joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x49e87c
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x49e88d
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x49e89b
push edi
call fcn.0049ec80
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.0049e660
add esp, 0x10
test eax, eax
je 0x49e8c3
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x49e8e2
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call sub.MFC42.DLL_operatornew
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x49e91b
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x49e969
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0049d3e0
add esp, 4
test eax, eax
jne 0x49e969
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x49e996
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x49e9a2
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x49e9e3
mov al, byte [ebp]
test al, al
je 0x49e9e3
push eax
push ebx
call fcn.0049d130
add esp, 8
inc ebp
jne 0x49e9cf
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x49edc0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x49eea2
cmp dword [ebp + 4], 0xffffffff
jne 0x49eea2
push ebx
lea ebx, [ebp + 0x13c]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13b]
cmp cl, 0x5c
je 0x49ee32
cmp cl, 0x2f
je 0x49ee32
mov edi, 0x59188c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x49ee5e
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x49ee5e
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.0049d900
add esp, 0x10
test eax, eax
jne 0x49ee81
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.0049ded0
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x49f4a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x214]
mov al, byte [esi]
test al, al
je 0x49f572
push ebx
push ebp
push edi
mov ebx, esi
mov ecx, esi
cmp al, 0x2f
je 0x49f4c7
cmp al, 0x5c
jne 0x49f4c9
mov ebx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x49f4bf
mov ebp, dword [esp + 0x21c]
cmp ebx, esi
mov edx, ebx
je 0x49f50c
mov eax, ebx
lea edi, [esp + 0x10]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.0049f4a0
add esp, 8
lea edx, [ebx + 1]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret
Function at 0x4a5300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x503a2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x56fc68
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x4a5390
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x4a5357
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x4a5381
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x4a5396
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x4a5396
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x507718
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x507704
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a6e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x503bb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edi, 0x5b2c3c
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x3c], ebx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x4a6eff
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, 0x5b2c3c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0x40]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x4a6f55
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov edi, dword [ecx + 0xbc]
lea esi, [ecx + 0xb8]
mov ecx, esi
mov edx, dword [edi + 4]
push edx
push edi
call fcn.004a8d70
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.004a8da0
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 8
inc edx
mov dword [esi + 8], edx
mov esi, dword [eax + 0xc0]
dec esi
cmp ecx, ebx
je 0x4a6fcc
mov al, byte [ecx - 1]
cmp al, bl
je 0x4a6fc2
cmp al, 0xff
je 0x4a6fc2
dec al
mov byte [ecx - 1], al
jmp 0x4a6fcc
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4ae9f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x504270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CFrameWnd::OnSize
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub eax, edx
mov edx, dword [esp + 0xc]
add eax, 0x1c
sub ecx, edx
mov dword [esp + 8], 0
add ecx, 4
mov dword [esp + 4], 0x508e0c
inc eax
push 9
inc ecx
push 9
push eax
push ecx
push 0
push 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
je 0x4aea98
lea ecx, [esp + 4]
call sub.MFC42.DLL_CGdiObject::Detach
mov edx, dword [esi + 0x20]
push 1
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [esp + 4], 0x507718
lea ecx, [esp + 4]
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc

Function at 0x4af370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x504398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004afba0
mov al, byte [esp + 0xb]
xor edi, edi
push 0xc
mov dword [esp + 0x1c], edi
mov byte [esi + 0x30], al
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x14]
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
or eax, 0xffffffff
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 8], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], edi
mov dword [esi], 0x570e20
mov dword [esi + 0x5c], 0xff00ff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b09b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x504558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
lea eax, [esp + 0x18]
push edi
push eax
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x2c]
call fcn.004452b2
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x44], 0
test edi, edi
jne 0x4b09f9
xor eax, eax
jmp 0x4b09fc
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CDC::Attach
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50772c
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
sub eax, ebx
sub ecx, edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
mov byte [esp + 0x50], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov eax, dword [esp + 0x34]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
mov edx, dword [esi]
mov ebx, eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edx + 0xc8]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub ecx, edx
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
push 0xcc0020
and eax, esi
push 0
push 0
push eax
push ecx
mov ecx, dword [edi + 4]
push edx
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test ebx, ebx
je 0x4b0ac3
mov ebx, dword [ebx + 4]
mov edx, dword [esp + 0x30]
push ebx
push edx
call sub.MFC42.DLL_CDC::SelectGdiObject
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CDC::DeleteDC
mov dword [esp + 0xc], 0x507718
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], 0x507704
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x4b39f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x504848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x24], 0
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x30]
mov ecx, dword [edx - 8]
test ecx, ecx
mov dword [esp + 0xc], ecx
jne 0x4b3a74
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], eax
mov dword [esi + 4], ecx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov edi, dword [esp + 0x10]
mov eax, edi
cdq
idiv ecx
mov ebx, eax
test ebx, ebx
jne 0x4b3ab5
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], edi
mov dword [esi + 4], edx
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x34]
push ebp
mov ebp, dword [ecx + 8]
mov edx, dword [ecx]
mov esi, ebp
sub esi, edx
mov eax, esi
cdq
idiv ebx
mov dword [esp + 0x38], eax
mov eax, esi
cdq
idiv ebx
mov ebx, dword [esp + 0x38]
test edx, edx
je 0x4b3ada
inc ebx
mov eax, dword [esp + 0x3c]
cmp eax, 1
jne 0x4b3b12
cmp dword [esp + 0x10], ebx
jg 0x4b3b10
mov eax, esi
mov esi, dword [ecx]
sub eax, edi
cdq
sub eax, edx
mov edx, 0
sar eax, 1
sets dl
dec edx
and eax, edx
add esi, eax
mov eax, esi
mov dword [ecx], esi
add eax, edi
cmp eax, ebp
jle 0x4b3b0d
mov eax, ebp
mov dword [ecx + 8], eax
xor eax, eax
cmp dword [esp + 0x10], ebx
jl 0x4b3b1f
or eax, 0x40000
jmp 0x4b3b53
test eax, eax
jne 0x4b3b3a
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
add edx, edi
cmp edx, esi
jge 0x4b3b33
mov dword [ecx + 8], edx
jmp 0x4b3b53
mov eax, 0x40000
jmp 0x4b3b53
cmp eax, 2
jne 0x4b3b53
mov edx, dword [ecx + 8]
sub edx, edi
mov dword [ecx], edx
jns 0x4b3b53
mov dword [ecx], 0
mov eax, 0x40002
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
push eax
push ecx
mov edx, dword [ebx - 8]
mov ebp, dword [esi]
push edx
push ebx
mov ecx, esi
call dword [ebp + 0x70]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
mov dword [esi], edi
mov dword [esi + 4], eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4b6a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x504bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::CString_3
xor edi, edi
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1c], edi
call sub.MFC42.DLL_CString::CString_3
mov ebx, 1
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1c], 2
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_3
mov eax, 2
push 4
mov byte [esp + 0x20], 4
mov dword [esi], 0x571b44
mov dword [esi + 0x78], edi
mov dword [esi + 0x84], ebx
mov dword [esi + 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x1c], 5
je 0x4b6ade
mov ecx, eax
call fcn.004b36c0
jmp 0x4b6ae0
xor eax, eax
push 0x28
mov byte [esp + 0x20], 4
mov dword [esi + 0x58], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x1c], 6
je 0x4b6b08
mov ecx, eax
call fcn.004aff50
jmp 0x4b6b0a
xor eax, eax
push 0x28
mov byte [esp + 0x20], 4
mov dword [esi + 0x5c], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x1c], 7
je 0x4b6b32
mov ecx, eax
call fcn.004aff50
jmp 0x4b6b34
xor eax, eax
push 8
mov byte [esp + 0x20], 4
mov dword [esi + 0x60], eax
call sub.MFC42.DLL_operatornew
add esp, 4
cmp eax, edi
je 0x4b6b55
mov dword [eax + 4], edi
mov dword [eax], 0x5077fc
jmp 0x4b6b57
xor eax, eax
push 8
mov dword [esi + 0x64], eax
call sub.MFC42.DLL_operatornew
add esp, 4
cmp eax, edi
je 0x4b6b88
mov dword [eax + 4], edi
mov dword [eax], 0x5077fc
mov dword [esi + 0x68], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x68], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4e3120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x505261
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004e3f90
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x4e31cb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e31c2
cmp al, 0xff
je 0x4e31c2
dec al
mov byte [ecx], al
jmp 0x4e31cb
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4e31fc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e31f3
cmp al, 0xff
je 0x4e31f3
dec al
mov byte [ecx], al
jmp 0x4e31fc
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4a80e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x68000]
push edi
or ebp, 0xffffffff
jmp 0x4a8102
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a8109
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a80f8
mov eax, 1
add ebx, ebx
jne 0x4a811b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a812c
jne 0x4a814b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a814b
dec eax
add ebx, ebx
jne 0x4a8138
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a8110
add ebx, ebx
jne 0x4a8147
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a819d
xor ecx, ecx
sub eax, 3
jb 0x4a8163
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a81d2
sar eax, 1
mov ebp, eax
jmp 0x4a816e
add ebx, ebx
jne 0x4a816e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a813c
inc ecx
add ebx, ebx
jne 0x4a817c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a813c
add ebx, ebx
jne 0x4a8189
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a817e
jne 0x4a819a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a817e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a81bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a81ae
jmp 0x4a80fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a81bc
add edi, ecx
jmp 0x4a80fe
pop esi
mov edi, esi
mov ecx, 0x3493
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a81da
cmp byte [edi], 0x4c
jne 0x4a81da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a81df
lea edi, [esi + 0xa4000]
mov eax, dword [edi]
or eax, eax
je 0x4a8257
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa99f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa9b44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a820c
mov ecx, edi
jns 0x4a823b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa9b48]
or eax, eax
je 0x4a8251
mov dword [ebx], eax
add ebx, 4
jmp 0x4a8229
call dword [esi + 0xa9b58]
mov ebp, dword [esi + 0xa9b4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a828b
sub esp, 0xffffff80
jmp 0x417770