joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4738e8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, 0x511bbc
cmp dword [esi + 4], 0
jne 0x47391b
push 1
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
push esi
mov ecx, dword [edi]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004b6d0c
jmp 0x473a5c
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x47392c
mov eax, 2
jmp 0x473a5c
cmp dword [eax + 0x18], 1
jne 0x473a57
cmp dword [eax + 8], 0
jne 0x473a3d
xor edx, edx
mov dword [0x511bb8], edx
mov edx, dword [eax]
cmp byte [edx], 0x3d
jne 0x473a04
mov eax, edx
inc eax
mov dword [0x511bc0], eax
cmp byte [eax], 0
je 0x473a14
xor ecx, ecx
mov dword [ebx], ecx
mov eax, dword [0x4f2768]
push eax
call fcn.004270e4
test eax, eax
je 0x4739ac
mov edx, dword [0x4f2768]
cmp dword [edx + 0x51c], 0
je 0x4739ac
mov ecx, dword [0x511bc0]
push ecx
mov eax, dword [0x4f2768]
add eax, 0x3f0
push eax
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4739ac
mov edx, dword [0x4f2768]
mov dword [ebx], edx
cmp dword [ebx], 0
jne 0x4739ee
mov ecx, dword [0x4f2764]
mov dword [ebx], ecx
jmp 0x4739e9
mov eax, dword [ebx]
cmp dword [eax + 0x51c], 3
jne 0x4739df
mov edx, dword [0x511bc0]
push edx
add eax, 0x3f0
push eax
call fcn.004014a8
add esp, 8
test eax, eax
je 0x4739ee
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x870]
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4739bb
cmp dword [ebx], 0
je 0x473a14
mov edx, dword [ebx]
mov ecx, dword [edx]
push ecx
call fcn.004eae80
mov dword [0x511bb8], eax
jmp 0x473a14
mov eax, dword [esi + 0x30]
mov edx, dword [eax]
push edx
call fcn.004eae20
mov dword [0x511bb8], eax
mov eax, dword [0x511bb8]
test eax, eax
je 0x473a3d
cmp dword [eax + 0x5d0], 0
je 0x473a3d
mov edx, dword [ebp + 0x14]
push edx
push 0x1f4
push 0xd
mov ecx, dword [eax + 0x5d0]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [esi + 0x30]
push eax
mov edx, dword [edi]
push edx
call fcn.00498fb0
mov dword [edi], eax
xor ecx, ecx
mov dword [esi + 4], ecx
mov eax, 2
jmp 0x473a5c
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x483450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, 0x5124e3
mov eax, dword [ebp + 0x10]
push eax
call fcn.00499164
xor edx, edx
mov dword [ebp - 4], edx
xor ebx, ebx
push ebx
mov eax, dword [ebp + 0xc]
push eax
push 0x4f7f1e
push 0x5128ca
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov edx, dword [ebp + 0x14]
push edx
push 0x3e7
push edi
push 0x4f7f24
push 0x5128ca
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x483585
cmp esi, 1
jne 0x483530
push 0x4f7f28
push edi
call fcn.004015f8
add esp, 8
test eax, eax
jne 0x48356a
push esi
push edi
mov esi, 0x5128ca
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x3a
push 0x5128ca
call fcn.00401278
add esp, 8
test eax, eax
jne 0x483506
inc ebx
jmp 0x48346f
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x483515
inc ebx
jmp 0x48346f
push eax
push 0x5128ca
push 0x5128ca
push 0x4f7f30
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x48356a
cmp esi, 2
jne 0x48354d
push 0x4f7f40
push edi
call fcn.004015f8
add esp, 8
test eax, eax
jne 0x48356a
inc ebx
jmp 0x48346f
cmp esi, 3
jne 0x48356a
push 0x4f7f45
push edi
call fcn.004015f8
add esp, 8
test eax, eax
jne 0x48356a
inc ebx
jmp 0x48346f
push 0
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call fcn.00498c08
test eax, eax
je 0x48357f
mov dword [ebp - 4], eax
inc ebx
jmp 0x48346f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x4835fc
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4f7ef4
mov esi, 0x5183d6
push 0x4f7dec
push pe_nt_image_headers32
push esi
lea eax, [ebx + 0x6a]
push eax
lea edx, [ebx + 0x62]
push edx
lea ecx, [ebx + 0x5a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push pe_nt_image_headers32
lea eax, [esi + 0x100]
push eax
lea edx, [ebx + 0x7d]
push edx
lea ecx, [ebx + 0x76]
push ecx
lea eax, [ebx + 0x6e]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push pe_nt_image_headers32
lea edx, [esi + 0x200]
push edx
lea ecx, [ebx + 0x92]
push ecx
lea eax, [ebx + 0x89]
push eax
lea edx, [ebx + 0x81]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push pe_nt_image_headers32
lea ecx, [esi + 0x300]
push ecx
lea eax, [ebx + 0xa8]
push eax
lea edx, [ebx + 0x9e]
push edx
lea ecx, [ebx + 0x96]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push pe_nt_image_headers32
lea eax, [esi + 0x400]
push eax
lea edx, [ebx + 0xbc]
push edx
lea ecx, [ebx + 0xb4]
push ecx
lea eax, [ebx + 0xac]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
jne 0x4836db
push esi
mov edi, esi
lea esi, [ebx + 0xc0]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [esi + 0x100], 0
jne 0x4836f8
push esi
lea edi, [esi + 0x100]
lea esi, [ebx + 0xc9]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x200], 0
jne 0x483714
push esi
lea edi, [esi + 0x200]
lea esi, [ebx + 0xd4]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
cmp byte [esi + 0x300], 0
jne 0x483731
push esi
lea edi, [esi + 0x300]
lea esi, [ebx + 0xde]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x400], 0
jne 0x483765
push esi
lea edi, [esi + 0x100]
add esi, 0x400
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop esi
pop ebx
ret
Function at 0x484bfc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
jne 0x484c8a
test edi, edi
jne 0x484c65
push 0x4f7dec
push 0x3dd
push 0x5124e3
push 0x4f8164
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5124e3], 0
je 0x484c65
mov esi, ebx
mov edi, 0x4f7dec
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x484d73
push esi
push edi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.0041fbd4
push 0x50d1f7
push 0x50d0f7
push 0x50cff7
push 0x50cff4
push ebx
call fcn.00405b58
add esp, 0x14
cmp byte [0x50cff4], 0
jne 0x484cbf
cmp byte [0x50cff7], 0
je 0x484ccf
push 1
push ebx
call fcn.0041f620
test eax, eax
jne 0x484d73
push 0x50d1f7
push 0x50d0f7
push 0x4f7cec
push 0x4f8168
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 1
push ebx
call fcn.0041f620
test eax, eax
jne 0x484d73
test edi, edi
jne 0x484d4a
push 0x4f7dec
push 0x3dd
push 0x5124e3
push 0x4f8170
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5124e3], 0
je 0x484d4a
mov esi, ebx
mov edi, 0x4f7dec
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x484d73
push esi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push ebx
call fcn.0041fbd4
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x486360
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffa8
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push 0x4f8aab
call fcn.004e8fc4
cmp dword [0x4fd514], 0
je 0x4863bd
mov ecx, dword [0x4fd9ec]
push ecx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4863bd
mov dword [esp + 0x10], 3
jmp 0x4863f6
mov eax, dword [0x4fd9ec]
push eax
call sub.USER32.dll_IsIconic
test eax, eax
je 0x4863d6
mov dword [esp + 0x10], 1
jmp 0x4863f6
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x4863f0
mov dword [esp + 0x10], 2
jmp 0x4863f6
xor ecx, ecx
mov dword [esp + 0x10], ecx
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x48641d
cmp dword [0x4fd510], 0
je 0x486415
mov dword [esp + 0x10], 3
jmp 0x48641d
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
jne 0x48645a
lea eax, [esp + 0x48]
push eax
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_GetWindowRect
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp + 0x50]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x54]
sub edx, eax
mov dword [esp + 0xc], edx
jmp 0x486495
mov dword [esp + 0x1c], 0x2c
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [0x4fd9ec]
push eax
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov edx, dword [esp + 0x40]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x44]
sub edx, eax
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [esp + 0x18]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [esp + 0x1c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
push 0x4f8ab1
push 0x5128ca
call sub.USER32.dll_wsprintfA
add esp, 0x24
push 0x4f7dec
push 0x5128ca
push 0x4f8ad0
push 0x4f8ac7
call fcn.0048326c
add esp, 0x58
ret
Function at 0x498418
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [0x515ee8], 0
je 0x498441
lea eax, [ebp - 4]
push eax
push 0x4f9da4
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
jmp 0x498456
lea eax, [ebp - 4]
push eax
push 0x4f9db3
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
je 0x49845e
xor eax, eax
jmp 0x49848f
push esi
call fcn.00401318
pop ecx
inc eax
push eax
push esi
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegSetValueA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49848a
xor eax, eax
jmp 0x49848f
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x498498
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [esi], 0
cmp dword [0x515ee8], 0
je 0x4984c6
lea eax, [ebp - 8]
push eax
push 0x4f9db9
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4984db
lea eax, [ebp - 8]
push eax
push 0x4f9dc8
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4984e3
xor eax, eax
jmp 0x498514
mov dword [ebp - 4], 0x3e7
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueA
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49850f
xor eax, eax
jmp 0x498514
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x49851c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
cmp dword [0x515ee8], 0
je 0x498541
lea eax, [ebp - 4]
push eax
push 0x4f9dce
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x498556
lea eax, [ebp - 4]
push eax
push 0x4f9ddd
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x49855e
xor eax, eax
jmp 0x498583
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49857e
xor eax, eax
jmp 0x498583
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x499758
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x514b88
mov edi, 0x514b80
mov ebp, 0x514b7c
cmp dword [0x4fda0c], 0
jne 0x499794
push 0
push 0
push 8
push 0x4f9f14
call fcn.004ee374
mov esi, eax
mov dword [0x4fda0c], esi
test esi, esi
je 0x49997f
mov eax, dword [0x4fda0c]
push eax
call fcn.004eae80
mov esi, eax
mov dword [ebp], esi
test esi, esi
je 0x49997f
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x514b8c], eax
push 0x425
mov eax, dword [0x4fda0c]
push eax
call sub.USER32.dll_GetDlgItem
mov esi, eax
mov dword [0x514b90], esi
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [0x514b90]
push eax
call sub.USER32.dll_EnableWindow
mov edx, dword [ebp]
mov ecx, dword [edx + 0x4b8]
push ecx
call fcn.00499164
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + 0x4b8], edx
push 0
push 0
push 0x184
mov ecx, dword [eax + 0x5d4]
push ecx
call sub.USER32.dll_SendMessageA
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4fda0c]
push eax
call sub.USER32.dll_SetWindowPos
mov eax, dword [0x4f9ef4]
test eax, eax
je 0x499900
mov dword [ebx], eax
jmp 0x4998ce
mov edx, dword [esi]
push esi
push edi
mov edi, edx
mov esi, 0x51382c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x2c
push 0x51382c
call fcn.00401278
add esp, 8
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x4998c7
mov byte [esi], 0
inc dword [edi]
mov eax, dword [edi]
cmp byte [eax], 0
je 0x4998c7
push 0x2c
mov edx, dword [edi]
push edx
call fcn.00401278
add esp, 8
mov esi, eax
mov dword [0x514b84], esi
test esi, esi
je 0x4998c7
mov byte [esi], 0
mov eax, dword [edi]
push eax
push 0x51382c
call fcn.004014a8
add esp, 8
test eax, eax
je 0x4998d8
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov esi, dword [ebx]
test esi, esi
jne 0x49984a
cmp dword [ebx], 0
jne 0x4998fa
mov eax, dword [0x4f9ef4]
mov dword [ebx], eax
jmp 0x4998fa
mov edx, dword [ebp]
push edx
push 0
push eax
call fcn.004993fc
mov ecx, dword [0x4f9ef4]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x4998e6
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + 0x4c8], edx
push 0
push eax
call fcn.004eb3ac
cmp dword [0x4f9ef8], 0
je 0x49994f
push 2
push 0x4f9f20
push 0x425
mov ecx, dword [0x4fda0c]
push ecx
call fcn.004ea900
push 1
mov eax, dword [0x514b90]
push eax
call sub.USER32.dll_EnableWindow
push 5
mov edx, dword [0x514b90]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x4fda0c]
push ecx
call fcn.004eaeb4
push 0
push 0
push 0x186
mov eax, dword [ebp]
mov edx, dword [eax + 0x5d4]
push edx
call sub.USER32.dll_SendMessageA
mov ecx, dword [0x514b8c]
push ecx
call sub.USER32.dll_SetCursor
mov eax, dword [0x4f9ef4]
push eax
call fcn.00499164
xor edx, edx
mov dword [0x4f9ef4], edx
cmp dword [0x4f9ef8], 0
jne 0x4999a9
push 0
mov ecx, dword [0x4fda0c]
push ecx
call fcn.004eb4c8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49acb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x4fa0a4
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x49acdd
mov esi, 0x4fa0b3
mov edi, 0x513c45
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49ad3a
push 0x4fa0bb
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x49ad00
mov esi, 0x4fa0cb
mov edi, 0x513c45
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49ad3a
push 0x20
push esi
call fcn.00401278
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x49ad15
mov ebx, esi
jmp 0x49ad16
inc ebx
mov esi, 0x513c45
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0xc], 0
jne 0x49ad47
mov eax, 0x513c45
jmp 0x49ad7c
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fa0de
push 0x513c45
push 0x4fa0d5
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x515718], 0
je 0x49ad7a
mov eax, 0x515718
jmp 0x49ad7c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x49dfe0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x5124e3
mov edi, 0x4fa314
mov ebp, 0x5128ca
call fcn.0049f6e8
call sub.USER32.dll_CreatePopupMenu
mov ebx, eax
mov dword [0x4fa224], ebx
test ebx, ebx
je 0x49e07e
xor ebx, ebx
push ebx
lea eax, [edi + 0x10d]
push eax
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x4f2218
push 0x3e7
push esi
lea edx, [edi + 0x11c]
push edx
push ebp
lea ecx, [edi + 0x112]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x49e06e
push 0x20
push esi
call fcn.00401278
add esp, 8
test eax, eax
je 0x49e052
mov byte [eax], 0
push esi
lea eax, [ebx + 0x514]
push eax
push 0
mov edx, dword [0x4fa224]
push edx
call sub.USER32.dll_AppendMenuA
inc ebx
cmp ebx, 0x14
jl 0x49e00b
test ebx, ebx
jne 0x49e07e
call fcn.0049f6e8
push 0
call sub.USER32.dll_MessageBeep
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49e9ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x5155bc
call fcn.0049f6e8
push 2
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x49ea25
cmp dword [0x4fccb4], 0
je 0x49ea4d
push 0x400
push 2
mov edx, dword [ebp]
push edx
call sub.USER32.dll_DeleteMenu
jmp 0x49ea4d
cmp dword [0x4fccb4], 0
jne 0x49ea4d
push 0
push 0xefc
call fcn.0041f178
push eax
push 0x7c
push 0x400
push 2
mov ecx, dword [ebp]
push ecx
call sub.USER32.dll_InsertMenuA
push 3
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
jne 0x49ea6b
push 4
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
je 0x49eaf4
push 3
push ebx
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7f
jne 0x49eaa5
cmp dword [0x4fccb4], 0
je 0x49eade
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
jmp 0x49eade
cmp dword [0x4fccb4], 0
jne 0x49eade
push 0x4fa49a
push 0
push 0x800
push 2
push ebx
call sub.USER32.dll_InsertMenuA
push 0
push 0xefc
call fcn.0041f178
push eax
push 0x7f
push 0x400
push 3
push ebx
call sub.USER32.dll_InsertMenuA
cmp dword [0x4fa6a4], 0
je 0x49eaf4
push 8
push 0x7f
mov eax, dword [ebp]
push eax
call sub.USER32.dll_CheckMenuItem
mov edx, dword [ebp]
push edx
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x49eb27
push ebx
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7d
je 0x49eb27
push 0x400
push ebx
mov edx, dword [ebp]
push edx
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x49eb04
cmp dword [0x4fd9e4], 0
je 0x49ebd4
push 0x4fa49e
push 0
push 0x800
mov ecx, dword [ebp]
push ecx
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x320
mov esi, dword [0x4fd9e4]
test esi, esi
je 0x49ebd4
push 0x3c
push 0x515718
mov eax, dword [esi]
push eax
call sub.USER32.dll_GetWindowTextA
push 0x515718
call fcn.00401318
pop ecx
cmp eax, 0x32
jbe 0x49eb8d
push esi
push edi
mov esi, 0x4fa4a2
mov edi, 0x51574a
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x515718
push ebx
push 0x4fa4a7
push 0x515aff
call sub.USER32.dll_wsprintfA
add esp, 0x10
inc ebx
mov edx, dword [0x4fd9f8]
cmp edx, dword [esi]
jne 0x49ebb7
mov eax, 8
jmp 0x49ebb9
xor eax, eax
push 0x515aff
push edi
push eax
mov edx, dword [ebp]
push edx
call sub.USER32.dll_AppendMenuA
inc edi
mov esi, dword [esi + 0x828]
test esi, esi
jne 0x49eb5d
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a2cb8
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
xor eax, eax
mov dword [esp + 4], eax
xor edx, edx
mov dword [esp + 8], edx
mov ebp, 1
push 0x4f7cec
push 0x4fa718
push 0x515718
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x515718
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
mov dword [0x4fa6c4], ebx
test ebx, ebx
je 0x4a2db6
push esp
push 0x515718
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4a2db6
push esi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x4a2db6
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x4a2d99
push edi
push esi
mov eax, dword [esp + 8]
push eax
push 0x515718
call sub.VERSION.dll_GetFileVersionInfoA
push 0x4fa726
push 0x515718
call sub.USER32.dll_wsprintfA
add esp, 8
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0x515718
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4a2d93
cmp dword [esp + 8], 0
je 0x4a2d93
cmp dword [esp + 4], 0
je 0x4a2d93
mov eax, dword [esp + 4]
push eax
push 0x4fa691
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
jne 0x4a2d93
xor ebp, ebp
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
call sub.KERNEL32.dll_GlobalFree
test ebp, ebp
je 0x4a2db6
mov eax, dword [0x4fa6c4]
push eax
call sub.KERNEL32.dll_FreeLibrary
xor edx, edx
mov dword [0x4fa6c4], edx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret