joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x414b74
lea ecx, [esp + 0x10]
push ecx
push str..htm
push closesocket
mov ecx, edi
call fcn.00414a10
test eax, eax
jne 0x414b74
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push closesocket
mov ecx, edi
call fcn.00414a10
test eax, eax
jne 0x414b74
lea edx, [esp + 0x10]
push str.__1_
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x414b45
lea eax, [esp + 0x10]
push 0x4d7720
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x414b45
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x414b48
mov byte [esi], 0
push 0x4d7270
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x4151f0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004152e0
mov ecx, esi
call fcn.00415550
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [eax + 0x94]
push eax
push 1
push str.HotkeyMode
push str.Setup
call ebx
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.004341c0
push ecx
mov edx, esp
mov dword [esp + 0x1c], esp
push str.plugin
push 0x4db84c
push edx
call sub.MFC42.DLL_operator_2
mov ecx, edi
call fcn.004346a0
push edi
mov ecx, esi
call fcn.00415700
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
and ecx, 0xffff
mov eax, dword [eax + 0x94]
push eax
push ecx
push str.EndHotkey
push 0x4d77d4
call ebx
mov ebp, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov esi, dword [esi + 0x20]
shr esi, 0x10
mov ecx, dword [eax + 0x94]
push ecx
push esi
push str.EndHotkeyMod
push 0x4d77d4
call ebx
mov edx, eax
mov ecx, ebp
and edx, 0xffff
and ecx, 0xffff
shl edx, 0x10
or edx, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ebp
mov dword [ecx], edx
mov ecx, edi
call fcn.00434700
push edi
mov ecx, edi
call fcn.00434230
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x415550
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41f]
mov byte [ebp - 0x420], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp 0x41559e
mov eax, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x420]
push 0x400
push eax
push str.unknown
push str.FileName
push str.SetupFile
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x420]
push ecx
mov ecx, 0x4db860
call sub.MFC42.DLL_CString::operator_1
mov ebx, dword [esi + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebx
push 0
push str.EndHotkeyMod
push str.General
call edi
mov edx, eax
push ebx
and edx, 0xffff
push 0x7b
shl edx, 0x10
push str.EndHotkey
push str.General
mov dword [ebp - 0x10], edx
call edi
mov edx, dword [ebp - 0x10]
and eax, 0xffff
or edx, eax
mov eax, dword [esi + 0x1c]
push eax
push 0
push str.HideScriptPage
push str.General
mov dword [esi + 0x20], edx
call edi
mov dword [0x4db864], eax
mov eax, dword [esi + 0x1c]
push eax
push 0
push str.HideSettingPage
push str.General
call edi
mov dword [0x4db868], eax
mov esi, dword [esi + 0x1c]
push esi
lea eax, [ebp - 0x420]
push 0x400
push eax
push str.uservar.ini
push str.uservar.ini
push str.Rename
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4db790
call sub.MFC42.DLL_CString::CString_4
push ecx
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4db790
call sub.MFC42.DLL_CString::CString_4
push ecx
lea edx, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_4
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.uservar.ini
call sub.MFC42.DLL_CString::CString_4
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00432cf0
mov ecx, eax
call fcn.00433020
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x4156ed
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415700
Capabilities:
Read .ini file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472536
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1c]
push eax
push 0
push str.ShowFirstMacro
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
mov eax, dword [edi + 0xc]
xor esi, esi
test eax, eax
jle 0x4157f0
mov ebx, dword [esp + 0xa4]
lea ecx, [esp + 0x18]
call fcn.0042ed70
push ecx
mov dword [esp + 0xa0], 0
mov ecx, esp
mov dword [esp + 0x18], esp
push str.mymacro2009
call sub.MFC42.DLL_CString::CString_4
push 0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push esi
push eax
lea ecx, [edi + 4]
mov byte [esp + 0xb0], 1
call fcn.0040be30
lea ecx, [esp + 0x24]
mov byte [esp + 0xa8], 0
call fcn.0042f950
test ebp, ebp
mov dword [esp + 0x78], 1
je 0x4157ae
xor eax, eax
jmp 0x4157b1
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x3c]
push 0x4d7840
push ecx
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea edx, [esp + 0x18]
mov ecx, ebx
push edx
call fcn.00433ff0
lea ecx, [esp + 0x18]
mov dword [esp + 0x9c], 0xffffffff
call fcn.0042eed0
mov eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jl 0x41574d
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x90
ret 4

Function at 0x415810
Capabilities:
Delete file
Encode data using xor
Read file on windows
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x472548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov eax, dword [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x20]
lea eax, [esp + 8]
push edx
push 4
xor esi, esi
push 1
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x18]
add esp, 0x10
cmp eax, esi
jle 0x4158c0
mov ecx, dword [esp + 0x1c]
push 0x4d7860
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
cmp edi, esi
je 0x4158c0
cmp dword [esp + 8], esi
jle 0x4158b6
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fgetc]
mov edx, dword [esp + 0x28]
push edi
push edx
call ebp
add esp, 4
xor eax, 0xcc
push eax
call ebx
mov eax, dword [esp + 0x18]
add esp, 8
inc esi
cmp esi, eax
jl 0x415895
pop ebp
pop ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4158f0
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
test eax, eax
jle 0x41592e
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [edi + 4]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, ebx
call fcn.0040be30
mov ecx, dword [eax]
push ecx
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jl 0x415909
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x415940
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x472588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00415cc0
mov edx, esp
mov dword [esp + 0x14], esp
push str.mymacro.zip
push eax
push edx
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_operator_2
mov ecx, esi
call fcn.00415810
or esi, 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], esi
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x4db790
call sub.MFC42.DLL_CString::CString_4
push ecx
mov dword [esp + 0x28], 1
mov eax, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00415cc0
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 2
push ecx
call fcn.00415cc0
add esp, 4
mov byte [esp + 0x2c], 3
mov edx, esp
mov dword [esp + 0x20], esp
push str.mymacro.zip
push eax
push edx
call sub.MFC42.DLL_operator_2
mov byte [esp + 0x2c], 4
call fcn.00435430
add esp, 0xc
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], esi
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
push eax
call fcn.00415cc0
add esp, 4
push str.mymacro.zip
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x2c], 5
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x20], esi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x415cc0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0041eb90
mov cl, byte [0x4db890]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x415cff
mov dl, cl
mov ecx, 0x4db88c
or dl, al
mov byte [0x4db890], dl
call sub.MFC42.DLL_CString::CString_3
push 0x415d60
call fcn.0041ea7a
add esp, 4
mov eax, dword [0x4db88c]
push 0x4db790
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x415d36
lea ecx, [esp + 4]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 4]
mov ecx, 0x4db88c
push edx
call sub.MFC42.DLL_CString::operator_1
push esi
mov esi, dword [esp + 0x100c]
push 0x4db88c
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret
Function at 0x415d70
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0041eb90
mov cl, byte [0x4db888]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x415daf
mov dl, cl
mov ecx, 0x4db884
or dl, al
mov byte [0x4db888], dl
call sub.MFC42.DLL_CString::CString_3
push 0x415e40
call fcn.0041ea7a
add esp, 4
mov eax, dword [0x4db884]
push esi
push 0x4db790
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x415e19
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4d7144
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x4db884
call sub.MFC42.DLL_CString::operator_1
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x4db884
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret

Function at 0x415e50
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0041eb90
mov cl, byte [0x4db880]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x415e8f
mov dl, cl
mov ecx, 0x4db87c
or dl, al
mov byte [0x4db880], dl
call sub.MFC42.DLL_CString::CString_3
push 0x415f20
call fcn.0041ea7a
add esp, 4
mov eax, dword [0x4db87c]
push esi
push 0x4db790
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x415ef9
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x4d7144
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x4db87c
call sub.MFC42.DLL_CString::operator_1
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x4db87c
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret
Function at 0x416510
Capabilities:
Set current directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4727db
push eax
mov eax, 0x1704
mov dword fs:[0], esp
call fcn.0041eb90
push esi
mov esi, ecx
lea eax, [esp + 0x208]
lea ecx, [esp + 0x108]
push eax
lea edx, [esp + 0x30c]
push ecx
mov ecx, dword [esi + 0x90]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x108]
mov ecx, 0x4db848
push edx
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 8]
mov ecx, 0x4db84c
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x308]
push ecx
mov ecx, 0x4db84c
call fcn.0041e50e
mov edx, dword [0x4db84c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x4db84c
mov ecx, 0x4db84c
call sub.MFC42.DLL_CString::operator_2
lea eax, [esp + 0x708]
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [0x4db8d4]
mov al, 1
test al, cl
jne 0x4165f6
or cl, al
mov byte [0x4db8d4], cl
lea ecx, [esp + 0x708]
push ecx
mov ecx, 0x4db8d0
call sub.MFC42.DLL_CString::CString_4
push 0x416670
call fcn.0041ea7a
add esp, 4
push 0x2e
mov ecx, 0x4db8d0
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 4]
push eax
push edx
mov ecx, 0x4db8d0
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x4db8d0
mov dword [esp + 0x1714], 0
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 4]
mov dword [esp + 0x1710], 0xffffffff
call sub.MFC42.DLL_CString::CString
push str..ini
mov ecx, 0x4db8d0
call fcn.0041e50e
mov eax, dword [0x4db8d0]
mov ecx, dword [esp + 0x1708]
mov dword [esi + 0x94], eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1710
ret

Function at 0x416680
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472806
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.0041eb90
push esi
call fcn.00435c20
mov esi, eax
test esi, esi
je 0x4166f4
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
push esi
lea eax, [esp + 0xc]
push 0xf27b
push eax
mov dword [esp + 0x1020], 0
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 8]
mov dword [esp + 0x1014], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0xc]
push 0x1000
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::CString_4
push str.QMDispatch.dll
lea ecx, [esp + 8]
mov dword [esp + 0x1018], 1
call fcn.0041e50e
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov dword [esp + 0x1014], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x100c]
pop esi
mov dword fs:[0], ecx
add esp, 0x1014
ret
Function at 0x416760
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x472828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [esp + 8]
push eax
call fcn.00415cc0
add esp, 4
push str.ad_mymacro.xml
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x416879
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
push 0x95
lea eax, [esp + 0x10]
push 0x4d78b8
push eax
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
push str.EXTERNAL
push ecx
mov edx, dword [eax + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov eax, dword [eax + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
mov ebp, eax
je 0x416868
mov edx, dword [esp + 0x10]
push 0x4d7860
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416868
push esi
push 1
push ebp
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x416af0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4728d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
jmp 0x416b1e
lea eax, [ebp - 0x10]
push eax
call fcn.00416c10
add esp, 4
mov ecx, dword [ebp - 0x10]
push ecx
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416bd1
mov edx, dword [ebp - 0x10]
push esi
push edx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [edi + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x416ba0
mov eax, dword [esi]
push 0x201
push 0
push 0x464
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [edi + 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
jmp 0x416be1
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x416f10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x472a12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x66
mov dword [esp + 0x18], esi
call fcn.0041e2e6
lea ecx, [esi + 0x64]
mov dword [esp + 0x1c], 0
call fcn.004141e0
lea ebx, [esi + 0x130]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 0x134]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.0041e0e2
mov dword [edi], 0x479378
push fcn.0040b270
push fcn.0040b110
push 0x64
lea ecx, [esi + 0x178]
push 0x688
push ecx
mov byte [esp + 0x30], 3
call fcn.0041ebee
lea ecx, [esi + 0x28e98]
mov byte [esp + 0x1c], 4
call fcn.0040c9c0
lea ecx, [esi + 0x29038]
mov byte [esp + 0x1c], 5
call fcn.0040ad00
lea ecx, [esi + 0x295e8]
mov byte [esp + 0x1c], 6
call fcn.0040d330
lea edi, [esi + 0x29848]
mov byte [esp + 0x1c], 7
mov ecx, edi
mov dword [esp + 0x24], edi
call sub.MFC42.DLL_CPropertySheet::CPropertySheet
lea ebp, [edi + 0x90]
mov byte [esp + 0x1c], 8
mov ecx, ebp
call fcn.0041e0e2
mov dword [ebp], 0x479b4c
mov dword [edi], 0x479a80
lea ecx, [esi + 0x2991c]
mov byte [esp + 0x1c], 9
call fcn.00433e50
lea ecx, [esi + 0x2996c]
mov byte [esp + 0x1c], 0xa
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x29984]
mov byte [esp + 0x1c], 0xb
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x29988]
mov byte [esp + 0x1c], 0xc
call sub.MFC42.DLL_CString::CString_3
push 0x4db790
mov ecx, ebx
mov byte [esp + 0x20], 0xd
mov dword [esi], 0x49c788
call sub.MFC42.DLL_CString::operator_1
call sub.MFC42.DLL_AfxGetModuleState
push 0x80
push 0xe
push 0x80
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x174], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x417de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472bb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 1
lea ecx, [esp + 0xc]
call fcn.004150e0
mov ecx, dword [esi + 0x20]
lea eax, [esp + 4]
push eax
lea edx, [esi + 0x2991c]
push ecx
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.004151f0
mov eax, dword [esp + 4]
lea ecx, [esi + 0x2996c]
mov word [esi + 0x60], ax
shr eax, 0x10
mov word [esi + 0x62], ax
lea eax, [esp + 0x24]
push eax
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00415170
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4183a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472cb7
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [esi + 0x2996c]
push eax
push 0xffffffffffffffff
push str.AutoRunTime
push str.AutoRun
call edi
mov ebx, eax
test ebx, ebx
jl 0x41852b
mov eax, dword [esi + 0x2996c]
push eax
push 0
push str.PrimaryMacro
push str.AutoRun
call edi
test ebx, ebx
mov edi, eax
jle 0x4184f0
test edi, edi
jge 0x41840a
xor edi, edi
push 0
push edi
lea ecx, [esi + 0x2991c]
call fcn.00418550
push ecx
add eax, 0x34
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call sub.MFC42.DLL_CString::CString_2
push ebx
lea ecx, [esp + 0x1c]
call fcn.00404200
lea ecx, [esp + 0x10]
mov dword [esp + 0x100], 0
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 2
jne 0x4184a0
lea ecx, [esp + 0xf4]
mov dword [esp + 0x100], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xb0]
mov byte [esp + 0x100], 2
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x70]
mov byte [esp + 0x100], 1
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x10]
mov dword [esp + 0x100], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
jmp 0x41852b
lea ecx, [esp + 0xf4]
mov dword [esp + 0x100], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xb0]
mov byte [esp + 0x100], 5
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x70]
mov byte [esp + 0x100], 4
call sub.MFC42.DLL_CStatic::CStatic
lea ecx, [esp + 0x10]
mov dword [esp + 0x100], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
push 6
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
cmp edi, dword [esi + 0x29940]
jge 0x418516
test edi, edi
jl 0x418516
mov eax, dword [esi + 0x29938]
je 0x418518
lea ecx, [edi]
mov eax, dword [eax]
dec ecx
jne 0x41850f
jmp 0x418518
xor eax, eax
push 0
add eax, 8
push 0
push eax
lea ecx, [esi + 0x2991c]
call fcn.004347e0
mov ecx, dword [esp + 0xf8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xf8
ret