joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x424c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.User
lea ecx, [esp + 0x10]
lea eax, [esi + 0x1e14]
push eax
push ecx
call sub.MFC42.DLL_operator
push 0x43012c
lea edx, [esp + 0xc]
push eax
push edx
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_operator
push str.EZNet41.ini
push eax
lea eax, [esp + 0xc]
mov byte [esp + 0x34], 1
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
xor ecx, ecx
mov al, 0x33
mov dword [esp + 0x10], ecx
mov byte [esi + 0x1e49], al
mov dword [esp + 0x14], ecx
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
push eax
mov dword [esp + 0x24], ecx
push str.Type
push str.APPTYPE
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esi + 0x1e4c]
test eax, eax
je 0x40e3fe
mov cl, byte [esi + 0x1e49]
push ecx
push 0x430ad0
jmp 0x40e40a
mov dl, byte [esi + 0x1e49]
push edx
push 0x430988
lea ecx, [esi + 0x555c]
call fcn.00417420
mov ecx, esi
call fcn.00409250
lea ecx, [esp + 4]
mov dword [esi + 0x1df4], 1
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x40e750
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x424c5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x294
mov eax, dword [ecx + 0x55f4]
push esi
lea esi, [ecx + 0x55f4]
push 0x4333dc
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x40e7b3
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40e7b3
push esi
mov esi, dword [esp + 0x2ac]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
jmp 0x40e866
lea ecx, [esp + 4]
call fcn.00422340
lea eax, [esp + 0x108]
mov dword [esp + 0x2a0], 0
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40e83f
lea ecx, [esp + 8]
push 0xff
push ecx
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x40e83a
lea edx, [esp + 8]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40e83a
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
mov ecx, esi
call fcn.00422328
call sub.WSOCK32.dll_WSACleanup
push esi
mov esi, dword [esp + 0x2ac]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 4]
mov dword [esp + 0x2a0], 0xffffffff
call sub.MFC42.DLL_CString::CString
jmp 0x40e866
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp + 4]
mov dword [esp + 0x2a0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x2a8]
push str.127.0.0.1
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x298]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2a0
ret 4
Function at 0x40f940
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x424ee7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov edi, ecx
push str.User
lea eax, [esp + 0x18]
mov dword [esp + 0x24], edi
lea esi, [edi + 0x1e14]
push esi
push eax
call sub.MFC42.DLL_operator
push str.User.ini
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x23c], 0
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea edx, [esp + 0x128]
push eax
push 0xff
push edx
push 0x430164
push 0x430160
push str.UserInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
push str.User
push esi
push ecx
call sub.MFC42.DLL_operator
push str.User.ini
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x23c], 1
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
push 0x430164
push 0x430160
push str.UserInfo
call ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
test ebp, ebp
jle 0x40fb2e
lea edi, [eax + 1]
lea eax, [esp + 0x28]
push edi
push str.item_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x10]
push str.User
push esi
push ecx
call sub.MFC42.DLL_operator
push str.User.ini
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x23c], 2
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push eax
lea eax, [esp + 0x2c]
push 0
push eax
push str.UserOrder
call ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
push str.User
lea ecx, [esp + 0x28]
push esi
push ecx
call sub.MFC42.DLL_operator
push str.User.ini
lea edx, [esp + 0x20]
push eax
push edx
mov dword [esp + 0x23c], 3
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push eax
lea eax, [esp + 0x2c]
push 0
push eax
push str.UserInfo
call ebx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, edi
cmp eax, ebp
jl 0x40fa57
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
call fcn.00422340
lea ecx, [esp + 0x18]
lea ebx, [edi + 0x5d58]
push ecx
mov ecx, ebx
mov dword [esp + 0x234], 4
call sub.MFC42.DLL_CWnd::GetWindowTextA
test ebp, ebp
jle 0x40fb73
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [edi + 0x5d78]
push 0
push 0
push 0x144
push edx
call esi
dec ebp
jne 0x40fb5e
mov eax, dword [esp + 0x18]
mov ecx, ebx
push eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
lea ecx, [esp + 0x18]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x411530
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4251ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0
lea ecx, [esp + 8]
call fcn.00422340
mov eax, dword [esp + 0x34]
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
mov dword [esp + 0x28], 1
je 0x411586
push 0x4333dc
lea ecx, [esp + 0xc]
call fcn.00422328
jmp 0x41170c
lea eax, [esp + 0x34]
push edi
push eax
mov ecx, esi
call fcn.00403d40
lea edi, [esi + 0x1e30]
push eax
mov ecx, edi
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
push edi
lea ecx, [esp + 0x3c]
push 0x4310c0
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::CString
lea edx, [esi + 0x6214]
lea eax, [esp + 0x1c]
push edx
push 0x4315ac
push eax
call sub.MFC42.DLL_operator_2
push 0x431e18
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_operator
lea edx, [esi + 0x6208]
mov byte [esp + 0x2c], 4
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_operator_1
push 0x431e18
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_operator
push edi
lea edx, [esp + 0x3c]
push eax
push edx
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 7
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x6218]
pop edi
test eax, eax
je 0x4116a1
push 0x432040
jmp 0x4116a6
push 0x43203c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0x5518]
test eax, eax
je 0x4116c0
push 0x432040
jmp 0x4116c5
push 0x43203c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0x55e8]
test eax, eax
je 0x4116df
push 0x432040
jmp 0x4116e4
push 0x43203c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0x64f0]
test eax, eax
je 0x4116fe
push 0x432038
jmp 0x411703
push 0x432034
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 8]
lea ecx, [esp + 0x34]
push eax
push str._JHJ__MakeRerunData_
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x30]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x1c], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x411920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x425218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.User
lea ecx, [esp + 0x10]
lea eax, [esi + 0x1e14]
push eax
push ecx
call sub.MFC42.DLL_operator
push 0x43012c
lea edx, [esp + 0xc]
push eax
push edx
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_operator
push str.EZNet41.ini
push eax
lea eax, [esp + 0xc]
mov byte [esp + 0x34], 1
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
xor ecx, ecx
mov al, 0x32
mov dword [esp + 0x10], ecx
mov byte [esi + 0x1e49], al
mov dword [esp + 0x14], ecx
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
push eax
mov dword [esp + 0x24], ecx
push str.Type
push str.APPTYPE
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esi + 0x1e4c]
test eax, eax
je 0x4119ee
mov cl, byte [esi + 0x1e49]
push ecx
push 0x430ad0
jmp 0x4119fa
mov dl, byte [esi + 0x1e49]
push edx
push 0x430988
lea ecx, [esi + 0x555c]
call fcn.00417420
mov ecx, esi
call fcn.00409250
lea ecx, [esp + 4]
mov dword [esi + 0x1df4], 0
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x411c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x425298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00422340
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call fcn.00422340
add esi, 0x1e14
push str.User
lea eax, [esp + 0x14]
mov bl, 1
push esi
push eax
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
push str.SoftwareEZ_EagleII
lea ecx, [esp + 0xc]
call fcn.00422328
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 3
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Exe_TradeStation
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_CString::CString_1
push SysReAllocString
mov byte [esp + 0x38], bl
call fcn.0041df40
add esp, 0x10
lea ecx, [esp + 8]
push str.SoftwareEZ_Smart
call fcn.00422328
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 5
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SmartOne_Trans
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_CString::CString_1
push SysReAllocString
mov byte [esp + 0x38], bl
call fcn.0041df40
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x4140f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x425868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
push str.SystemCurrentControlSetServicesClassModem
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_2
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], esi
call fcn.00422340
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call fcn.00422340
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.00422340
mov ebp, dword [sym.imp.MSVCRT.dll__mbsicmp]
mov bl, 3
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x18]
push esi
push eax
lea ecx, [esp + 0x1c]
push str._s_04d
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x40], 4
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DriverDesc
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x48], 5
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x2c]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
mov byte [esp + 0x4c], bl
call fcn.0041dff0
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4141f2
mov ecx, dword [edi + 0x78]
push ecx
push eax
call ebp
add esp, 8
test eax, eax
je 0x4141fe
inc esi
cmp esi, 0x1e
jl 0x414153
jmp 0x41424c
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.ATX3
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x40], 7
mov ecx, esp
mov dword [esp + 0x30], esp
push str.UserInit
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x48], 8
call sub.MFC42.DLL_CString::CString_1
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x48], bl
call fcn.0041df40
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x4149e0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00414a70
test eax, eax
je 0x414a6b
mov ecx, esi
call fcn.00414b60
test eax, eax
je 0x414a6b
mov ecx, esi
call fcn.00414b40
mov edi, dword [esp + 0xc]
test eax, eax
jne 0x414a1b
test edi, edi
jne 0x414a1b
push str._JHJ__ReRunIDPassCheck_False
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret 4
push 0
push 0x3fe
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 0x457
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov eax, dword [esi + 0x55e8]
mov ecx, dword [esi + 0x5518]
mov edx, dword [esi + 0xbc]
push eax
push ecx
push 0x538
push edx
mov dword [esi + 0x64ec], edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
ret 4
Function at 0x41a260
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
push str.kdfapi2.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfAutoStart
push eax
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
push str.kdfGetVersion
push eax
call edi
mov ecx, dword [esi + 4]
push str.kdfProtectModeOn
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 4]
push str.kdfProtectModeCheck
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
push str.kdfExOption
push eax
call edi
mov ecx, dword [esi + 4]
push str.kdfAddEditCtrl
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 4]
push str.kdfDelEditCtrl
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push str.kdfGetPassword
push eax
call edi
mov ecx, dword [esi + 4]
push str.kdfSetImageDir
push ecx
mov dword [esi + 0x24], eax
call edi
mov edx, dword [esi + 4]
push str.kdfSetPassword
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x41a333
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41a333
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41a333
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a333
mov al, byte [esp + 0xc]
test al, al
je 0x41a32c
mov dword [esi + 4], 0
pop edi
mov al, 1
pop esi
ret 4
pop edi
xor al, al
pop esi
ret 4

Function at 0x41af10
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4263b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
mov edx, dword [esp + 0x148]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
mov ebp, dword [esp + 0x14c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 3
lea esi, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [edx - 8]
lea ecx, [esp + 0x34]
mov dword [esp + 0x26], ebx
mov dword [esp + 0x2a], ebx
mov byte [esp + edx + 0x34], bl
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x32], ebx
mov word [esp + 0x28], 0x414
mov dword [esp + 0x20], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp eax, ebx
jle 0x41afda
push ebx
push 0x432bcc
push 0x432be4
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x134
ret
Function at 0x41b700
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x104]
push ebx
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
mov edi, str.Control.exe
xor eax, eax
lea edx, [esp + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.modem.cpl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x214]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4315ac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x214]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x214]
and ecx, 3
push 5
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
add esp, 0x410
ret