joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4bf0db
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4bf0ff
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4bf11a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4c5a69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4c5a8b
cmp dword [edi + 0x3c], 0
jne 0x4c5a8b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004e4e26
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004c5aca
pop edi
pop esi
pop ebx
ret 8

Function at 0x4c5b2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004e4e26
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c5b5f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004c5b84
pop edi
pop esi
pop ebx
ret 8

Function at 0x4c8665
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c869d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c6a61
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c6a39
jmp 0x4c86a9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ca467
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ca4a9
call fcn.004e4e26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ca4a9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ca4a0
xor eax, eax
jmp 0x4ca4b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ca4b7
pop edi
pop esi
pop ebx
ret 4
Function at 0x4e64c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004e4e26
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4e6500
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e6500
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4e6504
xor eax, eax
jmp 0x4e6582
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004c62f5
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4e653c
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4e6526
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004e6687
push ebx
mov edi, eax
call fcn.004c631e
test edi, edi
pop ecx
je 0x4e657e
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004e63d9
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004e6587
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x51d610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x78000]
push edi
jmp 0x51d62a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51d631
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d620
mov eax, 1
add ebx, ebx
jne 0x51d643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51d654
jne 0x51d673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d673
dec eax
add ebx, ebx
jne 0x51d660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51d638
add ebx, ebx
jne 0x51d66f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51d6c5
xor ecx, ecx
sub eax, 3
jb 0x51d68b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51d6fa
sar eax, 1
mov ebp, eax
jmp 0x51d696
add ebx, ebx
jne 0x51d696
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d664
inc ecx
add ebx, ebx
jne 0x51d6a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d664
add ebx, ebx
jne 0x51d6b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51d6a6
jne 0x51d6c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51d6a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51d6e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51d6d6
jmp 0x51d626
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51d6e4
add edi, ecx
jmp 0x51d626
pop esi
mov edi, esi
mov ecx, 0x304e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51d702
cmp byte [edi], 0x1e
jne 0x51d702
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51d707
lea edi, [esi + 0x11a000]
mov eax, dword [edi]
or eax, eax
je 0x51d77f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11eebc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11efc0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51d734
mov ecx, edi
jns 0x51d763
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11efc4]
or eax, eax
je 0x51d779
mov dword [ebx], eax
add ebx, 4
jmp 0x51d751
call dword [esi + 0x11efd4]
mov ebp, dword [esi + 0x11efc8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51d7b3
sub esp, 0xffffff80
jmp 0x45af41
Function at 0x405cb5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c56c], 0
push esi
jne 0x405cec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405cc6
mov dword [ecx*4 + 0x42c568], eax
inc ecx
cmp ecx, 0x100
jl 0x405cc1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d1d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c568]
xor eax, esi
inc ecx
dec edx
jne 0x405cff
pop edi
not eax
pop esi
ret 0xc

Function at 0x4baaf9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6f2e58
push eax
push dword fs:[0]
outsd dx, dword [esi]
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4bab79
arpl word [edx + esi], si
into
mov byte [0x14d09108], al
mov eax, dword [0xf025629f]
dec edx
test al, 0x52
aad 0x6d
insd dword es:[edi], dx
adc dword [edx + 0x1f], esi
scasb al, byte es:[edi]
dec edi
test edx, esi
jns 0x4bab86
pop ebx
nop
test al, 0x81
xchg byte [edx + 0xc40d691], cl
or ah, ch
jns 0x4bab2b
fsubr st(4)
mov ebx, 0x750f4d42
invalid
jbe 0x4baafc
test eax, 0x7f55dc2f
sbb al, 0x9a
sub edx, dword [edi - 0x735c5eb]
fidiv dword ds:[edi + 0x6b4a9cb8]
daa
invalid
retf 0x3ef8
Function at 0x402860
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48a7c0
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, ecx
jg 0x40289f
mov ecx, dword [ebp + 0x1e8]
call dword [sym.imp.rmDB.dll_public:_int___thiscall_CArmy::IsArmyBaseAttackingPeriod_void_]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x402979
xor eax, eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x44]
push ecx
push 0x49b020
push edx
mov dword [esp + 0x44], ebx
call sub.MFC42.DLL_CString::Format
mov eax, dword [ebp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x10]
push ebx
push eax
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CSingleLock::Lock
mov eax, dword [esp + 0x44]
mov ecx, ebp
push eax
call dword [sym.imp.Staff2.dll_public:_void____thiscall_CExMapStringToPtr::Find_char_const__]
cmp eax, ebx
je 0x402950
mov ecx, dword [eax + 0x18]
lea esi, [eax + 0x18]
cmp ecx, ebx
jne 0x40291a
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
jmp 0x402925
mov ecx, 5
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x24]
cmp esi, ebx
je 0x402950
mov eax, esi
mov esi, dword [esi]
mov edx, dword [eax + 8]
cmp edx, ebx
je 0x40294c
mov edi, dword [edx]
xor eax, eax
lea ecx, [esp + 0x1c]
cmp edi, dword [ecx]
je 0x40298e
inc eax
add ecx, 4
cmp eax, 5
jl 0x40293f
cmp esi, ebx
jne 0x40292c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call fcn.00489b20
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
mov eax, dword [edx + 8]
cmp eax, 1
je 0x40299b
cmp eax, 3
jne 0x402950
cmp dword [edx + 0xc], 5
jne 0x402950
cmp dword [edx + 0x10], 0x64
jne 0x402950
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call fcn.00489b20
mov eax, 1
jmp 0x402979
Function at 0x404db0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48ab38
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404e42
mov ebx, dword [esp + 0x28]
test ebx, ebx
jl 0x404e42
cmp ebx, dword [esi + 0x30]
jge 0x404e42
mov edi, dword [esp + 0x2c]
test edi, edi
jl 0x404e42
cmp edi, dword [esi + 0x34]
jge 0x404e42
lea eax, [esi + 0x3c]
push 0
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CSingleLock::Lock
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
imul eax, edi
add eax, ebx
lea ecx, [eax + eax*4]
mov eax, dword [edx + ecx*4]
test eax, eax
lea edi, [edx + ecx*4]
je 0x404e58
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CSingleLock::Unlock
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
mov esi, dword [esp + 0x30]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x406d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48ad80
push eax
mov dword fs:[0], esp
sub esp, 0x74
push edi
mov edi, ecx
mov eax, dword [edi + 0x30]
test eax, eax
jne 0x406d37
xor eax, eax
pop edi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
add esp, 0x80
ret
mov eax, dword [edi + 0x34]
test eax, eax
jne 0x406d53
xor eax, eax
pop edi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
add esp, 0x80
ret
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [edi + 0x3c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x80], 0
mov eax, dword [eax + 0x32c4]
push eax
push str._05d.rme
push ecx
call sub.MFC42.DLL_CString::Format
push str.DataExtraExtra
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.Staff2.dll_class_CString___cdecl_STAFFGetInstancePathAndFilename_struct_HINSTANCE_____char_const__]
add esp, 0x18
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x84], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x34]
call fcn.00405e00
mov ecx, dword [esp + 8]
push 0
push 0
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 2
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
je 0x406ee9
mov eax, dword [edi + 0x68]
push 0
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], 3
call sub.MFC42.DLL_CSingleLock::Lock
lea edx, [esp + 6]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
lea ecx, [esp + 0x40]
call fcn.00405e50
test eax, eax
je 0x406ecf
push esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x50]
push eax
push ecx
mov ecx, edi
call fcn.00483230
cmp eax, 1
jne 0x406eae
push 6
call sub.MFC42.DLL_operatornew
mov esi, eax
mov eax, dword [esp + 0x18]
mov edx, esi
add esp, 4
mov dword [edx], eax
mov cx, word [esp + 0x18]
mov word [edx + 4], cx
movsx eax, word [esp + 0xa]
dec eax
je 0x406e6d
dec eax
je 0x406e66
dec eax
jne 0x406e75
mov al, byte [esi + 4]
add al, 6
jmp 0x406e72
mov al, byte [esi + 4]
add al, 4
jmp 0x406e72
mov al, byte [esi + 4]
add al, 2
mov byte [esi + 4], al
lea edx, [esp + 0x14]
push esi
lea eax, [esp + 0x50]
push edx
push eax
lea ecx, [edi + 0x4c]
call fcn.0040a220
cmp eax, 1
jne 0x406ea5
push 0
lea ecx, [esp + 0x18]
push 0
lea edx, [esp + 0x54]
push ecx
mov ecx, dword [edi + 0x3c]
push edx
call fcn.00469780
jmp 0x406eae
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea eax, [esp + 0xa]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x50]
push ecx
push edx
lea ecx, [esp + 0x44]
call fcn.00405e50
test eax, eax
jne 0x406e19
pop esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 2
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 1
call fcn.00405e40
lea ecx, [esp + 8]
mov byte [esp + 0x80], 0
call fcn.00489b20
lea ecx, [esp + 0xc]
mov dword [esp + 0x80], 0xffffffff
call fcn.00489b20
mov ecx, dword [esp + 0x78]
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0x80
ret
Function at 0x4078c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48aea0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
xor ebx, ebx
push 0x49b020
push ecx
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [edi + 0x28]
lea ecx, [esp + 0x10]
push ebx
push edx
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CSingleLock::Lock
mov eax, dword [esp + 0xc]
mov ecx, edi
push eax
call dword [sym.imp.Staff2.dll_public:_void____thiscall_CExMapStringToPtr::Find_char_const__]
mov esi, eax
cmp esi, ebx
je 0x4079a9
xor edx, edx
lea eax, [esi + 0x1a]
mov ecx, 5
cmp dword [eax - 0x16], 2
jne 0x40794a
cmp word [eax], bx
jl 0x40794a
inc edx
add eax, 0x18
dec ecx
jne 0x40793e
cmp edx, ebx
jne 0x4079a9
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CMapStringToPtr::RemoveKey
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00489b20
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00489b20
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x4092e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b1f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, ecx
push esi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 0x1c]
push 0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CSingleLock::Lock
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call dword [sym.imp.Staff2.dll_public:_void____thiscall_CExMapStringToPtr::First_struct___POSITION____class_CString__]
mov esi, eax
test esi, esi
je 0x409432
push ebx
mov ebx, dword [sym.imp.Staff2.dll_public:_void____thiscall_CExMapStringToPtr::Next_struct___POSITION____class_CString__]
push edi
je 0x409418
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call dword [sym.imp.Staff2.dll_public:_void____thiscall_CExMapStringToPtr::First_struct___POSITION____class_CString__]
test eax, eax
je 0x4093f4
mov ecx, dword [ebp + 0x24]
cmp eax, ecx
ja 0x4093d0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
call dword [sym.imp.rmDB.dll_public:_int___thiscall_CLegalProtection::DeleteLegalProtection_char___char__]
cmp eax, 1
jne 0x4093e2
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
call sub.MFC42.DLL_CMapStringToPtr::RemoveKey
mov ecx, dword [esi + 0x20]
push 0x4568
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4093e2
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esi + 0x20]
push eax
push 0xcd
call fcn.0043fc10
jmp 0x4093e2
mov edx, dword [esp + 0x10]
sub eax, ecx
push edx
mov ecx, esi
mov edi, eax
call sub.MFC42.DLL_CMapStringToPtr::operator__
mov dword [eax], edi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call ebx
test eax, eax
jne 0x40937a
mov eax, dword [esi + 0xc]
test eax, eax
jg 0x409418
mov ecx, esi
call dword [sym.imp.Staff2.dll_public_virtual:_void___thiscall_CExMapStringToPtr::destructor_void_]
push esi
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, ebp
push edx
call sub.MFC42.DLL_CMapStringToPtr::RemoveKey
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, ebp
call ebx
mov esi, eax
test esi, esi
jne 0x409364
pop edi
pop ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call fcn.00489b20
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00489b20
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret