412bd7
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
call fcn.0043abe8
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], 1
call sub.MFC42.DLL_CString::MakeLower
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push edx
call edi
add esp, 8
test eax, eax
je 0x412c12
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412b7b
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0xc]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x13c
ret 4
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x412bf8
Function at 0x418c90
Capabilities:
Create directory
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43cf50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
push 0x449128
lea eax, [esp + 0x14]
xor ebx, ebx
push 0x44ee44
push eax
mov dword [esp + 0x28], ebx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll__mkdir]
push ecx
call edi
add esp, 4
lea ecx, [esp + 0xc]
push 0x44a754
call fcn.0043ac24
push 0x44903c
lea edx, [esp + 0x14]
push 0x44ee44
push edx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0xc]
push eax
call edi
add esp, 4
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esi + 0x2e8]
call sub.MFC42.DLL_CString::operator_2
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call sub.MFC42.DLL_CString::CString_3
mov ecx, esi
call fcn.00412ee0
push 0x44a754
lea ecx, [esp + 0x10]
call fcn.0043ac24
push 0x448f04
lea eax, [esp + 0x14]
push 0x44ee44
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
push ecx
call edi
add esp, 4
add esi, 0x340
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::operator_2
mov esi, dword [esi]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x41ba90
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43d308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x20]
xor edi, edi
sub eax, edi
mov dword [esp + 0x18], edi
je 0x41bacb
sub eax, 2
jne 0x41bad7
push 2
jmp 0x41bacc
push edi
lea ecx, [esi + 0x50ec]
call fcn.00425120
mov eax, dword [esi + 0x20]
push eax
call fcn.004254c0
mov ecx, dword [esi + 0x20]
push 0x66
push ecx
call fcn.004253a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
mov esi, 0x44bf74
push edi
lea edx, [esp + 0x10]
push 0x448be8
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x20]
push 0x4492c8
push 0x44ee44
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push eax
push 0x64
push esi
push 0x4492c0
push ecx
push 0x4492b8
call ebx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
add esi, 0x64
inc edi
cmp esi, 0x44de50
jl 0x41baf9
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x41bb80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43d328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
mov dword [esp + 0x18], ebx
call sub.MFC42.DLL_AfxGetThread
cmp eax, ebx
je 0x41bbbd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x41bbbf
xor eax, eax
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov ecx, dword [eax + 4]
push 8
push 0x8006
push ecx
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, ebx
jne 0x41bd5a
push ebp
push edi
push ebx
lea ecx, [esi + 0x50ec]
call fcn.00425120
mov edx, dword [esi + 0x20]
push edx
call fcn.004254c0
mov eax, dword [esi + 0x20]
push 0x66
push eax
call fcn.004253a0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
mov edi, 0x44bf74
push ebx
lea ecx, [esp + 0x14]
push 0x448be8
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x14]
push 0x4492c8
push 0x44ee44
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x14]
push 0x64
push edi
push 0x4492c0
push eax
push 0x4492b8
call ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
add edi, 0x64
inc ebx
cmp edi, 0x44de50
jl 0x41bc18
mov eax, dword [esi + 0x2bc]
push eax
push 0x448d4c
push 0x449188
push 0x448aa8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, esi
mov dword [esi + 0x4020], 0
call fcn.0041a7d0
mov ecx, esi
call fcn.0041a6f0
lea edi, [esi + 0x180]
push 0x4492ec
push 0x478
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x449268
push 0xffffffffffffffff
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x4492e4
push 0x475
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, esi
call fcn.0041cd40
mov ecx, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_GetMenu]
push ecx
call ebp
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov edx, dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push 2
push edx
call edi
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov eax, dword [eax + 4]
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push 0x8006
push eax
call ebx
mov ecx, dword [esi + 0x20]
push ecx
call ebp
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov edx, dword [eax + 4]
push 2
push edx
call edi
push eax
call sub.MFC42.DLL_CMenu::FromHandle
mov eax, dword [eax + 4]
push 0
push 0x8007
push eax
call ebx
mov ecx, esi
call fcn.0041ab00
pop edi
pop ebp
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret