joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414863
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push edi
mov word [ebp - 8], 0x30
mov edi, 0x4600a2
jmp 0x4148e1
push 0x45cb12
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x44ef8c
lea eax, [ebp - 8]
push eax
push 0x44f831
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4148de
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x108]
push eax
call fcn.00401168
or eax, 0x80000000
mov dword [edi], eax
lea eax, [ebp - 0x88]
push eax
call fcn.00401168
mov dword [edi + 4], eax
movzx eax, byte [ebp - 8]
mov dword [edi + 8], eax
add edi, 0xc
inc byte [ebp - 8]
cmp byte [ebp - 8], 0x39
jbe 0x41487a
mov dword [0x46009a], 1
mov dword [ebp - 0x10c], 0
mov edi, 0x46022e
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10c]
call fcn.004011b7
push 0x45cb12
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x44ef8c
lea eax, [ebp - 8]
push eax
push str.BreakPoint
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4149be
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x108]
push eax
call fcn.00401168
or eax, 0x80000000
mov dword [edi], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x108]
push eax
call fcn.00401168
mov dword [edi + 4], eax
mov dword [edi + 8], 2
cmp byte [ebp - 0x88], 0
je 0x4149b0
mov eax, edi
sub eax, 0x46022e
mov ecx, 0xc
xor edx, edx
div ecx
inc eax
mov edx, eax
lea eax, [ebp - 0x88]
push eax
push edx
call fcn.004128c0
add edi, 0xc
inc dword [ebp - 0x10c]
jmp 0x414900
pop edi
leave
ret

Function at 0x414dc1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcfc
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov dword [ebp - 4], eax
push 0
push 0
push 0xb8
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
or eax, eax
je 0x414e97
push 0x100
lea eax, [ebp - 0x304]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push 0x44ed4c
lea eax, [ebp - 0x204]
push eax
call fcn.004010a7
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004010c5
mov dword [ebp - 0x304], 0x3f
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004010c5
push 0x23
push 0x44f25f
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x414e86
cmp dword [0x4538c8], 0
je 0x414e73
push dword [ebp + 8]
call fcn.0041590f
jmp 0x414e97
cmp dword [0x453960], 0
je 0x414e97
push dword [ebp + 8]
call fcn.00412b58
jmp 0x414e97
cmp eax, 7
jne 0x414e92
mov eax, 0
jmp 0x414e97
mov eax, 1
leave
ret 4

Function at 0x41526e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call sub.kernel32.dll_GetFileAttributesA
and eax, 1
or eax, eax
je 0x415293
push 1
push 0
push 0x80b
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x4152a4
push 0
push 0
push 0x80b
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
leave
ret 8
Function at 0x4152a8
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcdc
push esi
call fcn.00413e18
or eax, eax
je 0x4152c2
xor eax, eax
jmp 0x4154ab
push 0x45cf22
call fcn.004010ef
lea esi, [eax + 0x45cf22]
mov ecx, 8
xor eax, eax
dec ecx
je 0x4154ab
dec esi
mov al, byte [esi]
cmp al, 0x2e
jne 0x4152d7
push esi
lea eax, [ebp - 0x320]
push eax
call fcn.004010a7
mov byte [ebp - 0x100], 0x2e
mov byte [ebp - 0xff], 0
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.004010c5
cmp dword [ebp + 8], 0
jne 0x41549a
push 0x45cf22
push 0x45d026
call fcn.004010a7
mov dword [ebp - 0x324], 1
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x324]
call fcn.004011b7
push 0x45cc16
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.Open
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4154ab
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.0040ccb3
cmp eax, 0xffffffff
je 0x41548d
push 0x45cf22
call fcn.004010ef
mov dword [ebp - 0x200], 0x22
push 0x45cf22
lea eax, [ebp - 0x200]
push eax
call fcn.004010c5
mov dword [ebp - 0x320], 0x22
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004010c5
push 0x45cf22
call fcn.004010ef
mov ecx, eax
lea esi, [eax + 0x45cf22]
xor eax, eax
dec ecx
je 0x4154ab
dec esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x4153fc
mov byte [esi], 0
mov dword [ebp - 0x300], 0x22
push 0x45cf22
lea eax, [ebp - 0x300]
push eax
call fcn.004010c5
mov dword [ebp - 0x320], 0x22
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.004010c5
lea eax, [ebp - 0x100]
push eax
call fcn.00408490
push 0xa
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
push dword [0x4538b0]
call sub.shell32.dll_ShellExecuteA
push 0x45d026
push 0x45cf22
call fcn.004010a7
mov eax, 1
jmp 0x415498
inc dword [ebp - 0x324]
jmp 0x415338
jmp 0x4154ab
lea eax, [ebp - 0x320]
push eax
push 0x45c5de
call fcn.0040ccb3
pop esi
leave
ret 4
Function at 0x41590f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov dword [ebp - 4], eax
push 0
push 0
push 0xb8
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
or eax, eax
je 0x415ab2
push 0xff
push 0x45cf22
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push 0x45cf22
push 0x44ed66
call fcn.00401105
or eax, eax
jne 0x41596c
push dword [ebp + 8]
call fcn.00415ab6
leave
ret 4
push 1
push 0x45cf22
call fcn.00415c84
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x415a7c
mov dword [ebp - 8], eax
push 0x40000
push 0x45cf22
push dword [ebp - 4]
push 0x473
push dword [ebp + 8]
call fcn.00408423
or eax, eax
je 0x4159cf
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov eax, 1
leave
ret 4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x414b04
lea eax, [ebp - 0x14]
push eax
push 1
push 0x44a
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xb9
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0
push 1
push 0x83e
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 1
push 0
push dword [ebp - 4]
call sub.user32.dll_InvalidateRect
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push 0x45cf22
call fcn.00428ce6
cmp eax, 4
jne 0x415a56
inc dword [0x44f339]
push 0x2000
push 0x45cf22
push 0
push 0x48e
push dword [0x4538b0]
call fcn.00408423
push dword [ebp + 8]
call fcn.00404423
push 0x80000
push 0x45cf22
push dword [ebp - 4]
push 0x474
push dword [ebp + 8]
call fcn.00408423
xor eax, eax
jmp 0x415ab2
push 0x44ece9
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push 0
call sub.user32.dll_MessageBoxA
mov eax, 1
leave
ret 4
Function at 0x415c84
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push esi
push edi
cmp dword [0x45c480], 0
je 0x415ca1
cmp dword [0x44f32d], 0
jne 0x415ca7
pop edi
pop esi
leave
ret 8
mov esi, dword [ebp + 8]
push esi
call fcn.004010ef
lea edx, [eax + esi - 1]
jmp 0x415cc2
cmp byte [edx], 0x2e
jne 0x415cc1
mov dword [ebp - 0x204], edx
dec edx
cmp byte [edx], 0
je 0x415ccc
cmp byte [edx], 0x5c
jne 0x415cb6
lea edi, [ebp - 0x200]
cmp esi, dword [ebp - 0x204]
je 0x415cf0
mov al, byte [esi]
or al, al
je 0x415cf0
mov byte [edi], al
inc esi
inc edi
cmp al, 0x5c
jne 0x415cd2
lea edi, [ebp - 0x200]
jmp 0x415cd2
mov byte [edi], 0
push 0x45df62
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
lea edi, [ebp - 0x100]
add edi, eax
cmp dword [ebp + 0xc], 1
jne 0x415d42
mov al, 0x28
mov byte [edi], al
inc edi
mov al, 0x31
mov byte [edi], al
inc edi
mov al, 0x29
mov byte [edi], al
inc edi
jmp 0x415d4a
mov al, byte [edi - 2]
inc al
mov byte [edi - 2], al
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
or al, al
jne 0x415d4a
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x45c480]
jae 0x415d81
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x415d81
mov eax, dword [ebp + 0xc]
inc eax
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00415c84
push 0
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
pop edi
pop esi
leave
ret 8

Function at 0x415f44
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
or eax, eax
je 0x415f8c
lea esi, [ebp - 0x100]
add esi, eax
dec esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x415f80
mov al, 0
mov byte [esi], al
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
pop esi
leave
ret 4

Function at 0x416ec8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
call sub.kernel32.dll_GetUserDefaultLCID
mov edx, eax
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0xd
push edx
call sub.kernel32.dll_GetLocaleInfoA
mov al, byte [ebp - 0x100]
cmp al, 0x31
jne 0x416efd
mov eax, 1
jmp 0x416f02
mov eax, 0
mov dword [0x45ee12], eax
leave
ret
Function at 0x417b32
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push esi
push edi
push 0
push 0
push 0x184
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov eax, dword [ebp + 0x10]
mov dword [0x481876], eax
cmp eax, 0
jl 0x417bf6
push 0x4000
push 0x40
call fcn.00401030
mov dword [ebp - 4], eax
mov byte [ebp - 0x44], 0x43
lea eax, [ebp - 0x43]
push eax
push dword [ebp + 0x10]
call fcn.004011b7
push 0x45cd1a
push 0x4000
push dword [ebp - 4]
push 0x44ef8c
lea eax, [ebp - 0x44]
push eax
push str.KeyWords
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov esi, dword [ebp - 4]
dec esi
inc esi
mov al, byte [esi]
or al, al
je 0x417be9
cmp al, 0x20
je 0x417ba7
cmp al, 9
je 0x417ba7
lea edi, [ebp - 0x44]
mov al, byte [esi]
cmp al, 0x20
je 0x417bc7
cmp al, 9
je 0x417bc7
or al, al
jne 0x417be3
mov byte [edi], 0
lea eax, [ebp - 0x44]
push eax
push 0
push 0x180
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
dec esi
jmp 0x417ba7
mov byte [edi], al
inc esi
inc edi
jmp 0x417bb9
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
xor edi, edi
inc edi
jmp 0x417bf8
xor edi, edi
mov eax, dword [ebp + 0x10]
add eax, 4
push 0
push eax
push 0x199
push 0xfa1
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x417c7d
shr eax, 0x18
mov esi, eax
mov eax, 0
test esi, 1
je 0x417c2f
mov eax, 1
push eax
push 0xfa4
push dword [ebp + 8]
call sub.user32.dll_CheckDlgButton
mov eax, 0
test esi, 2
je 0x417c4f
mov eax, 1
push eax
push 0xfa3
push dword [ebp + 8]
call sub.user32.dll_CheckDlgButton
mov eax, 0
test esi, 0x10
je 0x417c6f
mov eax, 1
push eax
push 0xfa5
push dword [ebp + 8]
call sub.user32.dll_CheckDlgButton
mov eax, 0xfa5
call fcn.00417cb8
mov eax, 0xfac
call fcn.00417cb8
push 0
push 0
push 0xe
push 0xfac
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
or eax, eax
je 0x417cb2
mov eax, 0xfab
call fcn.00417cb8
pop edi
pop esi
leave
ret 0xc

Function at 0x417fe3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push 0
push 0
push 0x14b
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [ebp - 4], 0
jmp 0x418092
mov byte [0x463932], 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call fcn.004011b7
mov dword [0x463932], 0
push 0x45cc16
push 0x4000
push 0x463932
push 0x44ef8c
lea eax, [ebp - 0x44]
push eax
push str.Color
call sub.kernel32.dll_GetPrivateProfileStringA
cmp byte [0x463932], 0
je 0x41808f
lea eax, [ebp - 0x44]
push eax
push 0x463932
call fcn.0040cd48
lea eax, [ebp - 0x44]
push eax
push 0
push 0x143
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push dword [ebp - 4]
push eax
push 0x151
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x41800b
push 0
push 0
push 0x14e
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [0x48187a], 0
leave
ret 4
Function at 0x4180c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, 0x463d32
mov dword [ebx], 0
jmp 0x4181a2
push 0
push dword [ebp - 4]
push 0x150
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x41819f
mov edx, eax
lea eax, [ebp - 0x48]
push eax
push edx
call fcn.004011b7
mov dword [0x463932], 0
push 0x45cc16
push 0x4000
push 0x463932
push 0x44ef8c
lea eax, [ebp - 0x48]
push eax
push str.Color
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x48]
push eax
push 0x463932
call fcn.0040cd48
push ebx
push dword [ebp - 4]
push 0x148
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push 0x44ef90
push ebx
call fcn.004010c5
push 0x463932
push ebx
call fcn.004010c5
push dword [ebp - 8]
push dword [ebp - 4]
push 0x151
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push ebx
call fcn.004010ef
lea ebx, [eax + ebx + 1]
mov byte [ebx], 0
inc dword [ebp - 8]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4180e5
mov dword [ebp - 4], 0
mov ebx, 0x463d32
jmp 0x4181e7
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push ebx
lea eax, [ebp - 0x48]
push eax
push str.Color
call sub.kernel32.dll_WritePrivateProfileStringA
push ebx
call fcn.004010ef
lea ebx, [eax + ebx + 1]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jae 0x4181f2
cmp byte [ebx], 0
jne 0x4181ba
pop ebx
leave
ret 4
Function at 0x4181f7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], 0xf
jmp 0x418268
dec dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004011b7
mov dword [0x463932], 0
push 0x45cc16
push 0x4000
push 0x463932
push 0x44ef8c
lea eax, [ebp - 8]
push eax
push str.Color
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, dword [ebp - 4]
inc edx
lea eax, [ebp - 8]
push eax
push edx
call fcn.004011b7
push 0x45cc16
push 0x463932
lea eax, [ebp - 8]
push eax
push str.Color
call sub.kernel32.dll_WritePrivateProfileStringA
cmp dword [ebp - 4], 0
jne 0x418207
push 0x417b2a
push 0x463932
call fcn.004010a7
push 0x44ef90
push 0x463932
call fcn.004010c5
xor ebx, ebx
jmp 0x4182b3
push 0
push ebx
push 0x199
push 0xfaf
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push 1
push 0x463932
push eax
call fcn.0040cdd5
inc ebx
cmp ebx, 0x13
jb 0x418290
xor ebx, ebx
jmp 0x4182df
push 0
push ebx
push 0x199
push 0xfa1
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push 1
push 0x463932
push eax
call fcn.0040cdd5
inc ebx
cmp ebx, 0x13
jb 0x4182bc
push 0
push ebx
push 0x199
push 0xfa1
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push 1
push 0x463932
push eax
call fcn.0040cdd5
xor ebx, ebx
jmp 0x41831f
mov eax, dword [ebx*4 + 0x48187e]
push 1
push 0x463932
push eax
call fcn.0040cdd5
inc ebx
cmp ebx, 0x13
jb 0x41830a
mov eax, dword [ebx*4 + 0x48187e]
push 0
push 0x463932
push eax
call fcn.0040cdd5
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push 0x463932
lea eax, [ebp - 8]
push eax
push str.Color
call sub.kernel32.dll_WritePrivateProfileStringA
push dword [ebp + 8]
call fcn.00417fe3
push 0x417b2a
push 0xffffffffffffffff
push 0x158
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [0x48187a], eax
push 0
push eax
push 0x14e
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
pop ebx
leave
ret 4
Function at 0x4183af
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push 0
push 0
push 0x147
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x41851e
mov dword [0x48187a], eax
push 0
push eax
push 0x150
push 0xfb4
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004011b7
mov dword [0x463932], 0
push 0x45cc16
push 0x4000
push 0x463932
push 0x44ef8c
lea eax, [ebp - 4]
push eax
push str.Color
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x465932
push 0x463932
call fcn.0040cd48
xor ebx, ebx
jmp 0x418468
push 0x465932
push 0x463932
call fcn.0040cd48
push 0x465932
call fcn.00401168
push eax
push ebx
push 0x19a
push 0xfaf
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
inc ebx
cmp ebx, 0x13
jb 0x41843a
xor ebx, ebx
jmp 0x41849f
push 0x465932
push 0x463932
call fcn.0040cd48
push 0x465932
call fcn.00401168
push eax
push ebx
push 0x19a
push 0xfa1
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
inc ebx
cmp ebx, 0x14
jb 0x418471
xor ebx, ebx
jmp 0x4184c9
push 0x465932
push 0x463932
call fcn.0040cd48
push 0x465932
call fcn.00401168
mov dword [ebx*4 + 0x48187e], eax
inc ebx
cmp ebx, 0x14
jb 0x4184a8
push 0xfaf
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 0
push 0
push eax
call sub.user32.dll_InvalidateRect
push 0xfa1
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 0
push 0
push eax
call sub.user32.dll_InvalidateRect
mov eax, 1
shl eax, 0x10
or eax, 0xfa1
push 0
push eax
push 0x111
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
xor eax, eax
inc eax
jmp 0x418520
xor eax, eax
pop ebx
leave
ret 4
Function at 0x4193ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push edi
push 0x4000
push 0x483cd6
call sub.kernel32.dll_RtlZeroMemory
push 0x404
push 0x4838d2
call sub.kernel32.dll_RtlZeroMemory
mov eax, 0x4838d2
mov dword [ebp - 0x218], eax
mov eax, 0x483cd6
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], 1
jmp 0x419538
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x214]
call fcn.004011b7
push 0x45cd1a
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x110]
push eax
push str.CodeMacro
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x419532
mov edi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x21c]
mov dword [edi], eax
mov edi, eax
add dword [ebp - 0x218], 4
add dword [ebp - 0x21c], 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
call fcn.004010a7
mov eax, dword [ebp - 0x21c]
mov dword [edi], eax
lea eax, [ebp - 0x210]
push eax
call fcn.004010ef
inc eax
add dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x210]
push eax
call fcn.00419346
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
call fcn.004010a7
mov eax, dword [ebp - 0x21c]
mov dword [edi + 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.004010ef
inc eax
add dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x210]
push eax
call fcn.00419346
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
call fcn.004010a7
mov eax, dword [ebp - 0x21c]
mov dword [edi + 8], eax
lea eax, [ebp - 0x210]
push eax
call fcn.004010ef
inc eax
add dword [ebp - 0x21c], eax
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 0x100
jb 0x4193f9
pop edi
leave
ret
Function at 0x41b740
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
cmp dword [0x4a0296], 0
jne 0x41b890
push dword [ebp + 8]
pop dword [ebp - 0x2c]
push dword [ebp + 8]
call sub.user32.dll_GetParent
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowDC
mov dword [0x4a028e], eax
push dword [0x4a028e]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [0x4a0296], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [0x4a028e]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [0x4a029a], eax
push dword [0x4a029a]
push dword [0x4a0296]
call sub.gdi32.dll_SelectObject
push 0xcc0020
push 0
push 0
push dword [0x4a028e]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push dword [0x4a0296]
call sub.gdi32.dll_BitBlt
push 0
call sub.user32.dll_GetDC
mov dword [0x4a028a], eax
cmp dword [0x4a02a2], 0
je 0x41b80b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
push eax
push dword [0x4538c4]
call sub.user32.dll_GetClientRect
lea eax, [ebp - 0x20]
push eax
push dword [0x4538c4]
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x18]
push eax
push dword [0x4538c4]
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jbe 0x41b843
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jbe 0x41b84e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jae 0x41b859
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jae 0x41b864
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.gdi32.dll_CreateRectRgn
mov dword [0x4a0292], eax
push dword [0x4a0292]
push dword [0x4a028a]
call sub.gdi32.dll_SelectObject
mov dword [0x4a029e], eax
leave
ret 4