joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494120
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x582348
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov al, byte [esi + 0x545]
test al, al
jne 0x4942a8
push esi
call fcn.004940f0
add esp, 4
cmp eax, 1
je 0x4942a8
mov eax, dword [esi + 0x74]
push 0x11
push 0
push eax
call fcn.004f1c60
mov eax, dword [esi + 0x74]
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push 0
push ecx
push 1
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x4942a8
push 0x60300c
push str.flock.trc
call fcn.0044f470
mov edi, eax
add esp, 8
test edi, edi
je 0x4941fb
lea ecx, [esp + 0x14]
push ecx
call fcn.0044c7b0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x667108]
push eax
lea ecx, [esp + 0x18]
mov eax, dword [edx + 4]
mov edx, dword [0x6658d4]
push eax
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [0x6658cc]
push edx
push eax
push ecx
push str.Program_ref:_s_File:_s_Date:_s_Time:_s_user:_s_errcode:_ld_n
push edi
call dword [sym.imp.MSVCRT.dll_fprintf]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp edi, 0x7d0
jle 0x49425d
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [esi + 0x2c]
lea eax, [esp + 0xc]
push edx
push str.File:__s_in_locking
push eax
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
push 0
push 2
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
cmp eax, 3
je 0x494272
cmp eax, 5
je 0x494297
lea ecx, [esp + 0xc]
xor edi, edi
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
push 1
call ebp
push esi
call fcn.004940f0
add esp, 4
cmp eax, 1
je 0x4942a8
inc edi
jmp 0x494203
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4a0930
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, dword [0x64b2e0]
sub esp, 0x10
mov ecx, dword [eax + 0xa6c]
push ebx
xor ebx, ebx
push ebp
push esi
cmp ecx, ebx
push edi
jne 0x4a0954
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1e
call edi
push 0x1f
mov esi, eax
call edi
mov edi, dword [sym.imp.USER32.dll_InflateRect]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
call edi
add dword [esp + 0x10], 2
call sub.MFC42.DLL_AfxGetModuleState
mov edx, dword [0x64b2e0]
mov eax, dword [edx + 0xa6c]
and eax, 0xffff
push eax
push 0xe
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.USER32.dll_LoadIconA]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push 3
push 0
sub ecx, edx
mov edx, dword [esp + 0x20]
push 0
mov ebp, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [0x64b2e0]
mov ecx, dword [eax + 0xa70]
test ecx, ecx
jne 0x4a0a00
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push 0
push ecx
call edi
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov eax, 0x24
add ecx, eax
add edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_AfxGetModuleState
mov edx, dword [0x64b2e0]
mov eax, dword [edx + 0xa70]
and eax, 0xffff
push eax
push 0xe
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call ebx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 3
push 0
sub edx, ecx
push 0
push edx
mov edx, dword [esp + 0x20]
sub edi, edx
push edi
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DrawIconEx]
lea eax, [esi + esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x4a0be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x583310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x2c]
push esi
push edi
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CBrush::CBrush
mov edi, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x2c]
push 0xf00021
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [edi + 4]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
test esi, esi
je 0x4a0c4c
mov esi, dword [esi + 4]
mov ecx, dword [edi + 4]
push esi
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
mov dword [esp + 8], 0x59da10
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a58a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x583b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_3
push str.WhilePrintingRecords__nNumberVar__s__n_s_:__s
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push eax
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
add esp, 0x14
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0055dfe0
lea ecx, [esp + 4]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b6f00
Capabilities:
Delete file

Disassembly:
sub esp, 0x728
push ebx
push ebp
push esi
push edi
push str.Compress_backup_file_now...
mov ebx, ecx
push 0x10c5
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
lea eax, [ebx + 0x8912c]
lea ebp, [ebx + 0x89138]
push eax
mov ecx, ebp
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x338]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x14], esi
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x5fe2d0
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.004a6d70
xor edi, edi
add esp, 0xc
cmp eax, edi
je 0x4b6f8f
lea ecx, [esp + 0x338]
mov byte [esp + eax + 0x337], 0
push ecx
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_3
push 0x5fc52c
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [ebx + 0x88d30]
push 5
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
call fcn.004bc0b0
push 0x4aadb0
mov dword [0x668934], edi
mov dword [0x668930], edi
mov dword [0x6650a4], esi
mov dword [0x6650a0], edi
call dword [sym.imp.LSPZIPX.DLL_Ordinal_13]
test eax, eax
jne 0x4b6ffe
push 0x30
push str.Application_Message
push str.Callback_installation_error_
mov ecx, ebx
call sub.MFC42.DLL_CWnd::MessageBoxA
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x728
ret
mov ebx, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
mov edi, dword [ebx]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.LSPZIPX.DLL_Ordinal_3]
mov edi, dword [ebp]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
lea edx, [esp + 0x18]
xor esi, esi
push 0x91
push 9
push 2
push edx
mov dword [0x63e530], esi
call dword [sym.imp.LSPZIPX.DLL_Ordinal_1]
test eax, eax
jl 0x4b708b
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x6650a0], esi
mov dword [0x6650a4], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x728
ret
Function at 0x4bae0a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x414
lea eax, [esp + 8]
push esi
mov esi, ecx
lea ecx, [esp + 8]
push eax
mov edx, dword [esi + 0x8c4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x10]
cmp eax, 0xa
jl 0x4bae3f
cmp eax, 0x400
jbe 0x4bae49
mov eax, dword [esi + 0x8c4]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor eax, eax
pop esi
add esp, 0x414
ret
lea ecx, [esp + 4]
push 0
push ecx
push eax
mov eax, dword [esi + 0x8c4]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x20]
cmp al, 0xd
mov al, byte [esp + 0x21]
jne 0x4bae7f
cmp al, 0xa
jne 0x4bae7f
lea ecx, [esp + 0x18]
mov byte [esp + 0x20], 0
push ecx
jmp 0x4bae94
cmp al, 0xd
jne 0x4bae3f
cmp byte [esp + 0x22], 0xa
jne 0x4bae3f
lea edx, [esp + 0x18]
mov byte [esp + 0x21], 0
push edx
lea ecx, [esi + 0x964]
call sub.MFC42.DLL_CString::operator_3
mov eax, 1
pop esi
add esp, 0x414
ret

Function at 0x4bc510
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4bc524
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov byte [eax], 0
ret
mov ecx, dword [edi + 0x2c]
mov esi, dword [esp + 0xc]
push ecx
push str._s.tmp
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
push esi
push edi
call fcn.004ee090
push 0
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.00456f90
mov eax, dword [esp + 0x30]
add esp, 0x18
test eax, eax
je 0x4bc56c
push esi
call fcn.00470660
add esp, 4
pop edi
pop esi
ret
Function at 0x4c0b80
Capabilities:
Clear file content

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5876c8
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
push edi
mov al, byte [esi + 0x545]
test al, al
je 0x4c0c63
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 0x450]
lea ecx, [esp + 8]
push eax
push str.truncate_table___s_
push ecx
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::Format
add esp, 8
mov eax, esp
mov dword [esp + 0x10], esp
mov dword [eax], 0
mov edi, dword [esi]
push 0
push 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.004016c0
push eax
mov ecx, esi
call dword [edi + 0x2d0]
mov edx, dword [esi + 0x450]
lea eax, [esp + 8]
push edx
push str.delete_from___s_
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
mov eax, esp
mov dword [esp + 0x10], esp
mov dword [eax], 0
mov edi, dword [esi]
push 0
push 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.004016c0
push eax
mov ecx, esi
call dword [edi + 0x2d0]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x14
ret
push esi
push 0
call fcn.004959a0
push esi
mov byte [esp + 0x2c], 0x1a
call fcn.004c0ab0
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x74]
xor edx, edx
push 0xa1
mov dx, word [ecx + 8]
push edx
push eax
call fcn.004f1c60
mov edx, dword [esi + 0x74]
lea ecx, [esp + 0x38]
push 1
push ecx
push edx
call fcn.004f1b70
mov eax, dword [esi + 0x74]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [esp + 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret
Function at 0x4c5dc0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x587b8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov eax, dword [esp + 0xb8]
lea ecx, [esp]
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp]
mov dword [esp + 0xac], 0
push ecx
call fcn.004924b0
add esp, 4
test eax, eax
jne 0x4c5e65
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
lea edx, [esp + 0x10]
mov byte [esp + 0xac], 1
push edx
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x4c5e54
cmp dword [esp + 0x14], 6
jb 0x4c5e41
push 0x610918
jmp 0x4c5e46
push 0x610914
push str..bmp
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::Replace_1
lea ecx, [esp + 0xc]
mov byte [esp + 0xac], 0
call sub.MFC42.DLL_CString::CString
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x59d9e8
mov byte [esp + 0xb4], 2
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esp + 8]
push 0xb0
push 0
mov edx, dword [eax + 0x6c]
push 0
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
je 0x4c5f16
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0xbc]
lea eax, [esp + 0xc]
push eax
push 0x26
mov ecx, esi
call sub.MFC42.DLL_CToolBarCtrl::AddBitmap_1
mov eax, dword [esp + 0xc4]
test eax, eax
jg 0x4c5edf
mov ecx, dword [0x64b2e0]
mov eax, dword [ecx + 0x2f4]
test eax, eax
jle 0x4c5ee6
cmp eax, 0x80
jle 0x4c5eeb
mov eax, 0x20
and eax, 0xffff
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov edx, eax
shl edx, 0x10
or edx, eax
mov eax, dword [esi + 0x20]
push edx
push 0
push 0x420
push eax
call edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Detach
jmp 0x4c5f43
mov esi, dword [esp + 0xbc]
push 0xff
push 0xb
mov ecx, esi
call sub.MFC42.DLL_CToolBarCtrl::AddBitmap
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xf0010
push 0
push 0x420
push ecx
call edi
mov edx, dword [0x64b2e0]
mov eax, dword [edx + 0x2f0]
test eax, eax
je 0x4c5f5f
push 0
push eax
push 0
mov ecx, esi
call sub.MFC42.DLL_CWnd::ModifyStyle
mov eax, dword [esi + 0x20]
push 0x8001
push 0
push 0x454
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x421
push ecx
call edi
mov dword [esp + 0xc], 0x59da10
lea ecx, [esp + 0xc]
mov byte [esp + 0xb4], 3
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x59d9fc
mov dword [esp + 0xb4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xac]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xb0
ret
Function at 0x4c6530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x587c48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x2c]
xor edi, edi
mov ecx, dword [esi + 0x90]
push eax
push edi
push 0x101b
push ecx
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], 0x9b
mov dword [esp + 0x48], str.Description
mov dword [esp + 0x50], 1
call ebp
mov eax, dword [esi + 0x90]
lea edx, [esp + 0x2c]
push edx
push 1
push 0x101b
push eax
mov dword [esp + 0x44], 0x2d
mov dword [esp + 0x48], str.Width
mov dword [esp + 0x50], 2
call ebp
mov edx, dword [esi + 0x90]
lea ecx, [esp + 0x2c]
push ecx
push 2
mov ebx, 3
push 0x101b
push edx
mov dword [esp + 0x44], 0x41
mov dword [esp + 0x48], str.Alignment
mov dword [esp + 0x50], ebx
call ebp
mov eax, dword [esi + 0x90]
push 0x68
push edi
push 0x1036
push eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x64], edi
call ebp
mov ecx, dword [esi + 0x90]
push 0x5dc
push edi
push 0x1047
push ecx
call ebp
mov edx, dword [esi + 0x90]
push edi
push edi
push 0x103f
push edx
call ebp
push eax
mov eax, dword [esi + 0x90]
push edi
push 0x103e
push eax
call ebp
mov ecx, dword [esi + 0x60]
mov edx, dword [ecx + 0x128]
lea ecx, [esp + 0x18]
mov eax, dword [edx + 4]
push eax
push 0x14
push ecx
call fcn.004455f0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.MSVCRT.dll__strupr]
mov eax, dword [esi + 0x60]
push 4
push edi
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0048b030
mov edx, dword [esi + 0x60]
mov dword [esi + 0x6c], eax
mov ebx, eax
push 5
push edi
lea eax, [esp + 0x40]
push edx
push eax
call fcn.0048b030
add esp, 0x30
cmp ebx, eax
mov dword [esp + 0x14], eax
jg 0x4c674b
lea edi, [ebx - 1]
cmp edi, 0xffffffff
jle 0x4c674b
mov ecx, dword [esi + 0x60]
push ecx
push ebx
call fcn.004a74e0
mov eax, dword [esi + 0x60]
mov dword [esp + 0x58], edi
add esp, 8
mov edx, dword [eax + 0x128]
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x60], ecx
mov edx, dword [eax + 0xcc]
mov ecx, dword [esi + 0x90]
lea eax, [esp + 0x4c]
push eax
push 0
dec edx
push 0x1007
push ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], edi
call ebp
mov edx, dword [esi + 0x60]
mov eax, dword [edx + 0x128]
lea edx, [esp + 0x10]
mov ecx, dword [eax + 0x10]
push ecx
push edx
call fcn.00495e50
add esp, 8
mov eax, dword [eax]
lea ecx, [esi + 0x70]
push eax
push 1
push edi
mov dword [esp + 0x88], 0
call sub.MFC42.DLL_CListCtrl::SetItemText
lea ecx, [esp + 0x10]
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0x128]
mov edx, dword [ecx + 0x14]
lea ecx, [esi + 0x70]
push edx
push 2
push edi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov eax, dword [esp + 0x14]
inc ebx
inc edi
cmp ebx, eax
jle 0x4c6693
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret
Function at 0x4db640
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x58a372
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x14eb
mov dword [esp + 0x18], esi
call fcn.0055239c
lea edi, [esi + 0x6c]
mov dword [esp + 0x1c], 0
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ebp, [esi + 0x70]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x74]
mov byte [esp + 0x1c], 2
call fcn.00554bb0
lea ebx, [esi + 0x2a0]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call sub.MFC42.DLL_CWnd::CWnd
mov dword [ebx], 0x5b79a4
push fcn.00554d00
push fcn.00554bb0
push 0x63
lea ecx, [esi + 0x2e0]
push 0x22c
push ecx
mov byte [esp + 0x30], 4
call fcn.00552fad
push 0x619640
mov ecx, ebp
mov byte [esp + 0x20], 5
mov dword [esi], 0x5bb1b0
call sub.MFC42.DLL_CString::operator_3
push 0x619640
mov ecx, edi
call sub.MFC42.DLL_CString::operator_3
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x60], 8
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4dd7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58a611
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x508
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esp + 0x10]
call fcn.004e64f0
mov eax, dword [esi + 0x60]
mov dword [esp + 0x518], 0
push eax
call fcn.0046c190
mov edx, dword [esi + 0x60]
lea ecx, [esp + 0x78]
push 1
push ecx
mov ecx, dword [edx + 0x28]
xor edx, edx
mov dl, byte [ecx + 0x30]
push edx
push eax
call fcn.0044a0d0
mov eax, dword [esi + 0x60]
add esp, 0x14
lea ecx, [esp + 0x74]
mov dword [esp + 0x6c], eax
push ecx
lea ecx, [esp + 0x74]
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 1
jne 0x4dd8ea
mov edx, dword [esp + 0x70]
lea eax, [esp + 0x74]
push edx
push eax
call fcn.0044dab0
lea ecx, [esp + 0x7c]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
mov edx, dword [esi + 0x60]
mov edi, eax
lea eax, [esp + 0x80]
push edx
push eax
dec edi
call fcn.004dd5d0
add esp, 0x14
cmp eax, 1
jne 0x4dd8ea
mov ecx, dword [esi + 0x60]
push ecx
push edi
call fcn.0046c3b0
add esp, 8
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
inc edi
lea edx, [esp + 8]
push edi
push str.You_have_successfully_completed_reset_no_to__ld
push edx
mov byte [esp + 0x524], 1
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, esi
push 0
push 0
push eax
call sub.MFC42.DLL_CWnd::MessageBoxA
lea ecx, [esp + 8]
mov byte [esp + 0x518], 0
call sub.MFC42.DLL_CString::CString
cmp dword [esi + 0x68], 0x102
jne 0x4dd8fa
mov ecx, esi
call sub.MFC42.DLL_CDialog::OnCancel
lea ecx, [esp + 0x70]
mov dword [esp + 0x518], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x518], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x510]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x514
ret
Function at 0x4ec530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58c97f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], 0
lea edi, [esi + 0x92c]
mov dword [esp + 0x10], edi
lea ebp, [edi + 0x58]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x50]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x48]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x40]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, edi
mov dword [ebp], 0x59d9fc
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CButton::CButton
push fcn.0053df50
push 0xc
lea eax, [esi + 0x3b0]
push 0x74
push eax
mov byte [esp + 0x30], 2
call fcn.0055302f
push fcn.0053ddb0
push 0xb
lea ecx, [esi + 0xf0]
push 0x40
push ecx
mov byte [esp + 0x30], 1
call fcn.0055302f
lea ecx, [esi + 0xb0]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CStatusBarCtrl::CStatusBarCtrl
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4ec549
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58c97f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], 0
lea edi, [esi + 0x92c]
mov dword [esp + 0x10], edi
lea ebp, [edi + 0x58]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x50]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x48]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [ebp], 0x59d9fc
lea ebp, [edi + 0x40]
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x59da10
mov ecx, ebp
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, edi
mov dword [ebp], 0x59d9fc
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CButton::CButton
push fcn.0053df50
push 0xc
lea eax, [esi + 0x3b0]
push 0x74
push eax
mov byte [esp + 0x30], 2
call fcn.0055302f
push fcn.0053ddb0
push 0xb
lea ecx, [esi + 0xf0]
push 0x40
push ecx
mov byte [esp + 0x30], 1
call fcn.0055302f
lea ecx, [esi + 0xb0]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CStatusBarCtrl::CStatusBarCtrl
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret