joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cff50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x55384c
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x553850
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d00c4
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d0069
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d0045
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4cfffc
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x553864
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4cffae
mov ecx, dword [ebp - 0x824]
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d0110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x55386c
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x553870
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d028a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d022c
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d0208
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d01bc
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x553878
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d016e
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d02d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x553880
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x553884
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d044a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d03ec
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d03c8
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d037c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x553894
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d032e
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d06c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5538a0
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x5538a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d083a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d07dc
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d07b8
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d076c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x5538b8
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d071e
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d0880
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5538c0
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x5538c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d0a00
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d099f
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d097b
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d092c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x5538d8
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d08de
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d0a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x4d0a69
lea ecx, [ebp + 0x20]
call fcn.00406190
jmp 0x4d0b82
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
ja case.default.0x4d0a7c
mov ecx, dword [ebp - 0x18]
jmp dword [ecx*4 + 0x4d0b88]
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4d0a7c
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x4d0a7c
push 0
push 0
push 0x12
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4d0a7c
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], 0
je 0x4d0b01
lea ecx, [ebp - 8]
call fcn.004d41e0
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 8]
call fcn.004d4860
lea ecx, [ebp - 8]
call fcn.004d4200
jmp case.default.0x4d0a7c
push ecx
mov ecx, esp
lea eax, [ebp + 0x20]
push eax
call fcn.00405e60
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x18]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0xc], eax
call fcn.004d10d0
add esp, 0x14
jmp case.default.0x4d0a7c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.004d1280
add esp, 8
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
imul eax, eax, 0xfffffffd
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
jmp case.default.0x4d0a7c
mov edx, dword [ebp + 8]
push edx
call fcn.004d1340
add esp, 4
lea ecx, [ebp + 0x20]
call fcn.00406190
mov esp, ebp
pop ebp
ret
Function at 0x4d0bb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5538e0
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x5538e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d0d30
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d0ccf
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d0cab
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d0c5c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x5538f4
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d0c0e
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d0d80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5538fc
lea ecx, [ebp - 4]
call fcn.00405520
lea eax, [ebp - 0x80c]
push eax
call fcn.004a0660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x553900
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4d0f00
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4d0e9f
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4d0e7b
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00405520
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.0049b390
lea ecx, [ebp - 0x818]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.00405ec0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4d0e2c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00405520
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.0049b390
lea ecx, [ebp - 0x81c]
call fcn.00406190
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x553918
lea ecx, [ebp - 4]
push ecx
call fcn.00403850
add esp, 0xc
jmp 0x4d0dde
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.004d15a0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4d1340
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
cmp dword [0x57cbe4], 0
jne 0x4d1396
mov dword [0x57cbe4], 1
mov dword [ebp - 0x34], 0
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0050c770
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x20], 0x400000
mov dword [ebp - 0xc], 0x553920
mov dword [ebp - 0x2c], 0x4d14a0
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push 0x400000
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push str.C579A2E8_9F83_4375_AB58_21A25ABB45B9
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d1495
push 0xfffffffffffffff0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
and ecx, 0x7fffffff
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
or edx, 0x40000000
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
push 0xfffffffffffffff0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x5c], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4d146a
cmp dword [ebp - 0x54], 0x12
jne 0x4d1456
jmp 0x4d1495
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4d147a
jmp 0x4d1495
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x38]
cmp eax, 0x3e8
jb 0x4d148c
jmp 0x4d1495
mov edx, 1
test edx, edx
jne 0x4d1436
mov esp, ebp
pop ebp
ret
Function at 0x4d3030
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
call fcn.004a0660
add esp, 4
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x258
push 0x553ba8
push 0x553bbc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x57cbe8], eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x258
push str.checkmaxY
push 0x553be0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x57cbec], eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x32
push str.checkminY
push 0x553c04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x57cbf0], eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x258
push str.checkExplmaxX
push 0x553c30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x57cbf4], eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0x258
push str.checkExplmaxY
push str.PopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x57cbf8], eax
mov dword [ebp - 8], 1
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4d4770
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4d47cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x4d47ad
xor eax, eax
jmp 0x4d4851
lea ecx, [ebp - 0x14]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4d47cb
xor eax, eax
jmp 0x4d4851
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
lea edx, [ebp - 0x20]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4d4829
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4d4851
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x4d484c
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4d4851
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4d4860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d4899
mov ecx, dword [ebp - 0xc]
call fcn.004d4770
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d48a3
xor eax, eax
jmp 0x4d48d2
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d48cf
mov ecx, dword [ebp - 0xc]
call fcn.004d4770
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4d4ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x553cf8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d4be5
cmp dword [ebp - 8], 0
je 0x4d4c38
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x553d3c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d4c27
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret