joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4209b0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x43cf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push 0x44a688
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
call fcn.00437396
add esp, 4
push str.dlgprj.dll
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x14c], eax
jne 0x420a64
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DLGAboutShow
push eax
call edi
mov dword [esi + 0x150], eax
mov eax, dword [esi + 0x14c]
push str.DLGSetting
push eax
call edi
mov ecx, dword [esi + 0x14c]
push str.DLGExit
push ecx
mov dword [esi + 0x154], eax
call edi
mov edx, dword [esi + 0x14c]
push str.DLGExitAnswer
push edx
mov dword [esi + 0x158], eax
call edi
mov dword [esi + 0x15c], eax
mov eax, dword [esi + 0x14c]
push str.DLGClose
push eax
call edi
lea ecx, [esp + 8]
mov dword [esi + 0x160], eax
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x421330
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43d040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0xc]
mov byte [esp + 0x18], 1
push eax
call fcn.00437396
add esp, 4
push str.datapet.exe
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 8]
push edx
call fcn.00437396
add esp, 4
push str.data
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x20], 4
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
call fcn.00421a20
test eax, eax
je 0x42140d
mov eax, dword [eax + 0x20]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
push 0
push ecx
push 0
push edx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4217b0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43d0ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x518
push ebx
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x322]
mov word [esp + 0x320], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x103
stosw word es:[edi], ax
lea eax, [esp + 0x324]
push eax
push 0
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0x320]
push 0x5c
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x42182e
lea edx, [esp + 0x320]
push 0x2f
push edx
call esi
add esp, 8
mov ebp, eax
mov word [ebp], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11a]
mov word [esp + 0x118], 0
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [0x44a854]
stosw word es:[edi], ax
lea eax, [esp + 0x11c]
push eax
push ecx
call ebx
mov edi, 2
lea edx, [esp + 0x118]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
jne 0x42188d
lea eax, [esp + 0x118]
push 0x2f
push eax
call esi
add esp, 8
dec edi
mov word [eax], 0
jne 0x42186b
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..config.ini
push 0
push str.Version
push 0x449204
call ebx
mov ecx, eax
mov eax, 0x431bde83
mul ecx
mov esi, edx
mov eax, ecx
xor edx, edx
mov edi, 0xf4240
div edi
mov eax, 0xd1b71759
shr esi, 0x12
mul edx
mov edi, edx
mov eax, ecx
xor edx, edx
mov ecx, 0x2710
div ecx
lea ecx, [esp + 0x118]
lea eax, [ebp + 2]
push ecx
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
shr edi, 0xd
push edx
push edi
push esi
lea edx, [esp + 0x344]
push eax
push edx
push eax
push 0x4491f4
call fcn.00438fe0
add esp, 0x34
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x534], 0
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str._sconfigDynamicInfo.ini
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x2710
push 0x4491cc
push 0x449204
call ebx
push 0
push eax
call fcn.004396d0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x530], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x518]
mov dword fs:[0], ecx
add esp, 0x524
ret
Function at 0x423180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d340
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
push 0
push 0
mov edi, ecx
push 0
push 0x3e7
lea eax, [esp + 0x28]
push edi
push eax
lea esi, [edi + 0xd27c]
push 0x50800000
push 0x44a688
push 0x4416b8
mov ecx, esi
mov dword [esp + 0x3c], 0x1cc
mov dword [esp + 0x40], 0xf0
mov dword [esp + 0x44], 0x2b2
mov dword [esp + 0x48], 0x21c
call sub.MFC42.DLL_CWnd::CreateControl
push 7
push 0x11
mov ecx, esi
call fcn.0042c320
push 1
mov ecx, esi
call fcn.0042c090
lea ecx, [edi + 0xd358]
push ecx
mov ecx, esi
call fcn.0042c120
push 0x3c747b
push 6
mov ecx, esi
call fcn.0042c320
push 0
push 5
mov ecx, esi
call fcn.0042c320
push 0xa16606
push 0xc
mov ecx, esi
call fcn.0042c320
push 0x3c747b
push 4
mov ecx, esi
call fcn.0042c320
push 0
push 3
mov ecx, esi
call fcn.0042c320
push 0xff
push 0xe
mov ecx, esi
call fcn.0042c320
push 0xff
push 9
mov ecx, esi
call fcn.0042c320
push 0x85ab9b
push 0xf
mov ecx, esi
call fcn.0042c320
lea edx, [esp + 0x28]
mov eax, 0xa
push edx
mov ecx, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x3e8
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0x1e
mov dword [esp + 0x2c], eax
call fcn.0042c1e0
lea eax, [esp + 0xc]
push eax
call fcn.00437396
add esp, 4
push str.picplayerlisttitle_bg.bmp
mov dword [esp + 0x48], 0
push eax
lea ecx, [esp + 0x10]
push ecx
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 2
call fcn.0042c350
lea eax, [esp + 0x14]
push eax
call fcn.00437396
add esp, 4
push str.picplayerlisttitle_line.bmp
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x50], 3
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 4
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 1
call fcn.0042c350
push 0x12
push 0
push 0x44a688
mov ecx, esi
call fcn.0042c200
push 0x3c
push 0x448798
mov ecx, esi
call fcn.0042be90
push 0x3c
push 0x4492d0
mov ecx, esi
call fcn.0042be60
push 0x3c
push 0x4492c8
mov ecx, esi
call fcn.0042be90
push 0x3c
push 0x4492c0
mov ecx, esi
call fcn.0042be60
push 0x3c
push 0x4492b8
mov ecx, esi
call fcn.0042be60
push 0x3c
push 0x4492ac
mov ecx, esi
call fcn.0042be90
push 2
push 3
mov ecx, esi
call fcn.0042c1b0
mov ecx, esi
call fcn.0042bef0
push 4
mov ecx, esi
call fcn.0042c250
push 1
mov ecx, esi
call fcn.0042c270
push esi
lea ecx, [edi + 0xd2bc]
call fcn.0042c5e0
push 0
push str.__s10_
mov ecx, esi
call fcn.0042c0b0
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x4237f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, ecx
push eax
mov ecx, 0x44a7e8
call fcn.0041e020
mov esi, eax
test esi, esi
jne 0x42380e
pop edi
pop esi
ret 8
test byte [esi + 0x20], 0x40
je 0x423828
mov ecx, dword [esi]
add edi, 0xd27c
push 4
push ecx
mov ecx, edi
call fcn.0042bff0
jmp 0x42383a
mov edx, dword [esi]
add edi, 0xd27c
push 4
push edx
mov ecx, edi
call fcn.0042c020
mov eax, dword [esi + 0x20]
push 3
test eax, 0x10000000
je 0x423852
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.0042bff0
jmp 0x42385c
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.0042c020
mov eax, dword [esi + 0x20]
push 2
test eax, 0x20000000
je 0x423874
mov edx, dword [esi]
mov ecx, edi
push edx
call fcn.0042bff0
jmp 0x42387e
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.0042c020
mov eax, dword [esi + 0x20]
push 8
test eax, 0x40000000
je 0x423896
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.0042bff0
jmp 0x4238a0
mov edx, dword [esi]
mov ecx, edi
push edx
call fcn.0042c020
mov eax, dword [esi + 0x20]
push 8
test eax, 0x80000000
je 0x4238c0
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.0042bff0
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.0042c020
pop edi
mov eax, 1
pop esi
ret 8

Function at 0x4243c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
xor eax, eax
mov dword [esp], eax
mov dword [esp], 0x10
mov dword [esp + 4], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], edx
call fcn.0042cf60
lea eax, [esp]
push 2
push eax
push 0x10
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
call fcn.0042cfe0
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x44a7e0
call fcn.0042ce10
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0042cfa0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x425fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp], eax
push esi
mov dword [esp + 8], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xe
call fcn.0042cf60
lea edx, [esp + 4]
push 0xffffffffffffffff
push edx
push 0xe
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.0042cfe0
lea eax, [esp + 0x10]
mov ecx, 0x44a7e0
push eax
call fcn.0042ce10
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042cfa0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x42c650
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43daf0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x14]
sub eax, ecx
jne 0x42c69f
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x24]
sub ecx, eax
jne 0x42c69f
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esi]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
lea edi, [esi + 0x44]
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
push ebx
mov ebx, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
call ebx
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4417f0
lea ecx, [esi + 0x24]
mov dword [esp + 0x2c], 0
push ecx
call ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
test edi, edi
jne 0x42c743
xor ecx, ecx
jmp 0x42c746
mov ecx, dword [edi + 4]
mov edx, dword [esi + 0x48]
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CombineRgn]
test edi, edi
je 0x42c75b
mov edi, dword [edi + 4]
mov eax, dword [esi]
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, dword [esi]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0xc], 0x43fb34
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x42ced0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43db48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0042cf60
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 4], eax
lea edx, [esp + 4]
push 0xffffffffffffffff
mov dword [esp + 0xc], eax
push edx
mov dword [esp + 0x10], ecx
push 0xb
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
mov dword [esp + 0x14], 0xb
call fcn.0042cfe0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0042cfa0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x42da10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43dbe6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x18
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi], 0x441910
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x42da78
mov ecx, eax
call fcn.0042f940
jmp 0x42da7a
xor eax, eax
push 0x58
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 4], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], 1
je 0x42dabc
mov ecx, eax
call fcn.004343e0
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42ded0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43dc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea edx, [esp + 8]
push str._s_s
push edx
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
add esp, 0x10
push eax
push ecx
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x42e610
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebp, dword [esp + 0x220]
mov ebx, ecx
test ebp, ebp
mov dword [esp + 0xc], ebx
je 0x42e7f6
mov eax, dword [esp + 0x224]
mov ecx, dword [ebp + 4]
cmp eax, ecx
jne 0x42e7f6
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42e684
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
je 0x42e670
mov byte [eax], 0
lea eax, [esp + 0x1c]
push 0x5c
push eax
call esi
add esp, 8
test eax, eax
je 0x42e684
mov byte [eax + 1], 0
lea ecx, [esp + 0x120]
push 0x104
push ecx
lea edx, [esp + 0x24]
push str.QQGame.exe
push edx
call fcn.0042ded0
add esp, 0x10
xor esi, esi
lea eax, [esp + 0x120]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x42e7b5
lea ecx, [edi + 1]
push ecx
call sub.MFC42.DLL_operatornew
mov ebp, eax
xor eax, eax
add esp, 4
cmp ebp, eax
mov byte [edi + ebp], 0
je 0x42e7ae
push ebp
push edi
lea edx, [esp + 0x128]
push eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42e769
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x44a110
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42e769
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
mov esi, eax
and eax, 0xffff
mov ecx, edi
mov ebx, eax
shr ecx, 0x10
mov eax, 0x51eb851f
mul ecx
shr edx, 5
shr esi, 0x10
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
shl eax, 2
sub ecx, eax
lea eax, [esi + esi*4]
and edi, 0xffff
lea eax, [eax + eax*4]
lea eax, [ebx + eax*4]
mov ebx, dword [esp + 0x14]
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [ecx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [edi + eax*4]
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
cmp esi, 0x13154e8
jl 0x42e7ae
mov edx, dword [esp + 0x22c]
mov eax, dword [ebx + 0x24]
push edx
mov edx, dword [esp + 0x22c]
mov ecx, dword [eax]
mov edx, dword [edx]
push edx
push str._ii_
push 0xa
push eax
call dword [ecx + 0x1c]
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
mov ebp, dword [esp + 0x228]
mov edx, dword [esp + 0x22c]
mov eax, dword [ebx + 0x24]
push edx
push 0x44a104
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp]
mov eax, dword [ebx + 0x24]
add esp, 0x10
mov ecx, dword [eax]
push edx
push 0x44a104
push 4
push eax
call dword [ecx + 0x1c]
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret 8
Function at 0x436030
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x3ff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push str.jzhang_wk.exe_:
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x418]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x414]
push edx
not ecx
dec ecx
mov edx, 0x400
push eax
sub edx, ecx
lea eax, [esp + ecx + 0x18]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x1c
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x43767f
Capabilities:
Get file version info

Disassembly:
mov eax, 0x43e0dc
call fcn.0043af80
sub esp, 0x24
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [ebp - 0x18]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
cmp esi, edi
mov byte [ebp - 4], 1
jne 0x4376b6
or esi, 0xffffffff
jmp 0x437739
lea eax, [esi + 2]
push ebx
push eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x10], eax
push eax
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x44a110
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x14]
push 0x64
xor edx, edx
pop ebx
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, eax
mov edi, ecx
and eax, 0xffff
push dword [ebp - 0x10]
shr edi, 0x10
mov dword [ebp - 0x2c], eax
mov eax, edi
div ebx
and ecx, 0xffff
shr esi, 0x10
mov dword [ebp - 0x20], ecx
mov ebx, eax
imul eax, eax, 0x64
sub edi, eax
call sub.MFC42.DLL_operatordelete
imul esi, esi, 0x64
add esi, dword [ebp - 0x2c]
pop ecx
lea eax, [esi + esi*4]
lea esi, [ebx + eax*2]
pop ebx
imul esi, esi, 0x64
add esi, edi
imul esi, esi, 0x64
add esi, dword [ebp - 0x20]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x439380
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x45b1b8]
sub esp, 0x208
cmp dword [eax + 0x1c], 0x2710
ja 0x4393fa
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x45b1ac]
pop edi
test eax, eax
jne 0x4393ba
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push str._s....configDynamicInfo.ini
lea ecx, [esp + 8]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [0x45b1b8]
add esp, 0x10
lea edx, [esp]
mov ecx, dword [eax + 0x1c]
push edx
push ecx
push str.LastQQUin
push str.Public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [0x45b1b8]
mov dword [edx + 0x1c], eax
add esp, 0x208
ret