joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4847c0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp + 8]
call fcn.00487d60
lea ecx, [ebp + 0xc]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4847fb
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 0xc]
call fcn.0041d100
mov eax, dword [ebp - 0x10]
jmp 0x4848d9
mov dword [ebp - 8], 0x100000
push 0x557078
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004fa06b
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x484849
mov dword [ebp - 0x18], 0
lea ecx, [ebp + 0xc]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
jmp 0x4848d9
mov ecx, dword [ebp - 8]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp + 0xc]
call fcn.0041d2b0
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
sub edx, 2
cmp dword [ebp - 4], edx
je 0x4848a9
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.00484720
push eax
mov ecx, dword [ebp + 8]
call fcn.00487ae0
lea ecx, [ebp - 0x30]
call fcn.00487ac0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004f755c
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.00487cc0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp + 0xc]
call fcn.0041d100
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret 8
Function at 0x489fc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536d80
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536d84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48a13a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48a0dc
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48a0b8
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x1c
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48a06c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x1c
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536d94
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48a01e
mov ecx, dword [ebp - 0x824]
add ecx, 0x1c
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48a180
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536d9c
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536da0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48a2f4
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48a299
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48a275
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48a22c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536db4
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48a1de
mov ecx, dword [ebp - 0x824]
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48a340
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536dbc
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536dc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48a4ba
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48a45c
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48a438
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48a3ec
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536dc8
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48a39e
mov ecx, dword [ebp - 0x824]
add ecx, 0x38
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48a500
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536dd0
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536dd4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48a67a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48a61c
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48a5f8
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48a5ac
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536de4
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48a55e
mov ecx, dword [ebp - 0x824]
add ecx, 0x54
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48a960
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536df0
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536df4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48aae0
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48aa7f
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48aa5b
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48aa0c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536e08
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48a9be
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48ab30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536e10
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536e14
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48acaa
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48ac4c
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48ac28
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48abdc
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536e28
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48ab8e
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48acf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536e30
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536e34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48ae70
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48ae0f
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48adeb
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48ad9c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536e48
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48ad4e
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48b353
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
jne 0x48b339
lea ecx, [ebp + 0x20]
call fcn.0041d100
jmp 0x48b4bf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
ja case.default.0x48b34c
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x48b4c4]
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xf020
push 0x112
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
push 0
push 0
push 0x12
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], 0
je 0x48b3e7
lea ecx, [ebp - 8]
call fcn.0049d080
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.0049d700
lea ecx, [ebp - 8]
call fcn.0049d0a0
jmp case.default.0x48b34c
push ecx
mov ecx, esp
lea edx, [ebp + 0x20]
push edx
call fcn.0041d0a0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0xc], edx
call fcn.0048d800
add esp, 0x14
jmp case.default.0x48b34c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0048d9b0
add esp, 8
push 0
push 0
push 0
mov edx, dword [ebp - 0x10]
imul edx, edx, 0xfffffffd
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp case.default.0x48b34c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048da70
add esp, 4
jmp case.default.0x48b34c
lea edx, [ebp - 0x14]
push edx
push 0x53cc08
push 1
push 0
push 0x53d288
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl case.default.0x48b34c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp + 0x20]
call fcn.0041d100
mov esp, ebp
pop ebp
ret
Function at 0x48b374
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
jne 0x48b339
lea ecx, [ebp + 0x20]
call fcn.0041d100
jmp 0x48b4bf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
ja case.default.0x48b34c
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x48b4c4]
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xf020
push 0x112
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
push 0
push 0
push 0x12
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x48b34c
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], 0
je 0x48b3e7
lea ecx, [ebp - 8]
call fcn.0049d080
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.0049d700
lea ecx, [ebp - 8]
call fcn.0049d0a0
jmp case.default.0x48b34c
push ecx
mov ecx, esp
lea edx, [ebp + 0x20]
push edx
call fcn.0041d0a0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0xc], edx
call fcn.0048d800
add esp, 0x14
jmp case.default.0x48b34c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0048d9b0
add esp, 8
push 0
push 0
push 0
mov edx, dword [ebp - 0x10]
imul edx, edx, 0xfffffffd
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp case.default.0x48b34c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048da70
add esp, 4
jmp case.default.0x48b34c
lea edx, [ebp - 0x14]
push edx
push 0x53cc08
push 1
push 0
push 0x53d288
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl case.default.0x48b34c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp + 0x20]
call fcn.0041d100
mov esp, ebp
pop ebp
ret
Function at 0x48b4f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536f34
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536f38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48b670
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48b60f
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48b5eb
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48b59c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536f48
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48b54e
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret