joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f64
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, 0x46fc52
xor eax, eax
jmp 0x407fab
push eax
push esi
push dword [ebp + 8]
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x407f87
call fcn.00407fc8
jmp 0x407fa9
cmp byte [esi], 0
je 0x407f94
push esi
call sub.kernel32.dll_GetFileAttributesA
jmp 0x407f97
xor eax, eax
dec eax
cmp eax, 0xffffffff
jne 0x407fa3
call fcn.00407fc8
jmp 0x407fa9
add esi, 0x100
pop eax
inc eax
cmp eax, 0xa
jb 0x407f72
call fcn.00407fe6
push dword [ebp + 8]
push 0x46fc52
call fcn.004010a7
pop edi
pop esi
leave
ret 4

Function at 0x408086
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 0
push 0
push 0x839
push dword [0x453924]
call sub.user32.dll_SendMessageA
mov dword [ebp - 4], 0
jmp 0x408106
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cd1a
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x44ef8c
lea eax, [ebp - 0x24]
push eax
push str.CharTab
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x408103
xor eax, eax
jmp 0x4080fe
push eax
mov edx, dword [ebp - 4]
shl edx, 4
or edx, eax
mov al, byte ss:[eax + ebp - 0x24]
cmp al, 0x30
jb 0x4080fc
cmp al, 0x39
ja 0x4080fc
and eax, 0xf
add edx, dword [0x44f34d]
mov byte [edx], al
pop eax
inc eax
cmp eax, 0x10
jb 0x4080db
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4080a9
leave
ret
Function at 0x40810e
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push edi
mov dword [ebp - 4], 1
mov ebx, 1
jmp 0x40818d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push 0x80
lea eax, [ebp - 0x8c]
push eax
push 0x44ef8c
lea eax, [ebp - 0xc]
push eax
push str.AddIns
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40818a
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040cd48
push str.RADebug.dll
lea eax, [ebp - 0x10c]
push eax
call fcn.0040112a
or eax, eax
jne 0x40818a
xor ebx, ebx
jmp 0x408193
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x40
jbe 0x408127
or ebx, ebx
je 0x4081dd
push str.RADebug.dll
lea eax, [ebp - 0x8c]
push eax
call fcn.004010a7
push str._12_1
lea eax, [ebp - 0x8c]
push eax
call fcn.004010c5
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.004011b7
push 0x45cc16
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xc]
push eax
push str.AddIns
call sub.kernel32.dll_WritePrivateProfileStringA
mov dword [ebp - 4], 1
mov edi, 0x4532b0
jmp 0x408319
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push 0x80
lea eax, [ebp - 0x8c]
push eax
push 0x44ef8c
lea eax, [ebp - 0xc]
push eax
push str.AddIns
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x408316
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040cd48
push 0x45d53a
push 0x45cf22
call fcn.004010a7
push 0x44ef92
push 0x45cf22
call fcn.004010c5
lea eax, [ebp - 0x10c]
push eax
push 0x45cf22
call fcn.004010c5
lea eax, [ebp - 0x10c]
push eax
push str.DragProp.dll
call fcn.0040112a
or eax, eax
jne 0x40828c
push 0x45cf22
call sub.kernel32.dll_DeleteFileA
jmp 0x408316
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040cd48
mov al, byte [ebp - 0x8c]
or al, al
je 0x4082bb
lea eax, [ebp - 0x8c]
push eax
call fcn.00401168
or eax, eax
jne 0x4082bb
jmp 0x408316
push 0x45cf22
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x4082e5
mov dword [edi], eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00401168
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x14], eax
add edi, 0x18
jmp 0x408316
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push 0
call sub.user32.dll_MessageBoxA
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x40
jbe 0x4081ee
pop edi
pop ebx
leave
ret
Function at 0x408581
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
mov edi, 0x463552
mov esi, 0x462d52
push 0x1e0
push edi
call sub.kernel32.dll_RtlZeroMemory
push 0x800
push esi
call sub.kernel32.dll_RtlZeroMemory
xor ebx, ebx
jmp 0x40863c
inc ebx
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004011b7
push 0x45cd1a
push 0x104
push 0x45ca0e
push 0x44ef8c
lea eax, [ebp - 4]
push eax
push str.CodeBlock
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x408645
push ebx
xor ebx, ebx
jmp 0x408633
push esi
push 0x45ca0e
call fcn.0040cd48
cmp byte [esi], 0
je 0x40862b
cmp ebx, 4
jne 0x408617
push esi
call fcn.00401168
mov dword [edi + ebx*4], eax
push 0x45ca0e
call fcn.00401168
shl eax, 0x10
or dword [edi + ebx*4], eax
jmp 0x408632
push esi
call fcn.004010ef
mov dword [edi + ebx*4], esi
mov byte [eax + esi + 1], 0
lea esi, [eax + esi + 2]
jmp 0x408632
mov dword [edi + ebx*4], 0
inc ebx
cmp ebx, 5
jb 0x4085e7
pop ebx
lea edi, [edi + 0x14]
cmp ebx, 0x18
jb 0x4085b1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a430
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
push 0x45cc16
push 0x104
push 0x45ca0e
push 0x44ef8c
push str.Assembler
push str.Assembler
call sub.kernel32.dll_GetPrivateProfileStringA
xor eax, eax
inc eax
jmp 0x40a474
push 0x400
push 0
push dword [0x4706a6]
call sub.user32.dll_DeleteMenu
or eax, eax
jne 0x40a462
mov dword [ebp - 0x104], 0x59d8
xor eax, eax
lea eax, [ebp - 0x100]
push eax
push 0x45ca0e
call fcn.0040cd48
cmp byte [ebp - 0x100], 0
je 0x40a4c0
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x104]
push 0
push dword [0x4706a6]
call sub.user32.dll_AppendMenuA
inc dword [ebp - 0x104]
jmp 0x40a484
pop esi
leave
ret
Function at 0x40a994
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
push 0x2000
push 0x40
call fcn.00401030
mov dword [ebp - 0x138], eax
push 0
push 0
push dword [0x453964]
call sub.user32.dll_CopyAcceleratorTableA
mov dword [ebp - 0x134], eax
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push dword [0x453964]
call sub.user32.dll_CopyAcceleratorTableA
push dword [0x453964]
call sub.user32.dll_DestroyAcceleratorTable
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x104]
call fcn.004011b7
push 0x45cc16
push 0x104
push 0x45ca0e
push 0x44ef8c
lea eax, [ebp - 0x80]
push eax
push str.Accel
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40ab3c
lea eax, [ebp - 0x80]
push eax
push 0x45ca0e
call fcn.0040cd48
lea eax, [ebp - 0x80]
push eax
call fcn.00401168
mov ebx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
inc ecx
jmp 0x40ab29
cmp ax, word [ebx + 4]
je 0x40aa66
cmp word [ebx + 4], 0
jne 0x40ab25
cmp word [ebx + 4], 0
jne 0x40aa77
mov word [ebx + 4], ax
inc dword [ebp - 0x134]
lea eax, [ebp - 0x100]
push eax
push 0x45ca0e
call fcn.0040cd48
lea eax, [ebp - 0x80]
push eax
push 0x45ca0e
call fcn.0040cd48
lea eax, [ebp - 0x80]
push eax
call fcn.00401168
mov word [ebx + 2], ax
push 0x45ca0e
call fcn.00401168
or al, 3
mov byte [ebx], al
mov esi, 0x45ca0e
lea eax, [ebp - 0x100]
push eax
push esi
call fcn.004010a7
push esi
call fcn.004010ef
lea esi, [eax + esi]
call fcn.0040abca
movzx edx, word [ebx + 4]
mov dword [ebp - 0x130], 0x2c
mov dword [ebp - 0x12c], 0x30
mov dword [ebp - 0x10c], 0x45ca0e
mov dword [ebp - 0x108], 0x104
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x130]
push eax
push 0
push edx
push dword [ebp + 8]
call sub.user32.dll_SetMenuItemInfoA
jmp 0x40ab31
add ebx, 6
dec ecx
or ecx, ecx
jne 0x40aa55
inc dword [ebp - 0x104]
jmp 0x40a9f3
mov esi, dword [ebp - 0x138]
mov byte [0x45ca0e], 0
jmp 0x40ab9b
mov edi, esi
add edi, 6
jmp 0x40ab91
movzx eax, word [esi + 2]
movzx ecx, byte [esi]
cmp ax, word [edi + 2]
jne 0x40ab8e
cmp cl, byte [edi]
jne 0x40ab8e
push esi
push edi
mov ebx, esi
lea esi, [ebp - 0x80]
call fcn.0040abca
lea eax, [ebp - 0x7f]
push eax
push 0x45ca0e
call fcn.004010c5
push 0x44ee71
push 0x45ca0e
call fcn.004010c5
pop edi
pop esi
add edi, 6
cmp word [edi + 4], 0
jne 0x40ab52
add esi, 6
cmp word [esi + 4], 0
jne 0x40ab4b
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call sub.user32.dll_CreateAcceleratorTableA
mov dword [0x453964], eax
push dword [ebp - 0x138]
call sub.kernel32.dll_GlobalFree
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b024
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push 0x45cd1a
push 0x40
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
push str.MenuMake
push str.MakeDefNoProject
call sub.kernel32.dll_GetPrivateProfileStringA
mov esi, 0x4539fc
mov al, byte [esi + 0x104]
cmp al, 0x4d
jne 0x40b0d6
push eax
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
mov al, byte [ebp - 0x200]
cmp al, 0x31
jne 0x40b0aa
push 0
push dword [esi + 0x109]
push dword [0x4538b4]
call sub.user32.dll_EnableMenuItem
push 1
push dword [esi + 0x109]
push 0x401
push dword [0x4538b8]
call sub.user32.dll_SendMessageA
jmp 0x40b0d5
push 1
push dword [esi + 0x109]
push dword [0x4538b4]
call sub.user32.dll_EnableMenuItem
push 0
push dword [esi + 0x109]
push 0x401
push dword [0x4538b8]
call sub.user32.dll_SendMessageA
pop eax
add esi, 0x115
or al, al
jne 0x40b055
pop esi
leave
ret
Function at 0x40cbbf
Capabilities:
Read .ini file

Disassembly:
push 0x45cd1a
push dword [ebp - 8]
push dword [ebp - 4]
push 0x44ef8c
push edi
push str.KeyWords
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40cc1a
inc eax
cmp eax, dword [ebp - 8]
jne 0x40cc03
add dword [ebp - 8], 0x2800
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [0x45ee26]
call sub.kernel32.dll_HeapReAlloc
mov dword [ebp - 4], eax
jmp fcn.0040cbbf
push 0x45ee4e
push dword [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [0x45ee26]
call fcn.0040c799
ret
Function at 0x40d70d
Capabilities:
Parse credit card information

Disassembly:
call fcn.00410115
or al, al
je 0x40d944
cmp al, 0xd
je 0x40d944
cmp al, 0x3b
je 0x40d944
cmp al, 0x7b
jne 0x40d731
inc esi
jmp fcn.0040d70d
cmp al, 0x7d
je 0x40d944
cmp al, 0x2e
jne 0x40d73e
inc esi
mov eax, dword [esi]
and eax, 0x5f5f5f5f
cmp eax, 0x53444e45
jne 0x40d770
mov cl, byte [esi + 4]
cmp cl, 0x3b
je 0x40d763
cmp cl, 9
je 0x40d763
cmp cl, 0x20
je 0x40d763
cmp cl, 0xd
jne 0x40d770
add esi, 4
call fcn.0040d6ec
jmp 0x40d944
cmp eax, 0x4f494e55
jne 0x40d7a4
mov cx, word [esi + 4]
and cl, 0x5f
cmp cl, 0x4e
jne 0x40d7a4
cmp ch, 0x3b
je 0x40d797
cmp ch, 9
je 0x40d797
cmp ch, 0x20
je 0x40d797
cmp ch, 0xd
jne 0x40d7a4
add esi, 5
call fcn.0040d6ae
jmp 0x40d944
cmp eax, 0x55525453
jne 0x40d7d8
mov cx, word [esi + 4]
and cl, 0x5f
cmp cl, 0x43
jne 0x40d7d8
cmp ch, 0x3b
je 0x40d7cb
cmp ch, 9
je 0x40d7cb
cmp ch, 0x20
je 0x40d7cb
cmp ch, 0xd
jne 0x40d7d8
add esi, 5
call fcn.0040d6ae
jmp 0x40d944
cmp eax, 0x55525453
jne 0x40d813
mov cx, word [esi + 4]
and cx, 0x5f5f
cmp cx, 0x5443
jne 0x40d813
mov ch, byte [esi + 6]
cmp ch, 0x3b
je 0x40d806
cmp ch, 9
je 0x40d806
cmp ch, 0x20
je 0x40d806
cmp ch, 0xd
jne 0x40d813
add esi, 6
call fcn.0040d6ae
jmp 0x40d944
cmp eax, 0x4d445453
jne 0x40d843
mov ecx, dword [esi + 4]
cmp ecx, 0x4f485445
jne 0x40d843
mov cx, word [esi + 8]
and cl, 0x5f
cmp cl, 0x44
jne 0x40d843
cmp ch, 9
je 0x40d83b
cmp ch, 0x20
jne 0x40d843
add esi, 9
jmp fcn.0040d70d
cmp eax, 0x444e45
je 0x40d944
cmp byte [esi + 2], 0x20
je 0x40d85a
cmp byte [esi + 2], 9
jne 0x40d884
mov ax, word [esi]
and ax, 0x5f5f
cmp ax, 0x4244
je 0x40d87f
cmp ax, 0x5744
je 0x40d87f
cmp ax, 0x4444
je 0x40d87f
cmp ax, 0x5144
je 0x40d87f
cmp ax, 0x5444
jne 0x40d884
jmp 0x40d944
cmp edi, dword [ebp + 8]
je 0x40d88c
mov al, 0x2c
stosb byte es:[edi], al
push esi
lea esi, [ebp - 0x100]
call fcn.00411291
pop esi
call fcn.00411291
mov edx, esi
cmp dword [0x44f399], 8
jne 0x40d8e4
call fcn.00410115
mov eax, dword [esi]
and eax, 0xff5f5f
cmp eax, 0x205341
jne 0x40d8e0
add esi, 3
call fcn.00410115
mov edx, edi
mov al, 0x3a
stosb byte es:[edi], al
call fcn.00411291
mov byte [edi], 0
push edx
inc edx
push edx
call fcn.0040d5dd
pop edx
or eax, eax
jne 0x40d8e0
mov edi, edx
jmp 0x40d944
cmp dword [0x44f399], 3
jne 0x40d913
call fcn.00410115
mov edx, edi
mov al, 0x3a
stosb byte es:[edi], al
call fcn.00411291
mov byte [edi], 0
push edx
inc edx
push edx
call fcn.0040d5dd
pop edx
or eax, eax
jne 0x40d911
mov edi, edx
mov byte [edi], 0
jmp 0x40d944
dec esi
inc esi
mov al, byte [esi]
cmp al, 0xd
je 0x40d944
cmp al, 0x3b
je 0x40d944
or al, al
je 0x40d944
cmp al, 0x3f
je 0x40d935
cmp al, 0x30
jb 0x40d931
cmp al, 0x39
ja 0x40d931
jmp 0x40d935
cmp al, 0x3c
jne 0x40d914
mov al, 0x3a
stosb byte es:[edi], al
mov esi, edx
call fcn.00410115
call fcn.00411291
call fcn.0040d95f
ret
Function at 0x40fe35
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x40fea9
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0xc], eax
inc eax
push eax
push 0x40
call fcn.00401030
mov dword [0x45ff66], eax
push dword [0x45ff66]
call sub.kernel32.dll_GlobalLock
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [0x45ff66]
push dword [ebp - 8]
call sub.kernel32.dll_ReadFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
jmp 0x40feae
mov eax, 0
leave
ret 4

Function at 0x40feb2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push 0xe
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
inc eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
inc eax
push eax
push 0x40
call fcn.00401030
mov dword [0x45ff66], eax
push dword [0x45ff66]
call sub.kernel32.dll_GlobalLock
push dword [0x45ff66]
push dword [ebp - 4]
push 0xd
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
pop eax
leave
ret 4
Function at 0x4111b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push 0
push dword [0x453970]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4538f0]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4538f8]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4538f4]
call sub.user32.dll_ShowWindow
push 0x461d4a
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
mov al, byte [ebp - 0x110]
or al, al
je 0x411278
lea eax, [ebp - 0x110]
push eax
push 0
push 0x143
push dword [0x45ff6e]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x110]
push eax
call fcn.00401168
push eax
push dword [ebp - 0x114]
push 0x151
push dword [0x45ff6e]
call sub.user32.dll_SendMessageA
jmp 0x411204
push 0
push dword [ebp + 8]
push 0x14e
push dword [0x45ff6e]
call sub.user32.dll_SendMessageA
leave
ret 4

Function at 0x41148a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push 0xfffffffffffffff4
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
cmp eax, 0xfde9
jb 0x411576
cmp eax, 0xffdb
ja 0x411576
push 0
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
cmp eax, 0xffdd
jne 0x411576
push 0x100
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x100]
push eax
call fcn.00428ce6
cmp eax, 2
je 0x4114f6
cmp eax, 3
jne 0x411576
push 0x10
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
or eax, eax
jne 0x411509
mov eax, dword [ebp + 8]
neg eax
mov dword [ebp - 0x104], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x411554
push 0xc
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
or eax, eax
je 0x411576
push dword [ebp - 0x104]
call fcn.0040f640
push dword [ebp - 0x104]
lea eax, [ebp - 0x100]
push eax
call fcn.00411446
push 0
push 0xc
push dword [ebp + 8]
call sub.user32.dll_SetWindowLongA
inc dword [0x45ff6a]
jmp 0x411576
cmp dword [ebp + 0xc], 0xfffffffe
jne 0x411568
push 1
push 0xc
push dword [ebp + 8]
call sub.user32.dll_SetWindowLongA
jmp 0x411576
push dword [ebp - 0x104]
push dword [ebp + 0xc]
call fcn.00411348
mov eax, 1
leave
ret 8
Function at 0x41166e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push 1
push dword [0x460006]
push 0x402
push dword [0x453914]
call sub.user32.dll_SendMessageA
cmp dword [0x45c48c], 0
je 0x4118d0
call sub.user32.dll_GetCursor
push eax
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 0
push 0
push 0xb
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x188
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push eax
push 0
push 0
push 0x18e
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push eax
push 0
push 0
push 0x184
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push dword [0x45ff7e]
push 0
push 0x1a0
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x14b
push dword [0x45ff6e]
call sub.user32.dll_SendMessageA
push dword [ebp + 0xc]
call fcn.004111b6
cmp dword [0x460006], 1
jne 0x4117ab
cmp dword [0x4538c8], 0
je 0x411890
push 0x100
lea eax, [ebp - 0x100]
push eax
push dword [0x4538c4]
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x100]
push eax
call fcn.00428ce6
cmp eax, 2
je 0x41177a
cmp eax, 3
jne 0x4117a6
push 0x10
push dword [0x4538c4]
call sub.user32.dll_GetWindowLongA
or eax, eax
jne 0x411792
mov eax, dword [0x4538c4]
neg eax
mov dword [ebp - 0x170], eax
push dword [ebp - 0x170]
push dword [ebp + 8]
call fcn.00411348
jmp 0x411890
cmp dword [0x460006], 2
jne 0x4117cc
push dword [ebp + 0xc]
push fcn.0041148a
push dword [0x4538c0]
call sub.user32.dll_EnumChildWindows
jmp 0x411890
cmp dword [0x460006], 3
jne 0x411874
cmp dword [0x44f32d], 0
je 0x411874
push dword [0x453910]
push 9
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
or eax, eax
je 0x411890
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], 5
lea eax, [ebp - 0x140]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], 0x40
lea eax, [ebp - 0x16c]
push eax
push 0
push 0x110c
push dword [0x453910]
call sub.user32.dll_SendMessageA
cmp dword [ebp - 0x148], 0
je 0x411872
lea eax, [ebp - 0x140]
push eax
call fcn.00428ce6
cmp eax, 2
je 0x411864
cmp eax, 3
jne 0x411872
push dword [ebp - 0x148]
push dword [ebp + 8]
call fcn.00411348
jmp 0x411890
cmp dword [0x460006], 4
jne 0x411890
cmp dword [0x44f32d], 0
je 0x411890
push 0
push dword [ebp + 8]
call fcn.00411348
pop eax
push 0
push eax
push 0x197
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
pop eax
push 0
push eax
push 0x186
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
push 0
push 1
push 0xb
push dword [0x45ff76]
call sub.user32.dll_SendMessageA
pop eax
push eax
call sub.user32.dll_SetCursor
leave
ret 8
Function at 0x411d6e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
cmp dword [0x44f32d], 0
je 0x411df2
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x411dec
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
call fcn.004011b7
push 0x45cb12
push 0x100
lea eax, [ebp - 0x108]
push eax
push 0x44ef8c
lea eax, [ebp - 0x128]
push eax
push str.Find
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x411de9
lea eax, [ebp - 0x108]
push eax
push 0
push 0x143
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
jb 0x411d99
leave
ret 4

Function at 0x411df6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthA
inc eax
mov dword [ebp - 8], eax
cmp eax, 1
jbe 0x411e8e
push 0x100
push 0x45fb1e
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextA
push 0x45fb1e
push 0xffffffffffffffff
push 0x158
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
cmp eax, 0xffffffff
je 0x411e57
push eax
push eax
push 0x144
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0x45fb1e
push 0
push 0x14a
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x14e
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push dword [ebp - 8]
push 0
push 0x142
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
leave
ret 4

Function at 0x412b58
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov dword [ebp - 4], eax
push 0
push 0
push 0xb8
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
or eax, eax
je 0x412c41
push 0xff
push 0x45cf22
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x412c0b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x414b04
lea eax, [ebp - 0x14]
push eax
push 1
push 0x44a
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xb9
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push 1
push 0
push dword [ebp - 4]
call sub.user32.dll_InvalidateRect
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.00404423
xor eax, eax
jmp 0x412c41
push 0x44ece9
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push 0
call sub.user32.dll_MessageBoxA
mov eax, 1
leave
ret 4