joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60a3dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x60a628
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x60a454
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x60a454
push 1
push 0x60a640
push dword [ebp - 4]
push 0x60a654
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0x14]
mov cl, 1
mov eax, esi
call fcn.006658ec
jmp 0x60a600
mov eax, dword [esi + 0x10d0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x60a478
push 1
xor ecx, ecx
mov edx, 0x60a69c
mov eax, esi
call fcn.006658ec
jmp 0x60a600
cmp byte [esi + 0x10d4], 0
jne 0x60a496
push 1
xor ecx, ecx
mov edx, 0x60a6bc
mov eax, esi
call fcn.006658ec
jmp 0x60a600
mov eax, dword [esi + 0x2e0]
cmp byte [eax + 0x4e], 0
je 0x60a4b7
push 1
xor ecx, ecx
mov edx, 0x60a6dc
mov eax, esi
call fcn.006658ec
jmp 0x60a600
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x10cc]
cmp eax, 0x2710
jae 0x60a4de
push 1
xor ecx, ecx
mov edx, 0x60a6f8
mov eax, esi
call fcn.006658ec
jmp 0x60a600
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x10cc], eax
mov byte [ebp - 0xd], 0
mov eax, dword [esi + 0x10d0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jl 0x60a5ea
inc edi
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x10d0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
test ebx, ebx
je 0x60a5e0
mov byte [ebp - 0xd], 1
cmp byte [ebx + 0x2e4], 0
jne 0x60a542
cmp byte [ebx + 0x2ec], 0
jne 0x60a542
cmp byte [ebx + 0xbbe], 0
jne 0x60a57f
push 1
push 0x60a714
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi + 0x10d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1c]
push 0x60a720
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, esi
call fcn.006658ec
jmp 0x60a600
cmp byte [ebx + 0x10c5], 0
je 0x60a593
mov edx, ebx
mov eax, esi
call fcn.0065da3c
jmp 0x60a5e0
push 1
mov edx, 0x60a738
lea eax, [ebp - 0x34]
call fcn.004039c4
lea edx, [ebx + 0x15]
lea eax, [ebp - 0x34]
mov cl, 0x10
call fcn.00403994
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x58]
call fcn.004039c4
mov edx, 0x60a73c
lea eax, [ebp - 0x58]
mov cl, 0x22
call fcn.00403994
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x20]
call fcn.004055f8
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, esi
call fcn.006658ec
inc dword [ebp - 0xc]
dec edi
jne 0x60a50b
cmp byte [ebp - 0xd], 0
jne 0x60a600
push 1
xor ecx, ecx
mov edx, 0x60a758
mov eax, esi
call fcn.006658ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60a62f
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004053b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b8
ret
Function at 0x60ab44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x60ad12
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x60abb5
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x60abb5
push 1
push 0x60ad28
push dword [ebp - 4]
push 0x60ad3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0xc]
mov cl, 1
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
cmp byte [ebx + 0x10b0], 0
jne 0x60abd3
push 1
xor ecx, ecx
mov edx, 0x60ad7c
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x4d], 0
je 0x60abf4
push 1
xor ecx, ecx
mov edx, 0x60ad94
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
cmp dword [ebx + 0x10c0], 0
jne 0x60ac2d
cmp byte [ebx + 0x2d], 0
jne 0x60ac18
push 1
xor ecx, ecx
mov edx, 0x60adb0
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
push 1
xor ecx, ecx
mov edx, 0x60adc8
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
mov eax, dword [ebx + 0x10c0]
cmp byte [eax + 0x2e4], 0
jne 0x60ac4e
cmp byte [eax + 0x2ec], 0
jne 0x60ac4e
cmp byte [eax + 0xbbe], 0
jne 0x60ac7b
cmp byte [ebx + 0x2d], 0
jne 0x60ac69
push 1
xor ecx, ecx
mov edx, 0x60ade0
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
push 1
xor ecx, ecx
mov edx, 0x60ae04
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x10c8]
cmp eax, 0x2710
jae 0x60ac9f
push 1
xor ecx, ecx
mov edx, 0x60ae28
mov eax, ebx
call fcn.006658ec
jmp 0x60acf7
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x10c8], eax
mov esi, dword [ebx + 0x10c0]
cmp byte [esi + 0x10c4], 0
je 0x60acc4
mov edx, esi
mov eax, ebx
call fcn.0065da3c
jmp 0x60acf7
push 1
lea edx, [esi + 0x15]
lea eax, [ebp - 0x30]
call fcn.004039c4
mov edx, 0x60ae3c
lea eax, [ebp - 0x30]
mov cl, 0x1e
call fcn.00403994
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
call fcn.004055f8
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60ad19
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004053b8
ret
Function at 0x60b6d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x60b915
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x238], 0
je 0x60b8e2
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x4b], 0
jne 0x60b8d0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x234]
mov ecx, 0x3e8
xor edx, edx
div ecx
imul edx, eax, 0x3e8
add dword [ebx + 0x234], edx
movzx edx, word [ebx + 0xec]
cmp eax, edx
jae 0x60b745
sub word [ebx + 0xec], ax
jmp 0x60b74e
mov word [ebx + 0xec], 0
movzx esi, word [ebx + 0xec]
test si, si
jne 0x60b8a3
cmp ebx, dword [ebx + 0x268]
jne 0x60b891
mov eax, dword [ebx + 0x26c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jle 0x60b871
mov dword [ebp - 4], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x26c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
cmp byte [esi + 0xf0], 0
je 0x60b83c
cmp byte [esi + 0x2e4], 0
jne 0x60b7bf
cmp byte [esi + 0x2ec], 0
jne 0x60b7bf
cmp byte [esi + 0xbbe], 0
jne 0x60b7ec
push 1
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x60b92c
call fcn.0040bb18
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60b867
mov eax, dword [esi + 0x2e0]
cmp byte [eax + 0x4b], 0
je 0x60b825
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x60b950
call fcn.0040bb18
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60b867
lea eax, [ebp - 0x18]
lea edx, [esi + 0x15]
call fcn.004055f8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0065d994
jmp 0x60b867
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x60b978
call fcn.0040bb18
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
inc dword [ebp - 4]
dec edi
jne 0x60b787
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x234], eax
mov eax, dword [select]
movzx eax, word [eax + 0x5f10]
mov word [ebx + 0xec], ax
jmp 0x60b8f2
push 1
xor ecx, ecx
mov edx, 0x60b998
mov eax, ebx
call fcn.006658ec
jmp 0x60b8f2
push 1
lea eax, [ebp - 0x20]
push eax
movzx eax, si
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x60b9b8
call fcn.0040bb18
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60b8f2
push 1
xor ecx, ecx
mov edx, 0x60b9e0
mov eax, ebx
call fcn.006658ec
jmp 0x60b8f2
push 1
xor ecx, ecx
mov edx, 0x60ba00
mov eax, ebx
call fcn.006658ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b91c
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004053b8
lea eax, [ebp - 8]
call fcn.00405394
ret
Function at 0x60baf8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x60bc9a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x333], 0
jne 0x60bb49
cmp byte [ebx + 0x261], 6
jb 0x60bc6f
cmp dword [ebp - 8], 0
jne 0x60bb7c
push 1
push 0x60bcb0
push dword [ebp - 4]
push 0x60bcc4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60bc7f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x39c]
cmp eax, 0x2710
ja 0x60bb9b
cmp byte [ebx + 0x261], 3
jb 0x60bc2f
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x39c], eax
mov eax, dword [0x6c0ec4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.005f0768
mov esi, eax
test esi, esi
je 0x60bc0f
push 1
push dword [ebp - 8]
push 0x60bcd8
mov eax, dword [esi + 0x2e0]
push dword [eax + 8]
push 0x60bcec
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x24]
call fcn.0040a784
push dword [ebp - 0x14]
push 0x60bcf8
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x28]
call fcn.0040a784
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00405728
mov edx, dword [ebp - 0x10]
mov cl, 2
mov eax, ebx
call fcn.006658ec
jmp 0x60bc7f
push 1
lea eax, [ebp - 0x1c]
mov ecx, 0x60bd04
mov edx, dword [ebp - 8]
call fcn.004056ac
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60bc7f
push 1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x39c]
mov ecx, 0x3e8
xor edx, edx
div ecx
sub eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040a954
lea eax, [ebp - 0x20]
mov edx, 0x60bd30
call fcn.00405660
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.006658ec
jmp 0x60bc7f
push 1
xor ecx, ecx
mov edx, 0x60bd54
mov eax, ebx
call fcn.006658ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bca1
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004053b8
ret
Function at 0x60f688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x60f7c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x60f728
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a98]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x60f71e
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a98]
mov edx, edi
call fcn.0041fbf0
mov ebx, eax
test ebx, ebx
je 0x60f71a
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x8e]
imul edx, dword [ebx + 0x8a], 0x3c
imul edx, edx, 0x3e8
cmp eax, edx
jbe 0x60f71a
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x8e], eax
mov eax, dword [ebx + 0x82]
mov dword [ebx + 0x86], eax
inc edi
dec esi
jne 0x60f6d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60f7a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f7c8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004053b8
ret
Function at 0x627958
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x627a47
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x627a60
push dword [ebp + 8]
push 0x627a70
lea eax, [ebp - 8]
lea edx, [ebx + 0x15]
call fcn.004055f8
push dword [ebp - 8]
push 0x627a84
lea eax, [ebp - 0xc]
lea edx, [ebx + 4]
call fcn.004055f8
push dword [ebp - 0xc]
push 0x627a94
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x24]
call fcn.0040a784
push dword [ebp - 0x10]
push 0x627aa4
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x28]
call fcn.0040a784
push dword [ebp - 0x14]
push 0x627ab0
push dword [esi + 0xc]
push 0x627ac0
push dword [esi + 0x18]
push 0x627ad0
push dword [esi + 0x24]
push 0x627ae0
push dword [esi + 0x30]
push 0x627af0
push dword [esi + 0x3c]
lea eax, [ebp - 4]
mov edx, 0x14
call fcn.00405728
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x627b00
call fcn.004056ac
mov eax, dword [ebp - 0x18]
call fcn.0049fdd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x627a4e
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004053b8
lea eax, [ebp + 8]
call fcn.00405394
ret
Function at 0x63c104
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
lea eax, [ebp - 0x20]
mov edx, dword [0x48b4e4]
call fcn.0040603c
xor eax, eax
push ebp
push 0x63c25e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xcb8], 0
jne 0x63c14b
cmp byte [ebx + 0xcba], 0
jne 0x63c14b
cmp byte [ebx + 0xcb9], 0
je 0x63c175
cmp byte [ebx + 0xcba], 0
je 0x63c169
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dx, 0x13d6
mov eax, ebx
call fcn.0063ce1c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
jmp 0x63c23a
xor eax, eax
push ebp
push 0x63c21b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x107d], 0
jne 0x63c1a7
mov eax, ebx
call fcn.0064151c
mov byte [ebx + 0x107d], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1080], eax
jmp 0x63c211
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x1080]
cmp eax, 0x9c40
jbe 0x63c203
mov byte [ebx + 0xcb8], 1
jmp 0x63c203
movzx esi, word [ebp - 0x20]
cmp si, 0x7f
jne 0x63c1ed
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00671ffc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00641208
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1080], eax
jmp 0x63c203
cmp si, 0x27
jne 0x63c203
mov byte [ebx + 0x1084], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x15ac], eax
lea edx, [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test al, al
jne 0x63c1c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63c23a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c265
lea eax, [ebp - 0x24]
call fcn.00405394
lea eax, [ebp - 0x20]
mov edx, dword [0x48b4e4]
call fcn.0040610c
ret
Function at 0x401600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bc8ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CWnd::CWnd
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 0x44]
mov byte [esp + 0x30], 1
mov ecx, edi
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [edi + 4]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_3
mov al, byte [esp + 0xf]
mov cl, byte [esp + 0xf]
mov byte [edi + 0xc], al
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov byte [edi + 0x1c], cl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x34], ebx
mov ecx, 0x11
mov eax, 0xa
mov dword [esi + 0x7c], 0x4cc6fc
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], 0x4cc6e8
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], eax
mov byte [esp + 0x30], 5
mov dword [esi], 0x4cc628
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push ebx
push ebx
lea edx, [esp + 0x20]
push eax
push edx
push ebx
push 0x5456d0
push ebx
mov ecx, esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CWnd::Create
push ebx
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x402eb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bcb08
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push 0x65
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ebp, eax
test ebp, ebp
je 0x402feb
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esi + 0x60]
call sub.MFC42.DLL_CListCtrl::GetItemText_1
add esi, 0x1a4
push eax
lea edx, [esp + 0x24]
push esi
push edx
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_operator_4
push str..txt
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x20], 1
push eax
call sub.MFC42.DLL_operator_3
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
push 0x539324
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x402f85
push 0x5456d0
mov ecx, ebp
call sub.MFC42.DLL_CWnd::SetWindowTextA
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push ebx
push edi
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_rewind]
lea edx, [ebx + 1]
push edx
call sub.MFC42.DLL_operatornew
push esi
mov edi, eax
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x28
mov ecx, ebp
mov byte [edi + ebx], 0
push edi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push edi
call dword [sym.imp.MSVCRT.dll_free]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4043d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bcd33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4ccb28
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004611a0
mov dword [ebx], 0x4ccb14
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.004611a0
or eax, 0xffffffff
push 0x545738
mov dword [ebx], 0x4ccad8
push edi
mov dword [esi], 0x4ccaec
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4079c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bd130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4ccb6c
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_2
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call sub.MFC42.DLL_CDC::LineTo
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call sub.MFC42.DLL_CDC::LineTo
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
push ebp
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_2
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x10], 0x4ccb44
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10