joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401569
Capabilities:
Get file version info

Disassembly:
jmp 0x40ba00
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov ebx, ecx
push eax
push edi
mov dword [esp + 0x14], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x40ba90
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebx + 0x38], eax
test eax, eax
je 0x40ba90
push eax
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40ba90
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x448cb0
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40ba90
mov esi, dword [esp + 0x18]
lea eax, [ebx + 4]
mov ecx, 0xd
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 0xfeef04bd
sete cl
mov dword [ebx + 0x48], ecx
mov eax, dword [ebx + 0x48]
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x401596
Capabilities:
Reference sql statements

Disassembly:
jmp 0x40d080
push 0xffffffffffffffff
push 0x43b850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov eax, dword [ebp]
push 0x44e400
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_CString::CString_1
push 0x44e400
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
movsx ecx, word [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push str.Utilidades_d
push edx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x3c]
add esp, 0xc
test edi, edi
je 0x40d15e
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x40d15e
lea eax, [esp + 0x30]
push 0x449134
push eax
call sub.MFC42.DLL_COleDateTime::Format
mov esi, eax
lea ecx, [esp + 0x2c]
push 0x449134
push ecx
mov ecx, edi
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_COleDateTime::Format
mov edx, dword [esi]
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str.SELECT__FROM__s_WHERE_DataHora_BETWEEN__s_AND__s_ORDER_BY_DataHora_DESC_
push edx
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.0043641e
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 1
call fcn.0043641e
jmp 0x40d176
mov eax, dword [esp + 0x28]
push eax
push eax
lea eax, [esp + 0x14]
push str.SELECT__FROM__s_WHERE_DataHora___SELECT_MAX_DataHora__FROM__s__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
push ecx
push esi
call fcn.00401311
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004017d5
add esp, 0xc
cmp al, 0xff
jne 0x40d1b3
mov ecx, dword [esp + 0x10]
mov dword [ebp], ecx
jmp 0x40d1ba
mov edx, dword [esp + 0x10]
mov dword [ebp], edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.0043641e
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043641e
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret
Function at 0x401663
Capabilities:
Reference sql statements

Disassembly:
jmp 0x40d5f0
push 0xffffffffffffffff
push 0x43b910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov eax, dword [ebp]
push 0x44e400
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_CString::CString_1
push 0x44e400
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
movsx ecx, word [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push str.Ciclometro_d
push edx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x3c]
add esp, 0xc
test edi, edi
je 0x40d6ce
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x40d6ce
lea eax, [esp + 0x30]
push 0x449134
push eax
call sub.MFC42.DLL_COleDateTime::Format
mov esi, eax
lea ecx, [esp + 0x2c]
push 0x449134
push ecx
mov ecx, edi
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_COleDateTime::Format
mov edx, dword [esi]
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str.SELECT__FROM__s_WHERE_DataHora_BETWEEN__s_AND__s_ORDER_BY_DataHora_ASC_
push edx
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.0043641e
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 1
call fcn.0043641e
jmp 0x40d6e6
mov eax, dword [esp + 0x28]
push eax
push eax
lea eax, [esp + 0x14]
push str.SELECT__FROM__s_WHERE_DataHora___SELECT_MIN_DataHora__FROM__s__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
push ecx
push esi
call fcn.00401311
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004017d5
add esp, 0xc
cmp al, 0xff
jne 0x40d723
mov ecx, dword [esp + 0x10]
mov dword [ebp], ecx
jmp 0x40d72a
mov edx, dword [esp + 0x10]
mov dword [ebp], edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.0043641e
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043641e
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret

Function at 0x401677
Capabilities:
Get hostname

Disassembly:
jmp 0x415f80
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43c205
push eax
mov eax, 0x800c
mov dword fs:[0], esp
call fcn.00436900
push esi
push 0x44e400
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x8020], 1
mov dword [esp + 0x10], 0x7fff
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
push 0x44765c
push eax
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x802c]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x8018], 0
call fcn.0043641e
mov ecx, dword [esp + 0x8010]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x8018
ret
Function at 0x40167c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x416160
push 0xffffffffffffffff
push 0x43c290
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
push 0x44e400
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 4]
mov dword [esp + 0x2a4], 1
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10c]
mov byte [esp + 0x2a4], 2
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4161fd
lea ecx, [esp + 0xc]
push 0xff
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x4161f8
lea edx, [esp + 0xc]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4161f8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [esp + 4]
call fcn.0043642a
call sub.WS2_32.dll_WSACleanup
push esi
mov esi, dword [esp + 0x2b0]
lea eax, [esp + 4]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x2a8], 1
call fcn.0043641e
lea ecx, [esp + 4]
mov byte [esp + 0x2a8], 0
call fcn.0043641e
mov ecx, dword [esp + 0x2a0]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2a8
ret

Function at 0x401703
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x427750
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
push edi
test ebp, ebp
mov edi, ecx
mov ebx, 0x1400
jbe 0x4277d5
mov eax, ebp
sub eax, esi
cmp ebx, eax
jbe 0x427772
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [edi + 0x19d]
push 0
push ebx
lea ecx, [esi + eax]
push ecx
push edx
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x4277e1
fld qword [edi + 0x115]
fcomp qword [0x43fc20]
add esi, eax
fnstsw ax
test ah, 0x40
jne 0x4277d1
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
fst qword [edi + 0x11d]
fmul qword [0x43fc88]
fdiv qword [edi + 0x115]
call sub.MSVCRT.dll__ftol
mov word [edi + 0x127], ax
cmp esi, ebp
jb 0x427768
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 8
Function at 0x401744
Capabilities:
Get disk size

Disassembly:
jmp 0x4167a0
push 0xffffffffffffffff
push 0x43c34f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push 0x44e400
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_1
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov dword [esp + 0x40], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
test eax, eax
je 0x416837
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x2c]
push edx
push ecx
push 0
call eax
test eax, eax
je 0x416830
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x1e
call fcn.004369f0
push edx
push eax
lea edx, [esp + 8]
push str._I64u_GB_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x4168a7
push str.Espa
jmp 0x41689a
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x416895
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mul dword [esp + 8]
push 0
push ecx
push edx
push eax
call fcn.004369b0
mov ecx, 0x1e
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call fcn.004369f0
push edx
push eax
lea edx, [esp + 8]
push str._I64u_GB_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x4168a7
push 0x44a8b0
lea eax, [esp + 4]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
push esi
mov esi, dword [esp + 0x44]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.0043641e
mov ecx, dword [esp + 0x34]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x401843
Capabilities:
Check os version
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
jmp 0x415ca0
push 0xffffffffffffffff
push 0x43c1c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d0
push esi
push edi
push 0x44e400
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x1e0], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edx, [esp + 0xc]
mov dword [esp + 0x10], 0x104
push edx
push 1
push 0
push str.HardwareDescriptionSystemCentralProcessor0
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415dc7
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xd8]
push eax
push ecx
push 0
push 0
push str.ProcessorNameString
push edx
call esi
call fcn.00401488
sub esp, 8
lea eax, [esp + 0xe0]
lea ecx, [esp + 0x10]
fstp qword [esp]
push eax
push str._s__4.1f_MHz
push ecx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x58]
add esp, 0x14
cmp eax, 0xa
jne 0x415de3
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
lea eax, [esp + 0xd8]
push edx
push eax
push 0
push 0
push str.Identifier
push ecx
call esi
call fcn.00401488
sub esp, 8
lea edx, [esp + 0xe0]
lea eax, [esp + 0x10]
fstp qword [esp]
push edx
push str._s__4.1f_MHz
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
jmp 0x415de3
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push ecx
push edx
lea eax, [esp + 0x10]
push str._d__d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x1e8]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x1e0], 0
call fcn.0043641e
mov ecx, dword [esp + 0x1d8]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1dc
ret

Function at 0x40184d
Capabilities:
Create thread

Disassembly:
jmp 0x408400
push 0x44eb28
push 0
push 0
push 0x40171c
push 0
push 0
mov byte [0x44ee48], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x44f074], eax
ret
Function at 0x40185c
Capabilities:
Access peb ldr_data
Read file on windows

Disassembly:
jmp 0x416930
push 0xffffffffffffffff
push 0x43c38f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString
push 0x44fa64
mov dword [esp + 0x2c], 1
call fcn.00401942
mov edi, str.chave.dat
or ecx, 0xffffffff
xor eax, eax
push 0x44a98c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x44fa64
mov esi, edi
mov edx, ecx
mov edi, 0x44fa64
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4169c7
lea eax, [esp + 8]
push str.Chave:_Arquivo_chave.dat_inexistente.
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
jmp 0x416a3b
push esi
push 0x10
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
movsx edx, byte [esp + 0x2b]
movsx eax, byte [esp + 0x2a]
movsx ecx, byte [esp + 0x29]
push edx
push eax
movsx edx, byte [esp + 0x30]
movsx eax, byte [esp + 0x2f]
push ecx
push edx
movsx ecx, byte [esp + 0x36]
movsx edx, byte [esp + 0x35]
push eax
push ecx
movsx eax, byte [esp + 0x3c]
movsx ecx, byte [esp + 0x3b]
push edx
push eax
movsx edx, byte [esp + 0x42]
movsx eax, byte [esp + 0x41]
push ecx
push edx
movsx ecx, byte [esp + 0x48]
push eax
push ecx
lea edx, [esp + 0x48]
push str.Chave:__c_c_c_c__c_c_c_c__c_c_c_c
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x48
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0043641e
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x40187a
Capabilities:
Write file on windows

Disassembly:
jmp 0x41f700
sub esp, 0x100
lea eax, [esp]
push ebx
push esi
push edi
push eax
call fcn.004013a2
mov edi, str.CopiaMDB32.prg
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x44ae38
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41f777
push esi
push 0x502
push 1
push 0x44e500
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x4018ca
Capabilities:
Reference sql statements

Disassembly:
jmp 0x40ccb0
push 0xffffffffffffffff
push 0x43b7d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
push 0x44e400
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_1
push 0x44e400
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
mov ax, word [esp + 0x2c]
mov byte [esp + 0x1c], 1
test ax, ax
jg 0x40cd19
lea eax, [esp + 8]
push str.Energia
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
jmp 0x40cd2f
movsx ecx, ax
push ecx
lea edx, [esp + 0xc]
push str.Energia_d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov edi, dword [esp + 0x30]
test edi, edi
je 0x40cda6
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x40cda6
lea eax, [esp + 0x30]
push 0x449134
push eax
call sub.MFC42.DLL_COleDateTime::Format
mov esi, eax
lea ecx, [esp + 0x2c]
push 0x449134
push ecx
mov ecx, edi
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_COleDateTime::Format
mov edx, dword [esi]
mov eax, dword [eax]
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str.SELECT__FROM__s_WHERE_DataHora_BETWEEN__s_AND__s_ORDER_BY_DataHora_DESC_
push edx
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.0043641e
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 1
call fcn.0043641e
jmp 0x40cdbe
mov eax, dword [esp + 8]
push eax
push eax
lea eax, [esp + 0x14]
push str.SELECT__FROM__s_WHERE_DataHora___SELECT_MAX_DataHora__FROM__s__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
push ecx
push esi
call fcn.00401311
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004017d5
add esp, 0xc
cmp al, 0xff
jne 0x40cdfe
mov ecx, dword [esp + 0x28]
mov dword [ecx], 0
jmp 0x40ce08
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov dword [edx], eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.0043641e
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043641e
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret
Function at 0x4018fc
Capabilities:
Get session user name

Disassembly:
jmp 0x416070
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43c245
push eax
mov eax, 0x800c
mov dword fs:[0], esp
call fcn.00436900
push esi
push 0x44e400
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x8020], 1
mov dword [esp + 0x10], 0x7fff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
push 0x44765c
push eax
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x802c]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x8018], 0
call fcn.0043641e
mov ecx, dword [esp + 0x8010]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x8018
ret

Function at 0x401942
Capabilities:
Read .ini file

Disassembly:
jmp 0x4299d0
sub esp, 0x100
lea eax, [esp]
push ebx
push esi
push edi
push eax
call fcn.00401578
mov edi, str.Smart32.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x114]
push 0xff
push esi
push 0
push str.caminho
push str.caminho
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x429a4c
push 0x100
push esi
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x4019ce
Capabilities:
Get disk information

Disassembly:
jmp 0x416570
push 0xffffffffffffffff
push 0x43c317
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x44e400
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
mov al, byte [0x44e400]
xor ecx, ecx
mov word [esp + 0x19], cx
mov dword [esp + 0x28], 1
mov byte [esp + 0x1b], cl
lea ecx, [esp + 0x10]
mov byte [esp + 0x18], al
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x28], 2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov esi, 0x41
and ebx, 1
test ebx, ebx
je case.default.0x41660f
push esi
lea edx, [esp + 0x1c]
push str._c:_
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call ebp
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x41660f
jmp dword [eax*4 + 0x41671c]
push esi
push str.__c:_Drive_Removivel_
jmp 0x416646
push esi
push str.__c:_Hard_Disk_
jmp 0x416660
push esi
lea edx, [esp + 0x14]
push str.__c:_Drive_de_Rede_
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x10]
push eax
jmp 0x416672
push esi
push str.__c:_CD_ROM_Drive_
lea ecx, [esp + 0x18]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x10]
push edx
jmp 0x416672
push esi
push str.__c:__RAM_Disk_
lea eax, [esp + 0x18]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
inc esi
lea edx, [esi - 0x41]
cmp edx, 0x1a
jl 0x4165e8
mov eax, dword [esp + 0x14]
mov esi, 0x44e400
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4166b9
test cl, cl
je 0x4166b5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4166b9
add eax, 2
add esi, 2
test cl, cl
jne 0x416691
xor eax, eax
jmp 0x4166be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4166d0
push str.C:_Hard_Disk_
lea ecx, [esp + 0x18]
call fcn.0043642a
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.0043641e
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.0043641e
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4019e7
Capabilities:
Reference sql statements

Disassembly:
jmp 0x40d7c0
push 0xffffffffffffffff
push 0x43b950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov eax, dword [ebp]
push 0x44e400
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_CString::CString_1
push 0x44e400
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
movsx ecx, word [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push str.Ciclometro_d
push edx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x3c]
add esp, 0xc
test edi, edi
je 0x40d89e
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x40d89e
lea eax, [esp + 0x30]
push 0x449134
push eax
call sub.MFC42.DLL_COleDateTime::Format
mov esi, eax
lea ecx, [esp + 0x2c]
push 0x449134
push ecx
mov ecx, edi
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_COleDateTime::Format
mov edx, dword [esi]
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str.SELECT__FROM__s_WHERE_DataHora_BETWEEN__s_AND__s_ORDER_BY_DataHora_DESC_
push edx
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.0043641e
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 1
call fcn.0043641e
jmp 0x40d8b6
mov eax, dword [esp + 0x28]
push eax
push eax
lea eax, [esp + 0x14]
push str.SELECT__FROM__s_WHERE_DataHora___SELECT_MAX_DataHora__FROM__s__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
push ecx
push esi
call fcn.00401311
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004017d5
add esp, 0xc
cmp al, 0xff
jne 0x40d8f3
mov ecx, dword [esp + 0x10]
mov dword [ebp], ecx
jmp 0x40d8fa
mov edx, dword [esp + 0x10]
mov dword [ebp], edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.0043641e
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043641e
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret