joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517300
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x268], ecx
push 0x10
push 0
lea eax, [ebp - 0x264]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 4
call fcn.00587e90
push eax
push 0x10
lea ecx, [ebp - 0x264]
push ecx
push 0x673c59
push 0x674410
push 0x67441c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x109], dl
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x517377
or eax, 0xffffffff
jmp 0x517443
lea ecx, [ebp - 0x264]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401640
push 0x100
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x108]
push eax
push 0x673c5a
push 0x674428
push 0x674434
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne cl
mov byte [ebp - 0x251], cl
movzx edx, byte [ebp - 0x251]
test edx, edx
jne 0x5173e9
mov eax, 0xfffffffe
jmp 0x517443
push 0x100
push 0
lea eax, [ebp - 0x250]
push eax
call fcn.005e5330
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x250]
push edx
call fcn.005e5550
add esp, 0xc
push 1
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x250]
push ecx
call sub.Password.dll_DecryptStringEX
lea edx, [ebp - 0x150]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401640
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 8

Function at 0x517570
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0xea60
push 0x674470
push 0x674480
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e20
jle 0x5175ad
mov eax, dword [ebp - 4]
jmp 0x5175b2
mov eax, 0xea60
mov esp, ebp
pop ebp
ret

Function at 0x5176c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 1
push str.UpdateEnable
push 0x6744dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret

Function at 0x517780
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0
push str.SavePassword
push 0x674518
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret
Function at 0x5177c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673c5b
push 0x674524
push 0x674530
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x517832
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x517853
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x67453c
push 0x674540
push 0x67454c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x5179d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], 0
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673c6b
push str.bSupport
push 0x67459c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x12], dl
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x517a42
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
test eax, eax
setne dl
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x517b50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673c77
push 0x6745dc
push 0x6745e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x517bc9
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x517bea
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00587e90
push eax
push 0x6745f0
push 0x6745f4
push 0x6745fc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0xa
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x673c85
push 0x674608
push 0x674614
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne cl
mov byte [ebp - 0x11], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x517c42
lea eax, [ebp - 0x10]
push eax
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x1c], eax
jmp 0x517c63
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00587e90
push eax
push 0x674620
push str.Lock_Min
push str.Lock_Screen
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x517c80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62d026
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.005e5330
add esp, 0xc
push str.Download
call fcn.0041b910
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x128]
add ecx, 4
call fcn.00587e90
push eax
push 0x104
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x120]
call fcn.00587e90
push eax
push 0x674648
push 0x674650
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne al
mov byte [ebp - 0x121], al
push 0x673c86
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0040ced0
add esp, 8
test eax, eax
jne 0x517d5d
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040bb70
jmp 0x517d6c
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401640
mov cl, byte [ebp - 0x121]
mov byte [ebp - 0x122], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401620
mov al, byte [ebp - 0x122]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4
Function at 0x517df0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673c87
push 0x674678
push 0x674680
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x517e62
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x517e83
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x67468c
push 0x674690
push 0x674698
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x517f50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 1
push 0x6746bc
push 0x6746c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret

Function at 0x518040
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 0
push 0x6746f0
push 0x6746fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 0
push 0x674708
push 0x674714
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 0
push 0x674720
push 0x674730
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x518200
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 1
push 0x674794
push 0x6747a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x518580
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673cba
push 0x674868
push 0x674874
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x40
cmp dword [ebp - 0x18], 0x40
jbe 0x5185e9
lea edx, [ebp - 0x10]
push edx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x51df00
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62dc05
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CDlgSkinWin.0
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x14c
call fcn.0043bda0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.00523aa0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.00523aa0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x84
call fcn.00523aa0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.00523aa0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00523aa0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00523aa0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00523aa0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00523aa0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00523aa0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00523aa0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00401620
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.0052ace0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x51e020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62dc38
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 0x10]
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0x676fe8
lea ecx, [ebp + 0xc]
call fcn.00587e90
push eax
lea ecx, [ebp + 8]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx]
test eax, eax
je 0x51e1a0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x118], ecx
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x228], eax
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x224], eax
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x220], eax
movzx edx, byte [ebp - 0x228]
movzx eax, byte [ebp - 0x224]
shl eax, 8
or edx, eax
movzx ecx, byte [ebp - 0x220]
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00401620
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401620
mov eax, dword [ebp - 0x22c]
jmp 0x51e1ff
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x230], edx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00401620
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401620
mov eax, dword [ebp - 0x230]
jmp 0x51e1ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5228d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xec]
mov dword [eax + 0xf0], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xec], 2
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x522a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0xf030
jne 0x522a4d
mov ecx, dword [ebp - 4]
call fcn.00522840
jmp 0x522adc
cmp dword [ebp + 8], 0xf120
jne 0x522a6c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xec], 1
jne 0x522a6c
mov ecx, dword [ebp - 4]
call fcn.00522910
jmp 0x522adc
cmp dword [ebp + 8], 0xf120
jne 0x522aae
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xec], 2
jne 0x522aae
push 9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf0]
mov dword [ecx + 0xec], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.00521080
jmp 0x522adc
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x522acf
cmp dword [ebp + 8], 0xf010
je 0x522acb
cmp dword [ebp + 8], 0xf012
jne 0x522acd
jmp 0x522adc
jmp 0x522adc
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call eax
mov esp, ebp
pop ebp
ret 8
Function at 0x522ba0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62e05f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 0xc], 0
jne 0x522d27
lea ecx, [ebp - 0x1c]
call fcn.00422710
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
lea ecx, [ebp - 0x1c]
call fcn.005d2ee7
lea ecx, [ebp - 0x1c]
call fcn.00522f50
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0
jmp 0x522c1d
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jge 0x522c3a
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00522f70
cmp eax, dword [ebp + 8]
jne 0x522c38
jmp 0x522c3a
jmp 0x522c14
lea ecx, [ebp - 0x1c]
call fcn.005d2f10
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x10]
jl 0x522c68
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041cb10
mov eax, dword [ebp - 0x20]
jmp 0x522d29
cmp dword [ebp + 8], 0xf030
jne 0x522c7e
mov ecx, dword [ebp - 0x28]
call fcn.00522840
jmp 0x522d0c
cmp dword [ebp + 8], 0xf020
jne 0x522c91
mov ecx, dword [ebp - 0x28]
call fcn.005228d0
jmp 0x522d0c
cmp dword [ebp + 8], 0xf120
jne 0x522cb0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xec], 1
jne 0x522cb0
mov ecx, dword [ebp - 0x28]
call fcn.00522910
jmp 0x522d0c
cmp dword [ebp + 8], 0xf120
jne 0x522cf2
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0xec], 2
jne 0x522cf2
push 9
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0xf0]
mov dword [ecx + 0xec], eax
push 0
mov ecx, dword [ebp - 0x28]
call fcn.00521080
jmp 0x522d0c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x112
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041cb10
mov eax, dword [ebp - 0x24]
jmp 0x522d29
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5232d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52330a
xor eax, eax
jmp 0x52339d
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x523325
xor eax, eax
jmp 0x52339d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x52338f
cmp dword [ebp + 0x14], 0
jne 0x523357
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 9], 1
jmp 0x523386
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x18]
cmp dword [edx], eax
jl 0x523386
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.005e5550
add esp, 0xc
mov byte [ebp - 9], 1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005235c0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x525e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62e49c
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 0x10]
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0x677560
lea ecx, [ebp + 0xc]
call fcn.00587e90
push eax
lea ecx, [ebp + 8]
call fcn.00587e90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx]
test eax, eax
je 0x525fea
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x118], ecx
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x228], eax
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x224], eax
push 0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.0052b4a0
add esp, 0xc
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x220], eax
movzx edx, byte [ebp - 0x228]
movzx eax, byte [ebp - 0x224]
shl eax, 8
or edx, eax
movzx ecx, byte [ebp - 0x220]
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00401620
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401620
mov eax, dword [ebp - 0x22c]
jmp 0x526049
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x230], edx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00401620
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401620
mov eax, dword [ebp - 0x230]
jmp 0x526049
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x52a940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0xf030
jne 0x52a95a
mov ecx, dword [ebp - 4]
call fcn.0052a770
jmp 0x52a9c8
cmp dword [ebp + 8], 0xf120
jne 0x52a979
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 1
jne 0x52a979
mov ecx, dword [ebp - 4]
call fcn.0052a830
jmp 0x52a9c8
cmp dword [ebp + 8], 0xf120
jne 0x52a9bb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xe8], 2
jne 0x52a9bb
push 9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xec]
mov dword [ecx + 0xe8], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.00528e40
jmp 0x52a9c8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call eax
mov esp, ebp
pop ebp
ret 8