joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407400
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ed71
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, edx
xor ebx, ebx
mov dword [ebp + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], 1
cmp eax, ebx
jl 0x4074b0
push eax
call fcn.00407850
test al, al
je 0x4074b0
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x4074b0
cmp word [ecx], bx
je 0x4074b0
cmp dword [esi + 0x28], ebx
jle 0x4074b0
mov eax, dword [esi + 0x24]
cmp eax, ebx
jne 0x407472
mov eax, 0x54ee24
push eax
push ebx
push ecx
push str.SupportFileType
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jbe 0x4074b0
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00407900
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00508010
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x4074b0
push eax
call fcn.0051ebab
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4074d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ed31
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], 1
cmp eax, ebx
jl 0x407588
push eax
mov ecx, str.AdditionalImgApp
call fcn.00407850
test al, al
je 0x407588
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x407588
cmp word [ecx], bx
je 0x407588
cmp dword [esi + 0x28], ebx
jle 0x407588
mov eax, dword [esi + 0x24]
cmp eax, ebx
jne 0x407547
mov eax, 0x54ee24
push eax
push ebx
push ecx
push str.SupportFileType
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jbe 0x407588
push 1
lea eax, [ebp - 0x18]
push eax
mov ebx, esi
call fcn.004079a0
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00508010
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x407588
push eax
call fcn.0051ebab
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407fc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5401b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
mov byte [ebp - 0xd], bl
call fcn.00407850
cmp al, bl
je 0x4080f7
lea ecx, [ebp - 0x34]
push ecx
mov ecx, esi
call fcn.00407900
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jle 0x4080ca
lea edx, [ebp - 0x28]
push edx
mov ecx, esi
call fcn.00407b20
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], ebx
jle 0x408064
mov ecx, esi
call fcn.00407f40
test al, al
je 0x4080ae
sub esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.005072b0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
call fcn.00407d00
cmp dword [ebp - 0x18], ebx
jle 0x40805a
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x1c]
call fcn.00507320
jmp 0x4080ae
push ebx
lea edx, [ebp - 0x1c]
push edx
mov ebx, esi
call fcn.004079a0
cmp dword [ebp - 0x18], 0
jle 0x408091
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x408082
mov eax, 0x54ee24
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408091
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4080ac
push eax
call fcn.0051ebab
add esp, 4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x4080ca
push eax
call fcn.0051ebab
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x4080e1
push eax
call fcn.0051ebab
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408c00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call fcn.00513550
mov ecx, dword [ebp + 0xc]
movzx edx, word [ebp + 0x10]
push ecx
movzx ecx, word [ebp + 8]
shl edx, 0x10
or edx, ecx
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.004089a0
mov byte [esi + 0x4b0], 0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x408c47
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 0xc
mov edx, dword [esi + 0x2c]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x2c], 6
pop ebp
ret 0xc

Function at 0x408c60
Capabilities:
Hide graphical window

Disassembly:
call fcn.00513550
push 0
push 0x17d8
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.004089a0
mov byte [esi + 0x4b0], 0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x408c96
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x2c], 6
ret
Function at 0x40b300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [0x57804a], bl
je 0x40b39d
cmp byte [0x5786b7], bl
je 0x40b39d
cmp byte [0x5786b8], bl
jne 0x40b39d
push 0x578092
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00507d60
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x40b366
mov eax, 0x54ee24
push eax
lea ebx, [edi + 0x1a64]
call fcn.005059c0
lea ecx, [edi + 0x1a90]
call fcn.0051c6a0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00507320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x1a94]
cmp eax, ebx
je 0x40b3c0
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x1a90]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x1a90], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410e40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53648f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov eax, vtable.CMemDc.0
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov byte [esi + 0x5c], bl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], eax
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x90], bl
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov byte [esi + 0x9c], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xac], vtable.CDibInfo.0
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xa0], vtable.CImgBltEx.0
mov dword [esi + 0xe0], 0x55e624
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov byte [esi + 0xec], bl
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov byte [esi + 0xf4], bl
push 0x409530
push 0x43d3e0
push 9
push 0x2ac
lea eax, [esi + 0xf8]
push eax
mov byte [ebp - 4], 6
call fcn.0051f8e5
push 0x42ec30
push 0x42ec10
push 3
push 0x18
lea ecx, [esi + 0x1904]
push ecx
mov byte [ebp - 4], 7
call fcn.0051f880
mov dword [esi + 0x194c], ebx
mov dword [esi + 0x1950], ebx
mov dword [esi + 0x1954], ebx
mov dword [esi + 0x1958], ebx
mov dword [esi + 0x195c], ebx
mov dword [esi + 0x1960], ebx
mov ecx, 0x24
lea eax, [esi + 0x1964]
mov byte [eax], bl
inc eax
dec ecx
jne 0x411002
mov ecx, 0x24
lea eax, [esi + 0x1988]
mov byte [eax], bl
inc eax
dec ecx
jne 0x411013
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4130a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541802
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0x552e9c
mov dword [edi + 0x50], 0x55e624
mov dword [edi + 0x60], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x38], eax
mov byte [edi + 0x40], al
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov byte [edi + 0x5c], al
mov dword [edi + 0x24], vtable.CChildWnd.0
mov dword [edi + 0x68], 0x551a48
mov dword [edi + 0x90], 0x551a50
mov dword [edi + 0xa0], 0x551a58
mov dword [edi + 0x534], eax
lea eax, [edi + 0x64]
call fcn.0043e9b0
lea esi, [edi + 0xfc]
mov dword [edi + 0x64], vtable.CAdvBaseWnd.0
call fcn.004093e0
xor eax, eax
mov dword [edi + 0x518], eax
mov dword [edi + 0x51c], eax
mov dword [edi + 0x520], eax
mov dword [edi + 0x524], eax
mov dword [edi + 0x52c], eax
mov dword [edi + 0x530], eax
mov dword [edi + 0x514], eax
lea eax, [edi + 0x538]
push eax
mov byte [ebp - 4], 2
call fcn.0040a700
mov ecx, 0x24
lea eax, [edi + 0xd3a8]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4131b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418db0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x418dc5
push 3
push eax
call edi
jmp 0x418dd3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0x834]
test eax, eax
je 0x418de4
push 0
push eax
call edi
jmp 0x418df8
mov edx, dword [esi + 0x830]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x830], 6
mov eax, dword [esi + 0xae0]
test eax, eax
je 0x418e09
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0xadc]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xadc], 6
pop edi
ret

Function at 0x418e20
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x418e35
push 9
push eax
call edi
jmp 0x418e43
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0xae0]
test eax, eax
je 0x418e54
push 0
push eax
call edi
jmp 0x418e68
mov edx, dword [esi + 0xadc]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xadc], 6
mov eax, dword [esi + 0x834]
test eax, eax
je 0x418e79
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0x830]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x830], 6
pop edi
ret

Function at 0x419080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea esi, [edi + 0x1fc]
jne 0x4190e3
mov eax, dword [esi + 0x638]
test eax, eax
je 0x4190a8
push 0
push eax
call ebx
jmp 0x4190bc
mov eax, dword [esi + 0x634]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x634], 6
mov eax, dword [esi + 0x8e4]
test eax, eax
je 0x4190cd
push 5
push eax
call ebx
jmp 0x419133
mov edx, dword [esi + 0x8e0]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x8e0], 6
jmp 0x419133
mov eax, dword [esi + 0x8e4]
test eax, eax
je 0x4190f4
push 0
push eax
call ebx
jmp 0x419108
mov ecx, dword [esi + 0x8e0]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x8e0], 6
mov eax, dword [esi + 0x638]
test eax, eax
je 0x419119
push 5
push eax
call ebx
jmp 0x41912d
mov eax, dword [esi + 0x634]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x634], 6
cmp dword [ebp + 0xc], 0
jne 0x41915b
mov ebx, dword [ebp + 8]
lea eax, [edi + 0xb8]
call fcn.0051c750
mov ebx, dword [ebp + 0x10]
mov eax, ebx
call fcn.00419ce0
mov eax, dword [ebp + 0x14]
lea esi, [edi + 0x1028]
call fcn.005041d0
jmp 0x41915e
mov ebx, dword [ebp + 0x10]
mov dx, word [edi + 0x12bc]
sub dx, word [edi + 0x12a0]
mov cx, word [edi + 0x12a4]
add dx, word [ebp + 0x14]
add cx, cx
movzx eax, dx
sub bx, cx
mov ecx, dword [edi + 0x12f4]
movzx edx, bx
shl eax, 0x10
or eax, edx
push eax
mov eax, dword [ebp + 0xc]
push eax
push 5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x41b480
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, eax
call fcn.0041d220
mov edi, eax
test edi, edi
js 0x41b506
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x41b4b9
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x41b4ab
push 0
push ecx
call ebx
jmp 0x41b4b9
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx + 4]
mov dword [eax + edx + 0x2c], 6
mov eax, dword [esi + edi*8 + 0x34]
mov dword [esi + 0x30], eax
mov ecx, dword [esi + edi*8 + 0x38]
push ecx
call fcn.005135d0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x41b4ed
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x41b4df
push 5
push ecx
call ebx
jmp 0x41b4ed
mov edx, dword [eax + 0x2c]
mov ecx, dword [edx + 4]
mov dword [eax + ecx + 0x2c], 6
mov edi, dword [esi + 0x30]
test edi, edi
je 0x41b4f9
call fcn.0041f240
mov esi, dword [esi + 0x30]
test esi, esi
je 0x41b506
push esi
call fcn.0041f930
pop edi
pop esi
pop ebx
ret
Function at 0x41da80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
lea edi, [esi + 0x8c]
push edi
mov ecx, str.BrCcAdvnc.sdd
call fcn.00470370
push str.AdvFuncTabWnd_ClientWnd
lea eax, [esi + 0x9c]
call fcn.005080c0
mov eax, dword [edi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x41dab7
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [edi + 8], ebx
jle 0x41dae5
cmp eax, ebx
je 0x41dae5
cmp word [eax], bx
je 0x41dae5
mov ecx, dword [edi + 4]
cmp ecx, ebx
jne 0x41dad4
mov ecx, 0x54ee24
push ecx
push ebx
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
jne 0x41daf1
mov ecx, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [edi + 8], ebx
jle 0x41db1f
cmp ecx, ebx
je 0x41db1f
cmp word [ecx], bx
je 0x41db1f
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x41db0e
mov eax, 0x54ee24
push eax
push ebx
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
jne 0x41db2b
mov ecx, 0x54ee24
cmp dword [edi + 8], ebx
jle 0x41db56
test ecx, ecx
je 0x41db56
cmp word [ecx], bx
je 0x41db56
mov eax, dword [edi + 4]
test eax, eax
jne 0x41db45
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
jne 0x41db62
mov ecx, 0x54ee24
xor eax, eax
cmp dword [edi + 8], eax
jle 0x41db8d
test ecx, ecx
je 0x41db8d
cmp word [ecx], ax
je 0x41db8d
mov eax, dword [edi + 4]
test eax, eax
jne 0x41db7e
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
push ecx
mov ecx, dword [ebp - 8]
push edx
push eax
mov eax, dword [ebp - 4]
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push 0
push 0x40000000
push 0
mov eax, str.ControlCenter4_AdvTabPageWndCls
mov edx, esi
call fcn.0051bcc0
mov ebx, dword [ebp + 0xc]
mov edi, eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], 1
test edi, edi
je 0x41dc11
mov edx, dword [ebp + 8]
push edx
push esi
call fcn.00421d00
cmp dword [esi + 0x32694], 0
mov dword [esi + 0x214], ebx
jle 0x41dbf6
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x334], ebx
mov dword [esi + 0x3c4], ebx
mov eax, dword [ebp + 8]
push ebx
push edi
push eax
push esi
call fcn.00421e70
push esi
call fcn.0041f930
mov cl, byte [ebp + 0x14]
mov byte [esi + 0x33ba0], cl
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
je 0x41f216
mov ecx, dword [ebp + 8]
cmp ecx, edi
jl 0x41f216
mov eax, dword [esi + 0x32690]
cmp ecx, eax
jg 0x41f216
mov byte [ebp - 1], 0
mov dword [ebp - 8], edi
cmp eax, edi
jle 0x41f216
jmp 0x41f0c3
mov ecx, dword [ebp + 8]
cmp edi, 5
ja case.default.0x41f0c8
jmp dword [edi*4 + 0x41f220]
mov al, byte [ebx]
mov byte [ebp - 1], al
jmp case.default.0x41f0c8
mov dl, byte [ebx + 1]
jmp 0x41f0f3
mov al, byte [ebx + 2]
mov byte [ebp - 1], al
jmp case.default.0x41f0c8
mov dl, byte [ebx + 3]
jmp 0x41f0f3
mov al, byte [ebx + 4]
mov byte [ebp - 1], al
jmp case.default.0x41f0c8
mov dl, byte [ebx + 5]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x41f1b1
mov eax, dword [esi + ecx*4 + 0x33b48]
imul eax, dword [ebp - 8]
mov edx, dword [esi + 0x33b7c]
add eax, dword [esi + ecx*4 + 0x33b60]
lea ebx, [edi + 0x12e]
imul ebx, ebx, 0x2ac
push 0
push edx
add ebx, esi
push eax
mov ecx, ebx
call fcn.0051c380
mov edx, dword [esi + 0x33b98]
mov eax, dword [ebp + 8]
push 0
push edx
mov edx, dword [esi + eax*4 + 0x33b48]
imul edx, dword [ebp - 8]
add edx, dword [esi + eax*4 + 0x33b7c]
lea ecx, [edi + edi*8 + 0x336f]
shl ecx, 4
add ecx, esi
push edx
mov dword [ebp - 0xc], ecx
call fcn.0051c380
mov eax, dword [ebx + 4]
test eax, eax
je 0x41f176
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f182
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
test eax, eax
je 0x41f19d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
jmp 0x41f209
mov edx, dword [ecx]
mov eax, dword [edx + 4]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax], 6
jmp 0x41f209
lea eax, [edi + 0x12e]
imul eax, eax, 0x2ac
mov ecx, dword [eax + esi + 4]
add eax, esi
test ecx, ecx
je 0x41f1d2
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f1de
mov edx, dword [eax]
mov ecx, dword [edx + 4]
mov dword [eax + ecx], 6
lea eax, [edi + edi*8 + 0x336f]
shl eax, 4
mov ecx, dword [eax + esi + 4]
add eax, esi
test ecx, ecx
je 0x41f1fd
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f209
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [eax + edx], 6
inc edi
cmp edi, dword [esi + 0x32690]
jl 0x41f0c0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42cfc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539968
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x74]
push esi
or edi, 0xffffffff
call fcn.00440a90
test al, al
je 0x42d01f
xor eax, eax
cmp dword [esi + 0x68], eax
jle 0x42d01d
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x42d00a
mov eax, 0x54ee24
push eax
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov dword [ebx], edi
call fcn.004407d0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00508010
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42d054
push eax
call fcn.0051ebab
add esp, 4
cmp dword [ebx], 0
jl 0x42d074
cmp dword [esi + 4], 0
jle 0x42d074
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4