joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb6d0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push ebp
mov ebp, ecx
mov ecx, dword [0x21eaca8]
or eax, 0xffffffff
cmp ecx, eax
mov dword [esp + 0xc], ebp
je 0x4eb7f8
cmp dword [0x21eadb0], eax
je 0x4eb7f8
fld dword [0x21ebd0c]
push edi
call fcn.005b8b18
mov ecx, ebp
mov edi, eax
call fcn.004ea5e0
cmp eax, 0xc8
jg 0x4eb73a
mov eax, dword [ebp + 0x9e4]
mov ecx, dword [ebp + 0x9e0]
add eax, 0x9c
add ecx, 0x13
push eax
push ecx
lea ecx, [ebp + 0x16288]
call fcn.00538c10
pop edi
pop ebp
add esp, 0xc
ret
mov eax, edi
cdq
push ebx
push esi
and edx, 0x1ff
add eax, edx
mov esi, 0x200
sub esi, edi
sar eax, 9
cmp esi, 0xc8
jle 0x4eb75e
mov esi, 0xc8
and edi, 0x800001ff
jns 0x4eb76e
dec edi
or edi, 0xfffffe00
inc edi
mov ebx, dword [ebp + 0x9e4]
mov dword [esp + 0x10], edi
add edi, esi
mov dword [esp + 0x14], edi
add ebx, 0x9c
xor edi, edi
shl eax, 4
lea ebp, [eax + ebp + 0x16288]
fild dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x9e0]
sub esp, 8
fmul dword [0x6acb80]
add eax, 0x13
mov ecx, ebp
fstp dword [esp + 4]
fild dword [esp + 0x18]
fmul dword [0x6acb80]
fstp dword [esp]
push 0x3f800000
push 0
push esi
push 0x200
push ebx
push eax
push 0xffffffffffffffff
call fcn.00538d40
add ebx, esi
add edi, esi
mov esi, 0xc8
sub esi, edi
add ebp, 0x10
cmp edi, 0xc8
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
jl 0x4eb790
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x4eb800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
push edi
mov esi, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4eb82e.1
jmp dword [eax*4 + 0x4eba3c]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 8], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0xc], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x18], cx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jmp 0x4eb97f
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0xc], eax
mov eax, dword [0x6abc24]
mov dword [esp + 8], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jmp 0x4eb97b
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 8], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0xc], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x10], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x14], ecx
mov word [esp + 0x18], dx
mov byte [esp + 0x1a], al
jmp 0x4eb97f
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 8], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0xc], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x4eb97f
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 8], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jmp 0x4eb97f
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0xc], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x10], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 8], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x18], ax
mov byte [esp + 0x1a], cl
mov dword [esp + 0x14], edx
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x118]
push edx
push 0x6a75d5
push str.SHEET_OPTION_POS_X
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x4eb9bf
lea ecx, [esp + 0x110]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [esi + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x118]
push edx
push 0x6a75d5
push str.SHEET_OPTION_POS_Y
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x4eb9f9
lea ecx, [esp + 0x110]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [esi + 8], eax
mov ecx, dword [esi + 4]
xor edx, edx
cmp ecx, edx
jge 0x4eba07
mov dword [esi + 4], edx
jmp 0x4eba16
mov eax, dword [0x6f355c]
sub eax, dword [esi + 0xc]
cmp ecx, eax
jle 0x4eba16
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
cmp ecx, edx
jge 0x4eba26
mov dword [esi + 8], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6f3560]
sub eax, dword [esi + 0x10]
cmp ecx, eax
jle 0x4eba35
mov dword [esi + 8], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f07b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4f07df.1
jmp dword [eax*4 + 0x4f09b4]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f0930
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4f092c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4f0930
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4f0930
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f0930
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_QUEST_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f0970
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push 0x6af708
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f09aa
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f0be0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d64c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6af730
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ebp, [esi + 0x38]
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.005167e0
lea ecx, [esi + 0x50c]
mov byte [esp + 0x18], 2
call fcn.0051a260
mov eax, 3
mov dword [esi + 0xc], 0xf4
cmp dword [0x6f3558], eax
mov byte [esp + 0x18], al
jne 0x4f0c74
mov dword [esi + 0xc], 0x129
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
mov dword [esi + 0x10], 0x83
mov dword [esi + 0x145c], 0xffffffff
mov dword [esi + 0x1460], edi
cmp dword [0x6f3558], eax
push 0x20
push 1
jne 0x4f0cef
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x108
push eax
push ecx
jmp 0x4f0cfc
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0xda
push edx
push eax
mov ecx, ebp
call fcn.00517f80
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f20e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4f210f.1
jmp dword [eax*4 + 0x4f22e4]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f2260
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4f225c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4f2260
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4f2260
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f2260
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_SKILL_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f22a0
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push 0x6af794
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f22da
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5910
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4f593f.1
jmp dword [eax*4 + 0x4f5b14]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f5a90
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4f5a8c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4f5a90
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4f5a90
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f5a90
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_STATUS_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f5ad0
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_STATUS_POS_Y
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f5b0a
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f93e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4f940f.1
jmp dword [eax*4 + 0x4f95e4]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f9560
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4f955c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4f9560
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4f9560
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4f9560
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_SUB_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f95a0
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.SHEET_SUB_POS_Y
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4f95da
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fbf90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4fbfbf.1
jmp dword [eax*4 + 0x4fc194]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc110
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4fc10c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4fc110
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4fc110
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc110
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.STATUSMINIBAR_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc150
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push 0x6af990
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc18a
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fc3c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4fc3ef.1
jmp dword [eax*4 + 0x4fc5c4]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc540
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4fc53c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4fc540
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4fc540
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc540
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.STATUSINFOBAR_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc580
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.STATUSINFOBAR_POS_Y
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc5ba
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret