joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415db0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00420c90
mov cl, byte [0x4d665c]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x415def
mov dl, cl
mov ecx, 0x4d6658
or dl, al
mov byte [0x4d665c], dl
call sub.MFC42.DLL_CString::CString_3
push 0x415e80
call fcn.00420b7c
add esp, 4
mov eax, dword [0x4d6658]
push esi
push 0x4d6560
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x415e59
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4d2124
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x4d6658
call sub.MFC42.DLL_CString::operator
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x4d6658
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret

Function at 0x415e90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00420c90
mov cl, byte [0x4d6654]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x415ecf
mov dl, cl
mov ecx, 0x4d6650
or dl, al
mov byte [0x4d6654], dl
call sub.MFC42.DLL_CString::CString_3
push 0x415f60
call fcn.00420b7c
add esp, 4
mov eax, dword [0x4d6650]
push esi
push 0x4d6560
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x415f39
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x4d2124
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x4d6650
call sub.MFC42.DLL_CString::operator
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x4d6650
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret
Function at 0x416530
Capabilities:
Set current directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x471e2b
push eax
mov eax, 0x1704
mov dword fs:[0], esp
call fcn.00420c90
push esi
mov esi, ecx
lea eax, [esp + 0x208]
lea ecx, [esp + 0x108]
push eax
lea edx, [esp + 0x30c]
push ecx
mov ecx, dword [esi + 0x90]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x108]
mov ecx, 0x4d661c
push edx
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 8]
mov ecx, 0x4d6620
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x308]
push ecx
mov ecx, 0x4d6620
call fcn.0042022c
mov edx, dword [0x4d6620]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x4d6620
mov ecx, 0x4d6620
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0x708]
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [0x4d66a4]
mov al, 1
test al, cl
jne 0x416616
or cl, al
mov byte [0x4d66a4], cl
lea ecx, [esp + 0x708]
push ecx
mov ecx, 0x4d66a0
call sub.MFC42.DLL_CString::CString_4
push 0x416690
call fcn.00420b7c
add esp, 4
push 0x2e
mov ecx, 0x4d66a0
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 4]
push eax
push edx
mov ecx, 0x4d66a0
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x4d66a0
mov dword [esp + 0x1714], 0
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 4]
mov dword [esp + 0x1710], 0xffffffff
call sub.MFC42.DLL_CString::CString
push str..ini
mov ecx, 0x4d66a0
call fcn.0042022c
mov eax, dword [0x4d66a0]
mov ecx, dword [esp + 0x1708]
mov dword [esi + 0x94], eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1710
ret

Function at 0x4166a0
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x471e56
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.00420c90
push esi
call fcn.00437510
mov esi, eax
test esi, esi
je 0x416714
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
push esi
lea eax, [esp + 0xc]
push 0xf27b
push eax
mov dword [esp + 0x1020], 0
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 8]
mov dword [esp + 0x1014], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0xc]
push 0x1000
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::CString_4
push str.QMDispatch.dll
lea ecx, [esp + 8]
mov dword [esp + 0x1018], 1
call fcn.0042022c
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov dword [esp + 0x1014], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x100c]
pop esi
mov dword fs:[0], ecx
add esp, 0x1014
ret
Function at 0x416780
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x471e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [esp + 8]
push eax
call fcn.00415d00
add esp, 4
push str.ad_mymacro.xml
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x416899
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
push 0x95
lea eax, [esp + 0x10]
push 0x4d2888
push eax
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
push str.EXTERNAL
push ecx
mov edx, dword [eax + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov eax, dword [eax + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
mov ebp, eax
je 0x416888
mov edx, dword [esp + 0x10]
push 0x4d2830
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416888
push esi
push 1
push ebp
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x416db0
Capabilities:
Access peb ldr_data
Create process on windows
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x471f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
mov dword [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString_3
push 0xf231
lea ecx, [esp + 0xc]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x14], eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 0x18], eax
push ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x20], eax
push 0x4d6620
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x44
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x14]
mov eax, dword [eax]
push ecx
mov ecx, dword [0x4d6620]
lea edx, [esp + 0x28]
push edx
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0xc]
mov esi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x416ea0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x472032
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x66
mov dword [esp + 0x18], esi
call fcn.004203d6
lea ecx, [esi + 0x64]
mov dword [esp + 0x1c], 0
call fcn.004141a0
lea ebx, [esi + 0x130]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 0x134]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.004201d2
mov dword [edi], 0x479358
push fcn.0040b250
push fcn.0040b0f0
push 0x14
lea ecx, [esi + 0x178]
push 0x688
push ecx
mov byte [esp + 0x30], 3
call fcn.00420cee
lea ecx, [esi + 0x8418]
mov byte [esp + 0x1c], 4
call fcn.0040c970
lea ecx, [esi + 0x85b8]
mov byte [esp + 0x1c], 5
call fcn.0040ace0
lea ecx, [esi + 0x8b68]
mov byte [esp + 0x1c], 6
call fcn.0040d2d0
lea edi, [esi + 0x8dcc]
mov byte [esp + 0x1c], 7
mov ecx, edi
mov dword [esp + 0x24], edi
call sub.MFC42.DLL_CPropertySheet::CPropertySheet
lea ebp, [edi + 0x90]
mov byte [esp + 0x1c], 8
mov ecx, ebp
call fcn.004201d2
mov dword [ebp], 0x479b2c
mov dword [edi], 0x479a60
lea ecx, [esi + 0x8ea0]
mov byte [esp + 0x1c], 9
call fcn.00435be0
lea ecx, [esi + 0x8ef4]
mov byte [esp + 0x1c], 0xa
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x8f0c]
mov byte [esp + 0x1c], 0xb
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x8f10]
mov byte [esp + 0x1c], 0xc
call sub.MFC42.DLL_CString::CString_3
push 0x4d6560
mov ecx, ebx
mov byte [esp + 0x20], 0xd
mov dword [esi], 0x49a858
call sub.MFC42.DLL_CString::operator
call sub.MFC42.DLL_AfxGetModuleState
push 0x80
push 0xe
push 0x80
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x174], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x417d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4721f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 1
lea ecx, [esp + 0xc]
call fcn.00415120
mov ecx, dword [esi + 0x20]
lea eax, [esp + 4]
push eax
lea edx, [esi + 0x8ea0]
push ecx
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.00415230
mov eax, dword [esp + 4]
lea ecx, [esi + 0x8ef4]
mov word [esi + 0x60], ax
shr eax, 0x10
mov word [esi + 0x62], ax
lea eax, [esp + 0x24]
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004151b0
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x418300
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4722f7
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [esi + 0x8ef4]
push eax
push 0xffffffffffffffff
push str.AutoRunTime
push str.AutoRun
call edi
mov ebx, eax
test ebx, ebx
jl 0x4184a2
mov eax, dword [esi + 0x8ef4]
push eax
push 0
push str.PrimaryMacro
push str.AutoRun
call edi
test ebx, ebx
mov edi, eax
jle 0x418469
test edi, edi
jge 0x41836b
xor edi, edi
lea ebp, [esi + 0x8ea0]
push 0
push edi
mov ecx, ebp
call fcn.004184c0
mov ecx, eax
call fcn.004195a0
push eax
mov ecx, ebp
call fcn.004184c0
mov ecx, eax
call fcn.00419590
push ecx
add eax, 0x34
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_2
push ebx
lea ecx, [esp + 0x20]
call fcn.004041d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x104], 0
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 2
jne 0x418419
lea ecx, [esp + 0xf8]
mov dword [esp + 0x104], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xb4]
mov byte [esp + 0x104], 2
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x74]
mov byte [esp + 0x104], 1
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x14]
mov dword [esp + 0x104], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
jmp 0x4184a2
lea ecx, [esp + 0xf8]
mov dword [esp + 0x104], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xb4]
mov byte [esp + 0x104], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x74]
mov byte [esp + 0x104], 4
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x14]
mov dword [esp + 0x104], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
push 6
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
cmp edi, dword [esi + 0x8ec4]
jge 0x41848d
test edi, edi
jl 0x41848d
mov eax, dword [esi + 0x8ebc]
je 0x41848f
mov eax, dword [eax]
dec edi
jne 0x418486
jmp 0x41848f
xor eax, eax
push 0
add eax, 8
push 0
push eax
lea ecx, [esi + 0x8ea0]
call fcn.00436380
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xf8
ret
Function at 0x419710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x458
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x24], esi
call fcn.004201d2
lea ebx, [esi + 0x50]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString_3
push str.SYSQMMCHS32L
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 8
mov dword [esi], 0x49a998
call sub.MFC42.DLL_CString::operator
lea eax, [ebp - 0x464]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x464]
push ecx
mov ecx, ebx
call sub.MFC42.DLL_CString::operator
call fcn.0043ab40
add ebx, 6
call ebx
jmp 0x139c803f

Function at 0x41c7c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x472b48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
xor edi, edi
mov dword [esp + 0x14], edi
call fcn.00420358
lea eax, [esp + 0x1c]
lea ecx, [esi + 0xe8]
push eax
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ecx, [esi + 0xf0]
mov dword [esi + 0xf0], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov eax, 0x47983c
mov dword [esi + 0x104], edi
mov dword [esi + 0x100], eax
mov dword [esi + 0x10c], edi
mov dword [esi + 0x108], eax
mov dword [esi + 0x11c], edi
mov dword [esi + 0x118], 0x479768
lea ecx, [esi + 0x120]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
mov dword [esi + 0xc0], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc4], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc8], ecx
lea ecx, [esp + 0x1c]
mov dword [esi], 0x49af60
mov dword [esi + 0xec], eax
mov dword [esi + 0xcc], edx
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x420059
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4200b1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x4d6560
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4200a4
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4200b3
xor eax, eax
pop esi
leave
ret 4

Function at 0x4259f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47336b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x49b948
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x425a80
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x425a47
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x425a71
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x425a86
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x425a86
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x479754
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x479248
mov dword [esp + 0x1c], 0xffffffff
call fcn.00420580
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x427560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4734f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edi, 0x4d6560
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x3c], ebx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x4275df
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, 0x4d6560
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0x40]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x427635
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov edi, dword [ecx + 0xbc]
lea esi, [ecx + 0xb8]
mov ecx, esi
mov edx, dword [edi + 4]
push edx
push edi
call fcn.00429480
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.004294b0
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 8
inc edx
mov dword [esi + 8], edx
mov esi, dword [eax + 0xc0]
dec esi
cmp ecx, ebx
je 0x4276ac
mov al, byte [ecx - 1]
cmp al, bl
je 0x4276a2
cmp al, 0xff
je 0x4276a2
dec al
mov byte [ecx - 1], al
jmp 0x4276ac
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x42b690
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1060
call fcn.00420c90
mov eax, dword [esp + 0x1064]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
push edi
push 0x4d21e8
push eax
call esi
mov ebp, eax
xor edi, edi
add esp, 8
cmp ebp, edi
jne 0x42b6d6
push str.Error_opening_ciphertext_file_
call fcn.0042b820
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret
mov ecx, dword [esp + 0x1078]
push 0x4d2830
push ecx
call esi
mov ebx, eax
add esp, 8
cmp ebx, edi
jne 0x42b706
push str.Error_opening_plaintext_file_
call fcn.0042b820
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret
push 0x3e8
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x42b732
push str.Out_of_memory__n
call fcn.0042b820
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
push edx
mov edx, dword [esp + 0x1080]
mov dword [esp + 0x18], edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.004527c0
push ebp
push 0x3e8
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
mov al, byte [ebp + 0xc]
add esp, 0x10
test al, 0x20
jne 0x42b7c0
push 0
push 0x3e8
push esi
lea ecx, [esp + 0x24]
call fcn.00453300
push ebx
push edi
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov al, byte [ebx + 0xc]
add esp, 0x10
test al, 0x20
jne 0x42b7d8
mov al, byte [ebp + 0xc]
push ebp
test al, 0x10
jne 0x42b7f0
push 0x3e8
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
mov al, byte [ebp + 0xc]
add esp, 0x10
test al, 0x20
je 0x42b778
push str.Error_reading_ciphertext_
call fcn.0042b820
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret
push str.Error_writing_plaintext_
call fcn.0042b820
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret
mov edi, dword [sym.imp.MSVCRT.dll_fclose]
call edi
push ebx
call edi
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1060
ret