joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429560
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x51a10c]
mov dword [esp + 0x1c], eax
xor eax, eax
cmp byte [0x4cdd74], 0
jne 0x429691
mov byte [0x4cdd74], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x42965f
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x18]
mov dword [esp], 2
test edx, edx
je 0x42964f
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4cef65
call sym._fwrite
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4c2f3c
jmp 0x4c2f34
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x429615
mov dword [esp], 2
call dword [0x4cc21c]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4c2f23
mov dword [esp], 2
call dword [0x4cc21c]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
mov eax, dword [esp + 0x1c]
sub eax, dword [0x51a10c]
jne 0x4296cf
call sym._abort
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4310d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [0x51a10c]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x78]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x70]
mov ebp, dword [ebp + 8]
mov dword [esp + 0x38], eax
test cl, 2
je 0x431130
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, ecx
and eax, 1
je 0x431170
cmp dword [esp + 0x1c], 1
jbe 0x431152
mov eax, 0xfffffeff
add edx, 2
mov word [edx - 2], ax
nop
mov dword [esp], ecx
lea eax, [esp + 0x2c]
mov ecx, ebp
mov dword [esp + 0x34], edx
lea edx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call method.std._anonymous_namespace_::ucs2_out_std::_anonymous_namespace_::range_char16_t_const__true___std::_anonymous_namespace_::range_char16_t__false___char32_t__std::codecvt_mode___clone_.part.0_
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov dword [esi], edi
mov dword [ebx], edx
mov edx, dword [esp + 0x3c]
sub edx, dword [0x51a10c]
jne 0x43118a
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
cmp dword [esp + 0x1c], 1
mov eax, 1
jbe 0x431152
mov eax, 0xfffffffe
add edx, 2
mov word [edx - 2], ax
jmp 0x431130
call dbg.__stack_chk_fail
nop
Function at 0x431300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [0x51a10c]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x78]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x70]
mov ebp, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
test cl, 2
je 0x431360
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, ecx
and eax, 1
je 0x4313a0
cmp dword [esp + 0x1c], 1
jbe 0x431382
mov eax, 0xfffffeff
add edx, 2
mov word [edx - 2], ax
nop
mov dword [esp], ecx
lea eax, [esp + 0x34]
mov ecx, ebp
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x34], edi
call method.std._anonymous_namespace_::ucs2_out_std::_anonymous_namespace_::range_char16_t_const__true___std::_anonymous_namespace_::range_char16_t__false___char32_t__std::codecvt_mode___clone_.part.0_
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov dword [esi], edi
mov dword [ebx], edx
mov edx, dword [esp + 0x3c]
sub edx, dword [0x51a10c]
jne 0x4313ba
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
cmp dword [esp + 0x1c], 1
mov eax, 1
jbe 0x431382
mov eax, 0xfffffffe
add edx, 2
mov word [edx - 2], ax
jmp 0x431360
call dbg.__stack_chk_fail
nop
Function at 0x44c360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x60]
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], eax
mov eax, dword [0x51a10c]
mov dword [esp + 0x3c], eax
mov eax, dword [edi]
mov dword [esp + 0x30], eax
call dword [0x4cc204]
mov edx, dword [esp + 0x1c]
mov ecx, eax
mov eax, edx
sub eax, ebp
sar eax, 1
imul eax, ecx
mov ecx, esi
sub ecx, ebx
cmp eax, ecx
jle 0x44c480
cmp ebp, edx
setb al
cmp ebx, esi
jae 0x44c45a
test al, al
je 0x44c45a
lea eax, [esp + 0x30]
mov dword [esp + 0x24], edi
mov edi, ebx
mov dword [esp + 0x20], eax
jmp 0x44c428
mov eax, esi
sub eax, edi
cmp eax, ebx
jb 0x44c4d0
lea eax, [esp + 0x37]
mov dword [esp], edi
add ebp, 2
add edi, ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
cmp ebp, eax
setb al
cmp edi, esi
jae 0x44c458
test al, al
je 0x44c458
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
movzx eax, word [ebp]
mov dword [esp + 4], eax
lea eax, [esp + 0x37]
mov dword [esp], eax
call dbg.wcrtomb
mov ebx, eax
cmp eax, 0xffffffff
jne 0x44c3e8
mov ebx, edi
mov eax, 2
jmp 0x44c45d
mov ebx, edi
and eax, 1
mov ecx, dword [esp + 0x28]
mov dword [ecx], ebp
mov ecx, dword [esp + 0x2c]
mov dword [ecx], ebx
mov edx, dword [esp + 0x3c]
sub edx, dword [0x51a10c]
jne 0x44c4d9
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x1c]
cmp ebp, eax
jae 0x44c4c8
lea esi, [esp + 0x30]
jmp 0x44c4a3
mov ecx, dword [esp + 0x30]
add ebx, eax
mov eax, dword [esp + 0x1c]
add ebp, 2
mov dword [edi], ecx
cmp ebp, eax
jae 0x44c4c8
mov dword [esp + 8], esi
movzx eax, word [ebp]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dbg.wcrtomb
cmp eax, 0xffffffff
jne 0x44c490
mov eax, 2
jmp 0x44c45d
xor eax, eax
jmp 0x44c45d
mov ebx, edi
mov eax, 1
jmp 0x44c45d
call dbg.__stack_chk_fail
nop
nop
Function at 0x4871d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov esi, dword [sym.imp.msvcrt.dll__read]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call esi
mov edx, eax
cmp eax, 0xffffffff
je 0x487210
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 0x1c], eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [esp + 0x1c]
cmp dword [eax], 4
je 0x4871e7
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4be5d0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call sym.___cxa_get_globals
mov edx, dword [eax]
add dword [eax + 4], 1
test edx, edx
je sym.___cxa_rethrow.cold
mov ecx, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
mov esi, 1
add ecx, 0xbcd4d500
mov edi, ecx
adc ebx, 0xb8b1aabc
xor ecx, ecx
cmp esi, edi
sbb ecx, ebx
jae 0x4be627
xor ecx, ecx
mov dword [eax], ecx
lea ebx, [edx + 0x30]
mov dword [esp], ebx
call sym.__Unwind_Resume_or_Rethrow
mov dword [esp], ebx
call sym.___cxa_begin_catch
jmp sym.___cxa_rethrow.cold
neg dword [edx + 0x14]
jmp 0x4be60f

Function at 0x4be680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [0x51a10c]
mov dword [esp + 0x4c], edi
mov edi, dword [esp + 0x78]
mov esi, dword [esp + 0x70]
mov ebp, dword [esp + 0x74]
test esi, esi
je 0x4be755
mov edx, dword [esi]
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ebx, [esi + eax]
mov dword [esp + 0x40], 0
mov edx, dword [ebx]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x10
cmp dword [edx - 4], ecx
jne 0x4be755
mov edx, dword [esp + 0x7c]
test edx, edx
js 0x4be6f1
add eax, dword [esp + 0x7c]
je 0x4be7a0
mov eax, dword [ecx]
mov dword [esp + 0xc], ebx
lea edx, [esp + 0x38]
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], 6
call dword [eax + 0x1c]
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x4be755
mov ecx, dword [esp + 0x44]
mov eax, ecx
not eax
test al, 6
je 0x4be757
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
and edx, eax
not edx
and edx, 6
je 0x4be757
and eax, 5
cmp eax, 4
je 0x4be755
test ecx, ecx
je 0x4be778
xor ebx, ebx
mov eax, dword [esp + 0x4c]
sub eax, dword [0x51a10c]
jne 0x4be7fc
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x7c]
test eax, eax
js 0x4be7c0
add ebx, dword [esp + 0x7c]
cmp esi, ebx
jne 0x4be755
lea esi, cs:[esi]
mov ebx, dword [esp + 0x2c]
jmp 0x4be757
mov dword [esp], edi
mov dword [esp + 0x2c], ecx
call method.std::type_info.operator_std::type_info_const__const
sub esp, 4
test al, al
mov ecx, dword [esp + 0x2c]
je 0x4be6f1
jmp 0x4be757
cmp dword [esp + 0x7c], 0xfffffffe
je 0x4be755
mov eax, dword [edi]
mov dword [esp + 0xc], esi
mov ecx, edi
mov esi, dword [esp + 0x2c]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov esi, dword [esp + 0x7c]
mov dword [esp], esi
call dword [eax + 0x20]
not eax
sub esp, 0x10
test al, 6
jne 0x4be755
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
jmp 0x4be790
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x405845
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
movzx esi, word [esp + 0x14]
push 2
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push 2
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
jne 0x405878
xor ebp, ebp
push 2
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x40589c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40589c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40589c
push eax
call fcn.004057f6
cmp ax, 0x10
pop ecx
je 0x4058a0
xor eax, eax
jmp 0x4058a9
push 0
push edi
push ebp
call sub.MFC42.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405c3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
xor esi, esi
cmp dword [0x4235b4], esi
je 0x405c59
mov eax, dword [0x4235b0]
jmp 0x405d0c
push ebx
push 1
pop ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftPlus_ThemesCurrent
push closesocket
mov dword [0x4235b4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405d06
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
mov dword [ebp - 0xc], 0x104
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405cfc
push 5
mov esi, str.Windows_Classic.theme
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x134]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x24]
push eax
call esi
cmp edi, eax
jl 0x405cfc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
sub edi, eax
lea eax, [ebp + edi - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405cfc
mov dword [0x4235b0], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [0x4235b0]
pop ebx
pop esi
leave
ret
Function at 0x408860
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x418768
call fcn.00417ad0
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
push str.LOAD
lea ecx, [ebp - 0x18]
call fcn.004175cc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_3
mov eax, 0x104
lea ecx, [ebp - 0x14]
push eax
push eax
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CString::Mid
push str.Myim.ini
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::Replace
push str.Font
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
lea eax, [esi + 0x2cc]
mov ebx, 0x423548
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x14
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Size
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
lea eax, [esi + 0x2e0]
push 0x14
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Bold
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
xor ebx, ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call edi
push str.Italic
lea ecx, [ebp - 0x10]
mov dword [esi + 0x2f8], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Underline
lea ecx, [ebp - 0x10]
mov dword [esi + 0x2fc], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Color
lea ecx, [ebp - 0x10]
mov dword [esi + 0x300], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x2f4], eax
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40a0f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov ebx, str.C:UsersPublicDocuments_sdfjketyd.zip
push str.dfnxssdfy43rf
push ebx
call fcn.004165f9
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x40a192
push dword [ebp + 8]
push edi
call fcn.004166a0
pop ecx
test eax, eax
pop ecx
jne 0x40a18b
lea eax, [ebp - 0x12c]
push eax
push 0xffffffffffffffff
push edi
call fcn.0041660e
add esp, 0xc
test eax, eax
jne 0x40a18b
mov eax, dword [ebp - 0x12c]
xor esi, esi
test eax, eax
mov dword [ebp + 8], eax
jle 0x40a175
lea eax, [ebp - 0x12c]
push eax
push esi
push edi
call fcn.0041660e
lea eax, [ebp - 0x128]
push eax
push esi
push edi
call fcn.00416687
add esp, 0x18
test eax, eax
jne 0x40a18b
inc esi
cmp esi, dword [ebp + 8]
jl 0x40a14c
push edi
call fcn.004166cf
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
push edi
call fcn.004166cf
pop ecx
xor eax, eax
jmp 0x40a186
Function at 0x40b215
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, 0x2b11
xor ebx, ebx
push 0xc
mov word [0x423680], 1
mov word [0x423682], 2
mov dword [0x423684], eax
mov dword [0x423688], eax
mov word [0x42368c], 2
mov word [0x42368e], 8
mov word [0x423690], bx
xor esi, esi
mov edi, 0x1000
pop ebp
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
push edi
mov dword [esi + 0x4236ac], eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [esi + 0x4236a4], eax
pop ecx
mov ecx, dword [esi + 0x4236ac]
cmp ecx, ebx
je 0x40b295
cmp eax, ebx
jne 0x40b2b7
cmp ecx, ebx
je 0x40b295
push ecx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
cmp dword [esi + 0x4236a4], ebx
je 0x40b2aa
push dword [esi + 0x4236ac]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push ebx
push 0x40
push 0x422554
call sub.MFC42.DLL_AfxMessageBox
push 0x20
call sub.MFC42.DLL_operatornew
push 0x20
mov dword [esi + 0x42369c], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [esi + 0x423694], eax
pop ecx
mov ecx, dword [esi + 0x4236ac]
push 1
mov dword [eax], ecx
mov eax, dword [esi + 0x423694]
add esi, 4
mov dword [eax + 4], edi
mov eax, dword [esi + 0x423690]
cmp esi, 4
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x423690]
mov dword [eax + 0xc], ebx
mov eax, dword [esi + 0x423690]
mov dword [eax + 0x10], ebp
mov ecx, dword [esi + 0x423690]
pop eax
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 0x423690]
mov dword [ecx + 0x18], ebx
mov ecx, dword [esi + 0x423690]
mov dword [ecx + 0x1c], ebx
mov ecx, dword [esi + 0x423698]
mov edx, dword [esi + 0x4236a0]
mov dword [ecx], edx
mov ecx, dword [esi + 0x423698]
mov dword [ecx + 4], edi
mov ecx, dword [esi + 0x423698]
mov dword [ecx + 8], ebx
mov ecx, dword [esi + 0x423698]
mov dword [ecx + 0xc], ebx
mov ecx, dword [esi + 0x423698]
mov dword [ecx + 0x10], ebp
mov ecx, dword [esi + 0x423698]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x423698]
mov dword [eax + 0x18], ebx
mov eax, dword [esi + 0x423698]
mov dword [eax + 0x1c], ebx
jle 0x40b25f
mov eax, dword [0x423800]
mov edi, 0x10000
push edi
push ebx
push dword [eax + 0x20]
mov esi, 0x423680
push esi
push 0xffffffffffffffff
push 0x4236b4
call dword [sym.imp.WINMM.dll_waveOutOpen]
cmp eax, ebx
jne 0x40b3b4
mov eax, dword [0x423800]
push edi
push ebx
push dword [eax + 0x20]
push esi
push 0xffffffffffffffff
push 0x4236b8
call dword [sym.imp.WINMM.dll_waveInOpen]
xor esi, esi
cmp eax, ebx
jne 0x40b3e6
push 0x20
push dword [esi + 0x423694]
push dword [0x4236b4]
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
cmp eax, ebx
jne 0x40b3e6
push 0x20
push dword [esi + 0x42369c]
push dword [0x4236b8]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
cmp esi, 4
jle 0x40b3b6
cmp eax, ebx
jne 0x40b40c
push 0xffff
push dword [0x4236b4]
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
cmp eax, ebx
jne 0x40b40c
push 1
pop eax
jmp 0x40b41b
push ebx
push 0x40
push 0x422534
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40c9b2
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x418e78
call fcn.00417ad0
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
push str.LOAD
lea ecx, [ebp - 0x18]
call fcn.004175cc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_3
mov eax, 0x104
lea ecx, [ebp - 0x14]
push eax
push eax
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CString::Mid
push str.Myim.ini
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::Replace
push str.Font
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
lea eax, [esi + 0x254]
mov ebx, 0x423548
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x14
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Size
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
lea eax, [esi + 0x268]
push 0x14
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Bold
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
xor ebx, ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call edi
push str.Italic
lea ecx, [ebp - 0x10]
mov dword [esi + 0x280], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Underline
lea ecx, [ebp - 0x10]
mov dword [esi + 0x284], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push str.Color
lea ecx, [ebp - 0x10]
mov dword [esi + 0x288], eax
call sub.MFC42.DLL_CString::operator_2
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x27c], eax
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret