joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b259
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc0
mov eax, 0x45cf22
jmp 0x42b272
cmp byte [eax], 0x2f
jne 0x42b271
mov byte [eax], 0x5c
inc eax
cmp byte [eax], 0
jne 0x42b269
lea eax, [ebp - 0x33e]
push eax
push 0x45cf22
push 0x104
push 0x45cf22
call sub.kernel32.dll_GetFullPathNameA
mov byte [ebp - 0x33e], 0
lea eax, [ebp - 0x13e]
push eax
push 0x45cf22
call sub.kernel32.dll_FindFirstFileA
push eax
call sub.kernel32.dll_FindClose
push 0x44ef92
lea eax, [ebp - 0x23e]
push eax
call fcn.004010a7
lea eax, [ebp - 0x112]
push eax
lea eax, [ebp - 0x23e]
push eax
call fcn.004010c5
lea eax, [ebp - 0x33e]
push eax
lea eax, [ebp - 0x23e]
push eax
call fcn.004010c5
lea eax, [ebp - 0x23e]
push eax
lea eax, [ebp - 0x33e]
push eax
call fcn.004010a7
push 0x45cf22
call fcn.004010ef
jmp 0x42b307
dec eax
cmp byte [eax + 0x45cf22], 0x5c
je 0x42b314
or eax, eax
jne 0x42b306
or eax, eax
je 0x42b336
mov byte [eax + 0x45cf22], 0
cmp byte [eax + 0x45cf21], 0x3a
je 0x42b336
cmp byte [eax + 0x45cf21], 0x5c
je 0x42b336
jmp 0x42b299
lea eax, [ebp - 0x33e]
push eax
push 0x45cf22
call fcn.004010c5
mov dword [0x453994], 0
push 0x9c45
call fcn.00449209
cmp dword [0x453994], 0
jne 0x42b387
cmp dword [ebp + 8], 0
je 0x42b371
call fcn.004154b0
jmp 0x42b3bb
push 0x45cf22
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42b385
call fcn.004154b0
jmp 0x42b3bb
push dword [0x453994]
call sub.user32.dll_IsIconic
or eax, eax
je 0x42b3a3
push 9
push dword [0x453994]
call sub.user32.dll_ShowWindow
push 0xffffffffffffffeb
push dword [0x453994]
call sub.user32.dll_GetWindowLongA
push eax
call sub.user32.dll_SetFocus
mov eax, 0
leave
ret 4

Function at 0x42b64b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
mov eax, dword [ebp + 0x14]
mov edx, 8
dec eax
mul edx
lea esi, [eax + 0x47696a]
push dword [ebp + 0xc]
call fcn.00428ce6
cmp dword [ebp + 0x18], 0
je 0x42b68a
cmp eax, 9
jne 0x42b680
mov eax, 1
jmp 0x42b68a
cmp eax, 3
jne 0x42b68a
mov eax, 0xa
cmp eax, 0x1e
jb 0x42b694
mov eax, 7
push eax
push 0x45de5e
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edx, eax
pop eax
test edx, 1
je 0x42b6cf
add eax, 0xb
add eax, 0x2e
mov edx, dword [esi]
or edx, edx
jne 0x42b6de
mov edx, dword [0x4a32e2]
push dword [ebp + 0x10]
push eax
push eax
push dword [ebp + 0xc]
push 0
push edx
push dword [ebp + 8]
call fcn.0042abd8
pop esi
leave
ret 0x14
Function at 0x42bd77
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
call sub.user32.dll_ReleaseCapture
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.user32.dll_ScreenToClient
push dword [ebp + 8]
call sub.user32.dll_GetParent
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call sub.user32.dll_ChildWindowFromPoint
cmp eax, dword [ebp + 8]
jne 0x42bf27
push 0
push 0
push 0xb
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
push 0
push 8
push 0x110b
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x110a
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call sub.user32.dll_ScreenToClient
lea eax, [ebp - 0x44]
push eax
push 0
push 0x1111
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
or eax, eax
jne 0x42be29
push 0
push 0xa
push 0x110a
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp eax, dword [ebp - 0xc]
je 0x42bf19
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x110c
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
cmp edx, 0
jl 0x42be72
push eax
push 3
push 0x110a
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp eax, dword [ebp - 0xc]
jne 0x42be72
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x148], 0
lea eax, [ebp - 0x148]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 0x34], 5
lea eax, [ebp - 0x34]
push eax
push 0
push 0x110c
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
mov ebx, dword [ebp - 0x10]
neg ebx
lea eax, [ebp - 0x148]
push eax
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x42bf19
push dword [ebp + 8]
call fcn.0042b997
mov eax, dword [0x4aa3e6]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 4
lea eax, [ebp - 0x34]
push eax
push 0
push 0x110c
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 0x10]
mov esi, 0x4a42e6
jmp 0x42befc
cmp eax, dword [esi + 4]
jne 0x42bef9
mov dword [esi + 8], ebx
jmp 0x42bf01
lea esi, [esi + 0xc]
cmp dword [esi], 0
jne 0x42beef
push dword [ebp + 8]
call fcn.0042bbf9
push dword [ebp + 8]
call fcn.0042b7bd
push dword [ebp + 8]
call fcn.0042bc11
push 0
push 1
push 0xb
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
call sub.user32.dll_GetDesktopWindow
push eax
call sub.comctl32.dll_ImageList_DragLeave
call sub.comctl32.dll_ImageList_EndDrag
push dword [0x4aa3ea]
call sub.comctl32.dll_ImageList_Destroy
pop esi
pop ebx
leave
ret 4
Function at 0x42cd2f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xaa3
push dword [ebp + 8]
call sub.user32.dll_IsDlgButtonChecked
or eax, eax
je 0x42cd51
mov esi, 0xabf
mov edi, 0xab5
jmp 0x42cd5b
mov esi, 0xab5
mov edi, 0xabf
mov eax, 7
jmp 0x42cd89
push eax
push esi
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 5
push eax
call sub.user32.dll_ShowWindow
push edi
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 0
push eax
call sub.user32.dll_ShowWindow
inc esi
inc edi
pop eax
dec eax
or eax, eax
jne 0x42cd62
pop edi
pop esi
leave
ret 4
Function at 0x42e18a
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push esi
push edi
lea eax, [ebp - 0x120]
push eax
push 0x20
push 0x7f7
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
lea esi, [ebp - 0x120]
lea edi, [ebp - 0x140]
mov al, byte [esi]
cmp al, 0x41
jb 0x42e1c1
cmp al, 0x5a
jbe 0x42e1c9
cmp al, 0x61
jb 0x42e1cf
cmp al, 0x7a
ja 0x42e1cf
mov byte [edi], al
inc edi
inc esi
jmp 0x42e1b7
mov byte [edi], 0
push esi
lea eax, [ebp - 0x120]
push eax
call fcn.004010a7
mov dword [ebp - 0x164], 1
inc dword [ebp - 0x164]
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x164]
call fcn.004011b7
push 0x45cd1a
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push 0x44feb7
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x42e316
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00401105
or eax, eax
jne 0x42e311
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004010a7
push str.__.___t
lea eax, [ebp - 0x140]
push eax
call fcn.004010c5
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004010c5
lea eax, [ebp - 0x100]
push eax
push 1
call fcn.004011b7
push 0x45cd1a
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push 0x44feb7
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x42e316
lea eax, [ebp - 0x120]
push eax
push 0x20
push 0x7f7
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call fcn.00408490
push 1
push 0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
push dword [0x4538b0]
call sub.shell32.dll_ShellExecuteA
jmp 0x42e316
jmp 0x42e1e9
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x42ece7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
mov dword [ebp - 4], 0x13
mov byte [ebp - 8], 0x24
lea eax, [ebp - 7]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cb12
push 0x80
lea eax, [ebp - 0x88]
push eax
push 0x44ef8c
lea eax, [ebp - 7]
push eax
push str.MakeFiles
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x42ed42
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call fcn.0040cc4c
dec dword [ebp - 4]
jns 0x42ecf7
leave
ret 4

Function at 0x42ed6e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push esi
push edi
push 0x45cd1a
push 0x40
push 0x4aad76
push str.error
push str.Identify
push 0x44feb7
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x4aad36
push 0x4aad76
call fcn.0040cd48
push 0x45cd1a
push 0
push str.Skip
push 0x44feb7
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x4aadb6], eax
push 0x45cd1a
push 0
push str.nAsm
push 0x44feb7
call sub.kernel32.dll_GetPrivateProfileIntA
or eax, eax
jne 0x42eddf
mov eax, dword [0x44f399]
mov dword [0x4aadba], eax
cmp dword [0x44f32d], 0
je 0x42ee46
cmp dword [0x461d46], 0
je 0x42ee46
push 0
push 0
push 0xba
push dword [0x453920]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x42ee25
push eax
push edx
mov dword [ebp - 0x14], edx
call fcn.0042ee4c
pop edx
pop eax
inc edx
cmp edx, eax
jb 0x42ee18
cmp dword [ebp - 0xc], 0
je 0x42ee46
push 0
push 0xa038
push 0x111
push dword [0x4538b0]
call sub.user32.dll_SendMessageA
pop edi
pop esi
leave
ret 4
Function at 0x4300ec
Capabilities:
Create thread
Terminate process

Disassembly:
cmp dword [0x4aad32], 0
je 0x4302fc
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x20c]
push eax
push 0x20
push edx
push fcn.0042f76d
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4aad0e], eax
lea eax, [ebp - 0x20c]
push eax
push dword [0x4aad0e]
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0x20c], 0x103
jne 0x430272
cmp dword [0x4aadbe], 0
jne 0x430157
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 0
push 0
push 0
lea eax, [ebp - 0x234]
push eax
call sub.user32.dll_GetMessageA
mov eax, dword [ebp - 0x230]
cmp eax, 0x102
jne 0x430198
cmp dword [ebp - 0x22c], 0x1b
jne 0x43026d
push 0x4d2
push dword [0x4aad1a]
call sub.kernel32.dll_TerminateProcess
jmp 0x43026d
cmp eax, 0x10
je 0x43026d
cmp eax, 0x200
jb 0x4301b3
cmp eax, 0x209
jbe 0x43026d
cmp eax, 0x113
jne 0x430255
inc esi
cmp esi, 4
jne 0x430255
lea eax, [ebp - 0x218]
push eax
push 0
push 0x434
push dword [0x453920]
call sub.user32.dll_SendMessageA
push dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x218]
cmp eax, 0x1e
jae 0x430217
add dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x437
push dword [0x453920]
call sub.user32.dll_SendMessageA
push str.__.___t
push 0
push 0xc2
push dword [0x453920]
call sub.user32.dll_SendMessageA
inc dword [ebp - 0x214]
pop dword [ebp - 0x218]
lea eax, [ebp - 0x218]
push eax
push 0
push 0x437
push dword [0x453920]
call sub.user32.dll_SendMessageA
xor esi, esi
lea eax, [ebp - 0x234]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x234]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x43011a
push 0x44ef8c
push 0
push 0xc2
push dword [0x453920]
call sub.user32.dll_SendMessageA
push dword [0x4aad0e]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x20c], 0xa
jne 0x4302b6
push 0x10
push 0x44f25f
push 0x44ef48
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
jmp 0x4302f4
cmp dword [ebp - 0x20c], 0xb
jne 0x4302f4
push 0x44ef63
push 0x463932
call sub.kernel32.dll_lstrcpyA
push 0x4aa50e
push 0x463932
call sub.kernel32.dll_lstrcatA
push 0x10
push 0x44f25f
push 0x463932
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
mov eax, dword [ebp - 0x20c]
jmp 0x430308
push eax
call fcn.0042f76d
mov dword [ebp - 0x20c], eax
ret
Function at 0x430309
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push 0x463932
call fcn.00408490
cmp dword [ebp - 0x210], 0
je 0x430322
mov ax, 0x22
jmp 0x430325
xor ax, ax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010c5
push 0x463932
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010a7
push 0x4aa50e
call fcn.004010ef
lea edx, [eax + 0x4aa50e]
cmp byte [edx - 1], 0x3a
je 0x43037b
mov word [edx], 0x20
inc edx
push edx
mov eax, dword [ebp - 0x210]
mov eax, dword [eax + 0x463932]
push eax
cmp ax, 0x2e24
jne 0x4303f5
cmp dword [0x4538c4], 0
je 0x430494
mov edx, dword [ebp - 0x210]
inc edx
lea eax, [edx + 0x463932]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
mov edx, dword [ebp - 0x210]
push 0x3fff
lea eax, [edx + 0x463932]
push eax
push dword [0x4538c4]
call sub.user32.dll_GetWindowTextA
push 0x2e
push 0x463932
call fcn.0040cd1c
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010c5
jmp 0x430494
cmp al, 0x24
jne 0x430450
cmp dword [0x4538c4], 0
je 0x430494
mov edx, dword [ebp - 0x210]
inc edx
lea eax, [edx + 0x463932]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
mov edx, dword [ebp - 0x210]
push 0x3fff
lea eax, [edx + 0x463932]
push eax
push dword [0x4538c4]
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010c5
jmp 0x430494
cmp al, 0x2a
jne 0x430494
mov edx, dword [ebp - 0x210]
inc edx
lea eax, [edx + 0x463932]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
mov edx, dword [ebp - 0x210]
push dword [ebp + 0xc]
lea eax, [edx + 0x463932]
push eax
call fcn.004010a7
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010c5
cmp dword [ebp - 0x210], 0
je 0x4304bc
push 0x463932
call fcn.004010ef
dec eax
push eax
push 0x463933
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcpynA
jmp 0x4304cd
push 0x463932
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
pop edx
cmp dl, 0x2a
je 0x430539
cmp dl, 0x24
je 0x430539
cmp edx, 0x63727372
je 0x430539
push str..obj
lea eax, [ebp - 0x104]
push eax
call fcn.0040ccb3
cmp eax, 0xffffffff
jne 0x430507
push str..res
lea eax, [ebp - 0x104]
push eax
call fcn.0040ccb3
cmp eax, 0xffffffff
je 0x430539
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x430539
inc dword [ebp - 0x238]
push 0x44e709
call fcn.00430605
lea eax, [ebp - 0x104]
push eax
call fcn.00430605
push str..res
push 0x463932
call fcn.0040ccb3
cmp eax, 0xffffffff
je 0x430564
cmp dword [0x44f32d], 0
jne 0x430565
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetFileAttributesA
jmp 0x430565
inc eax
pop edx
cmp eax, 0xffffffff
je 0x430576
push 0x463932
push edx
call fcn.004010a7
ret
Function at 0x430714
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
mov dword [ebp - 4], edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4307a5
mov dword [ebp - 8], eax
mov esi, str._BEGINTXT__r_n
call fcn.0043068b
push 0x45de5e
call fcn.004010ef
mov esi, 0x45cf22
add esi, eax
call fcn.0043068b
mov ax, 0xa0d
stosw word es:[edi], ax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x61a80
push edi
push dword [ebp - 8]
call sub.kernel32.dll_ReadFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
add edi, dword [ebp - 0xc]
mov al, byte [edi - 1]
cmp al, 0xa
je 0x430794
mov ax, 0xa0d
stosw word es:[edi], ax
mov esi, str._ENDTXT__r_n
call fcn.0043068b
mov eax, edi
sub eax, dword [ebp - 4]
jmp 0x4307df
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
mov eax, 0xffffffff
pop edi
leave
ret 4

Function at 0x4307e4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
mov dword [ebp - 4], edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4308e8
mov dword [ebp - 8], eax
mov esi, str._BEGINBIN__r_n
call fcn.0043068b
push 0x45de5e
call fcn.004010ef
mov esi, 0x45cf22
add esi, eax
call fcn.0043068b
mov ax, 0xa0d
stosw word es:[edi], ax
push 0
push dword [ebp - 8]
call sub.kernel32.dll_GetFileSize
or eax, eax
je 0x4308d7
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x40
call fcn.00401030
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.kernel32.dll_ReadFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov esi, dword [ebp - 0x10]
mov ah, 0
jmp 0x4308b7
mov al, byte [esi]
shr al, 4
add al, 0x30
cmp al, 0x39
jbe 0x430896
add al, 7
stosb byte es:[edi], al
mov al, byte [esi]
and al, 0xf
add al, 0x30
cmp al, 0x39
jbe 0x4308a3
add al, 7
stosb byte es:[edi], al
inc ah
cmp ah, 0x20
jne 0x4308b3
mov ax, 0xa0d
stosw word es:[edi], ax
mov ah, 0
inc esi
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x430889
or ah, ah
je 0x4308c7
mov ax, 0xa0d
stosw word es:[edi], ax
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalFree
mov esi, str._ENDBIN__r_n
call fcn.0043068b
mov eax, edi
sub eax, dword [ebp - 4]
jmp 0x430922
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
mov eax, 0xffffffff
pop edi
leave
ret 4
Function at 0x43098e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, 0x5b
stosb byte es:[edi], al
push dword [ebp + 8]
push edi
call fcn.004010c5
push dword [ebp + 8]
call fcn.004010ef
add edi, eax
mov eax, 0xa0d5d
stosd dword es:[edi], eax
dec edi
push 0x45cb12
push 0x4000
push 0x463932
push dword [ebp + 8]
call sub.kernel32.dll_GetPrivateProfileSectionA
mov esi, 0x463932
mov al, byte [esi]
or al, al
je 0x4309e1
call fcn.0043068b
inc esi
mov eax, 0xa0d
stosd dword es:[edi], eax
sub edi, 2
jmp 0x4309ca
leave
ret 4
Function at 0x430f96
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
mov ebx, 0x451135
mov esi, 0x4abaca
mov edi, 0x4ab6ca
mov dword [ebp - 0x210], 0x45
mov dword [ebp - 4], 1
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x44ef8c
lea eax, [ebp - 0x104]
push eax
push str.CustCtrl
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x43112e
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x104]
push eax
call fcn.00401168
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x4310f3
mov dword [esi], eax
push str.GetDefEx
push dword [esi]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x43108a
xor ecx, ecx
push eax
push ecx
mov dword [ebp - 0x208], esp
push ecx
call eax
mov esp, dword [ebp - 0x208]
or eax, eax
je 0x43107a
mov edi, eax
call fcn.00431133
call fcn.00431236
add ebx, 0x40
add esi, 4
inc dword [0x451c05]
pop ecx
pop eax
inc ecx
cmp ecx, dword [ebp - 0x20c]
jb 0x43104d
jmp 0x431126
push str.GetDef
push dword [esi]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x4310d1
xor ecx, ecx
push eax
push ecx
mov dword [ebp - 0x208], esp
push ecx
call eax
mov esp, dword [ebp - 0x208]
or eax, eax
je 0x4310c4
mov edi, eax
call fcn.00431133
add ebx, 0x40
add esi, 4
inc dword [0x451c05]
pop ecx
pop eax
inc ecx
cmp ecx, dword [ebp - 0x20c]
jb 0x43109c
jmp 0x4310f1
push dword [esi]
call sub.kernel32.dll_FreeLibrary
mov dword [esi], 0
push 0x10
push 0x44f25f
push str.GetDef
push 0
call sub.user32.dll_MessageBoxA
jmp 0x431126
push 0x44ecd3
push 0x467936
call fcn.004010a7
lea eax, [ebp - 0x204]
push eax
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push 0
call sub.user32.dll_MessageBoxA
inc dword [ebp - 4]
jmp 0x430fc2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431edf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
push dword [0x453970]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4538f0]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4538f8]
call sub.user32.dll_ShowWindow
push 8
push dword [0x4538c4]
call sub.user32.dll_GetWindowLongA
or eax, eax
jne 0x432132
push 0
push 0
push 0x188
push dword [0x4538ec]
call sub.user32.dll_SendMessageA
cmp eax, 0xffffffff
je 0x432132
mov dword [ebp - 0x14], eax
push 0x4abb4a
push dword [ebp - 0x14]
push 0x189
push dword [0x4538ec]
call sub.user32.dll_SendMessageA
mov ecx, 0x4abb4a
mov edx, 0x470662
jmp 0x431f6b
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp byte [ecx], 9
jne 0x431f65
mov byte [edx], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0x198
push dword [0x4538ec]
call sub.user32.dll_SendMessageA
push 0
push dword [ebp - 0x14]
push 0x199
push dword [0x4538ec]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x18], eax
push eax
push 0xffffffffffffffeb
push dword [0x4538f8]
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebp - 0x18]
cmp eax, 0xc8
jb 0x431fc1
cmp eax, 0x1f3
jbe 0x431fdd
cmp eax, 0x3e8
je 0x431fdd
cmp eax, 0x3eb
je 0x431fdd
cmp eax, 0x3ec
je 0x431fdd
cmp eax, 0xffff
jbe 0x432034
mov eax, dword [0x45ff7e]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov edx, dword [0x45ff82]
add edx, 0x20
sub edx, dword [0x45ff7e]
cmp eax, edx
jae 0x432001
mov dword [ebp - 8], edx
push 0
push dword [0x45ff7e]
push dword [0x45ff7e]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0
push dword [0x4538f8]
call sub.user32.dll_SetWindowPos
push 4
push dword [0x4538f8]
call sub.user32.dll_ShowWindow
jmp 0x43210d
push dword [0x4538ec]
call fcn.00431e15
cmp dword [ebp - 0x18], 0x3ea
je 0x432060
cmp dword [ebp - 0x18], 0x3ed
je 0x432060
cmp dword [ebp - 0x18], 0x3ee
je 0x432060
cmp dword [ebp - 0x18], 0x66
jne 0x432098
mov edx, dword [0x45ff7e]
dec edx
sub dword [ebp - 8], edx
push 0
push dword [0x45ff7e]
push dword [0x45ff7e]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0
push dword [0x4538f8]
call sub.user32.dll_SetWindowPos
push 4
push dword [0x4538f8]
call sub.user32.dll_ShowWindow
mov edx, dword [0x45ff82]
inc edx
mov dword [ebp - 0x10], edx
sub dword [ebp - 8], edx
mov eax, dword [0x45ff7e]
dec eax
push 0
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [0x4538f0]
call sub.user32.dll_SetWindowPos
push 4
push dword [0x4538f0]
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x10]
push eax
push 0
push 0xb2
push dword [0x4538f0]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x10], 1
mov eax, dword [0x45ff7e]
dec eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xb3
push dword [0x4538f0]
call sub.user32.dll_SendMessageA
mov eax, dword [0x4538e4]
call fcn.00404bfc
mov dword [edx + 0x90], 1
push 0
push 0xc
push dword [0x4538e4]
call fcn.004052c1
xor eax, eax
leave
ret
Function at 0x432dd4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
call sub.user32.dll_GetDesktopWindow
mov edx, eax
lea eax, [ebp - 0x10]
push eax
push edx
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_CopyRect
lea eax, [ebp - 0x10]
push eax
push dword [0x4538ec]
call sub.user32.dll_ClientToScreen
push 0
push 0
push 0x1a1
push dword [0x4538f4]
call sub.user32.dll_SendMessageA
push eax
push 0
push 0
push 0x18b
push dword [0x4538f4]
call sub.user32.dll_SendMessageA
cmp eax, 8
jbe 0x432e3f
mov eax, 8
pop edx
mul edx
add eax, 2
mov dword [ebp - 0x14], eax
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jbe 0x432e5d
mov eax, dword [ebp - 0x14]
inc eax
add eax, dword [0x45ff7e]
sub dword [ebp - 0xc], eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [0x4538f4]
call sub.user32.dll_SetWindowPos
push 5
push dword [0x4538f4]
call sub.user32.dll_ShowWindow
push dword [0x4538f4]
call sub.user32.dll_SetFocus
leave
ret 4