joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56b3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x71d934]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56b5a5
sub esp, 0x30
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x28]
test cl, cl
je 0x56b435
movzx ecx, byte [esp + 0x38]
cmp cl, 0xa
ja 0x56b419
cmp cl, 9
je 0x56b41e
cmp cl, 0xa
je 0x56b42a
jmp 0x56b43a
cmp cl, 0xb
jne 0x56b425
mov ecx, 0x20
jmp 0x56b43a
cmp cl, 0xc
jne 0x56b43a
mov byte [eax + 0x28], 0
mov ecx, 0xc
jmp 0x56b43a
movzx ecx, byte [esp + 0x38]
mov byte [esp + 0x23], cl
cmp dword [eax + 0x7c], 1
jne 0x56b455
mov edx, dword [eax + 8]
add edx, dword [eax + 0x1c]
mov dword [esp + 0x24], edx
mov ebx, edx
jmp 0x56b51a
mov edx, dword [esp + 0x3c]
mov ebx, edx
jmp 0x56b465
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], cl
dec edx
test edx, edx
jle 0x56b4e2
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x56b45d
mov dword [esp + 0x2c], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x591b60]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x71da68]
test eax, eax
je 0x56b4c7
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x3c]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x2c]
jmp 0x56b45d
add dword [eax + 0x60], ebx
cmp cl, 0xa
je 0x56b4ef
cmp cl, 0xc
jne 0x56b507
add dword [eax + 0x64], ebx
add dword [eax + 0x78], ebx
mov dword [eax + 0x68], 1
mov dword [eax + 0x7c], 1
add esp, 0x30
ret
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
add esp, 0x30
ret
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], 9
dec edx
test edx, edx
jle 0x56b597
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x56b511
mov dword [esp + 0x28], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x591b60]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x71da68]
test eax, eax
je 0x56b57c
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x24]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
jmp 0x56b511
add dword [eax + 0x60], ebx
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
jmp 0x56b455
call sym.runtime.morestack_noctxt
jmp sym.go_printer._printer_.writeByte
Function at 0x571f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x71d934]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x572138
sub esp, 0x54
lea eax, [0x59e900]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x5c]
cmp ecx, 1
jle 0x571f64
mov dword [esp], eax
lea ecx, [0x5b89d8]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
call sym.bytes._Buffer_.WriteString
mov eax, dword [esp + 0x50]
mov dword [esp], eax
lea ecx, [0x5fa09c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
call sym.bytes._Buffer_.WriteString
xor eax, eax
jmp 0x571f9b
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call sym.bytes._Buffer_.WriteString
mov eax, dword [esp + 0x20]
inc eax
mov ecx, dword [esp + 0x5c]
cmp ecx, eax
jle 0x571fe7
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x58]
lea ebx, [edx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
test eax, eax
jle 0x571f82
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
lea ecx, [0x5b89f4]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call sym.bytes._Buffer_.WriteString
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
jmp 0x571f82
mov ecx, dword [esp + 0x70]
test ecx, ecx
jne 0x57208d
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
call sym.runtime.convTstring
mov eax, dword [esp + 8]
lea ecx, [0x591ae0]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
lea eax, [0x5b2ac0]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
lea eax, [0x5c0405]
mov dword [esp], eax
mov dword [esp + 4], 0x19
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call sym.fmt.Errorf
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x28]
xor eax, eax
call fcn.0046f59a
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 4], ecx
call sym.runtime.convTstring
mov ecx, dword [esp + 8]
lea edx, [0x591ae0]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call sym.runtime.convTstring
mov ecx, dword [esp + 8]
lea edx, [0x591ae0]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
lea ecx, [0x5b2ac0]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x3c], ecx
lea ecx, [0x5c4969]
mov dword [esp], ecx
mov dword [esp + 4], 0x25
lea ecx, [esp + 0x28]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call sym.fmt.Errorf
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.main.failMessage
Function at 0x573e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x71d934]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x573f1f
sub esp, 0x30
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [eax + 0x74]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0x78]
mov dword [esp + 0x1c], edx
xor ebx, ebx
jmp 0x573e43
mov ebp, dword [esp + 0x18]
lea ebx, [ebp + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
cmp ebx, edx
jge 0x573e99
mov dword [esp + 0x18], ebx
lea eax, [ecx + ebx*8]
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x38]
mov dword [esp], edi
call esi
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x573e30
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 8], ecx
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
test al, al
je 0x573e30
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ecx, dword [eax + 0x80]
mov dword [esp + 0x2c], ecx
mov eax, dword [eax + 0x84]
mov dword [esp + 0x1c], eax
xor edx, edx
jmp 0x573ec0
mov ebx, dword [esp + 0x18]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
cmp edx, eax
jge 0x573f16
mov dword [esp + 0x18], edx
lea eax, [ecx + edx*8]
mov ebx, dword [eax + 4]
mov dword [esp + 0x10], ebx
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x38]
mov dword [esp], edi
call esi
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jne 0x573eb1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 8], ecx
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
test al, al
je 0x573eb1
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
call sym.runtime.morestack
jmp sym.main.parsePackage.func1
Function at 0x403b57
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push edi
xor edi, edi
push 0x1fe
lea eax, [ebp - 0x302]
push edi
push eax
mov dword [ebp - 4], edi
mov word [ebp - 0x304], di
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov ebx, 0xff
je 0x403ba6
push dword [ebp + 8]
mov eax, ebx
lea edi, [ebp - 0x304]
call fcn.004045b5
pop ecx
xor edi, edi
cmp word [ebp - 0x304], di
je 0x403c14
push ebx
lea eax, [ebp - 0x103]
push edi
push eax
mov byte [ebp - 0x104], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push edi
push ebx
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x304]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
jne 0x403c14
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
cmp eax, edi
je 0x403c2c
mov eax, dword [eax + 0xc]
cmp dword [eax], edi
je 0x403c2c
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x18]
xor edx, edx
inc edx
cmp ecx, edi
mov dword [ebp - 4], edx
je 0x403c2c
lea eax, [esi + 0x20]
mov dword [eax], edx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 4

Function at 0x40434c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x4044d1
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.0040431a
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x404563
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40454c
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40454c
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x404555
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x40456c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40466b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x40484d
Capabilities:
Get common file path

Disassembly:
cmp word [0x410128], 0
push esi
mov esi, 0x410128
jne 0x40486e
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x410334], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x410334]
pop ecx
pop ecx
pop esi
ret

Function at 0x404b79
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40c3dc
push eax
push eax
push dword [esp + 0x14]
push 0x40cb3c
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x404d5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x40cf20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x405612
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, eax
call fcn.0040431a
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
je 0x40567d
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
test ebx, ebx
mov edi, eax
je 0x405640
mov dword [ebx], edi
mov eax, dword [esi + 4]
cmp edi, eax
jl 0x405655
mov ecx, dword [esi + 8]
add eax, ecx
cmp eax, edi
jle 0x40564a
call fcn.004055d2
mov esi, dword [esi]
push edi
push esi
push dword [ebp + 8]
call fcn.00404d3c
add esp, 0xc
test eax, eax
pop edi
jne 0x405672
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x405686
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x405c72
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x40fb50
push dword [esp + 0xc]
push esi
push 0x40c3dc
push dword [esp + 0x14]
push 0x40fd60
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x405c97
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040b460
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40fb50
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40c3dc
push dword [ebp + 8]
push 0x40fd60
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x405d06
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x405d0a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040b460
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x40fb50
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40c3dc
push dword [ebp + 8]
mov esi, 0x40fd60
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x405d71
cmp dword [ebp + 0x10], 0
jne 0x405d71
xor eax, eax
jmp 0x405d7f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x4060d2
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.0040466b
test eax, eax
pop ecx
je 0x406159
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x40fb50
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x40fd60
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x40cbe8
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x40fde8
mov dword [0x40fde4], eax
call fcn.00405c72
push 0x3f
push str.TranslatorName
mov esi, 0x40fe68
call fcn.00405c72
push 0xff
push str.TranslatorURL
mov esi, 0x40fee8
call fcn.00405c72
add esp, 0x18
pop edi
pop esi
ret

Function at 0x406fe6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040b460
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x407df0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0x2a4], ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x407e9a
cmp dword [esi + 0x2ac], ebp
je 0x407e68
push 0x2b0
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x24], ebp
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4001
push 0x2b4
lea eax, [esp + 0x20]
push eax
push ebp
push 0x40c3dc
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 1
push 0x1003
push dword [esi + 0x290]
mov dword [esi + 0x298], eax
call edi
jmp 0x407e9a
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
push 1
lea ebp, [esi + 0x298]
push eax
mov dword [ebp], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [ebp]
push 1
push 0x1003
push dword [esi + 0x290]
call edi
xor ebp, ebp
cmp dword [esi + 0x2a8], ebp
je 0x407ed2
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebx
push 1
lea ebp, [esi + 0x29c]
push eax
mov dword [ebp], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [ebp]
push 0
push 0x1003
push dword [esi + 0x290]
call edi
push 1
push 1
push 0x19
push 0x10
pop ebp
push ebp
push ebp
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0
mov dword [esi + 0x294], eax
call ebx
push 0x1000
push ebp
push ebp
mov ebp, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 0x85
push eax
call ebp
push 0
mov dword [esp + 0x14], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x86
push eax
call ebp
push 0
push dword [esi + 0x294]
mov ebx, eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push dword [esi + 0x294]
call ebp
push dword [esp + 0x14]
push ebx
push dword [esi + 0x294]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push ebx
call ebp
mov eax, dword [esi + 0x294]
mov esi, dword [esi + 0x290]
push eax
push 0
push 0x1208
push esi
call fcn.00402a3c
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret
Function at 0x408a2d
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x410]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x408a5f
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
and word [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x40d064
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov eax, dword [esi + 0x694]
push 1
push 1
push 2
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.004089e2
test eax, eax
je 0x408ae3
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x408abe
lea eax, [ebp - 0x208]
push eax
call fcn.004044d1
pop ecx
jmp 0x408ac4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x408ad6
push dword [esi + 0x208]
mov ecx, eax
call fcn.00404393
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
leave
ret

Function at 0x408dc9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x274], edi
jne 0x408edd
push 0x208
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
call fcn.0040469a
pop ecx
lea eax, [ebp - 0x210]
push 0x2e
push eax
call sub.msvcrt.dll_wcsrchr
cmp eax, edi
pop ecx
pop ecx
je 0x408e26
mov word [eax], di
lea eax, [ebp - 0x210]
push str..cfg
push eax
call sub.msvcrt.dll_wcscat
mov esi, dword [ebx + 0x6a4]
pop ecx
pop ecx
push str._cfg
call fcn.004054a3
cmp eax, edi
jl 0x408e6e
push 0x104
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [eax + 1]
mov eax, dword [ebx + 0x6a4]
call fcn.00405493
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
mov word [ebp - 0x628], di
mov word [ebp - 0x41e], di
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x40d4d8
call fcn.0040a8d2
mov eax, dword [ebx + 0x690]
lea esi, [ebp - 0x630]
call fcn.00401bd1
mov eax, ebx
call fcn.0040190f
mov ebx, dword [ebx + 0x694]
mov edi, esi
call fcn.0040662e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x690]
push 0x2c
add eax, 0x250
push eax
push str.WinPosOptionsDlg
mov ecx, esi
call fcn.0040a969
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a7c1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0040b460
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x40a820
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.00404dab
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x40a861
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x40c3dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00404e34
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40a867
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40a885
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040a774
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret