joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471aa8
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x52ecd8
push 0x52ffb0
push 0x3e7
push 0x55296a
lea eax, [ebx + 0xf]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [ebx + 0x13]
push ecx
push 0x55296a
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x471aec
mov dword [0x52ec24], 1
jmp 0x471af3
xor eax, eax
mov dword [0x52ec24], eax
push 0x52ffb0
push 0x64
push 0x52ec32
lea edx, [ebx + 0x27]
push edx
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebx + 0x18]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x52ec32], 0
je 0x471b2f
push 0x20
push 0x52ec32
call fcn.0051833c
add esp, 8
test eax, eax
je 0x471b2f
mov byte [eax], 0
cmp byte [0x52ec32], 0
jne 0x471b40
xor edx, edx
mov dword [0x52ec24], edx
push 0x52ffb0
push 0x32
push 0x52ec96
lea ecx, [ebx + 0x3a]
push ecx
lea eax, [ebx + 0x32]
push eax
lea edx, [ebx + 0x2b]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x3e7
push 0x55296a
lea ecx, [ebx + 0x4d]
push ecx
lea eax, [ebx + 0x47]
push eax
lea edx, [ebx + 0x40]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x55296a], 0
je 0x471b99
push 0x55296a
call fcn.0052175c
pop ecx
mov word [0x52ec30], ax
jmp 0x471ba2
mov word [0x52ec30], 0x71
cmp word [0x52ec30], 0
ja 0x471bb5
mov word [0x52ec30], 0x71
pop ebx
ret

Function at 0x471ce6
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov esi, 0x52ecd0
cmp dword [esi], 0xffffffff
jne 0x471d61
mov dword [0x52ecd4], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x471d1a
push 0
call fcn.00471c66
pop esi
pop ebx
ret
mov ax, word [0x52ec30]
push eax
push dword [esi]
call fcn.004cb3a4
test eax, eax
jne 0x471d36
push 0
call fcn.00471c66
pop esi
pop ebx
ret
push 5
push dword [esi]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x471d4d
push 0
call fcn.00471c66
pop esi
pop ebx
ret
push 8
push 0x42a
push dword [0x537420]
push dword [esi]
call sub.WSOCK32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x471eae
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x471fdf
cmp eax, 0x20
je 0x471fdf
mov eax, dword [0x52ecd4]
cmp eax, 0xffffffff
je 0x471fdf
push 0
push 0x32
push 0x5517d4
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x471fdf
cmp eax, 1
jle 0x471fdf
cmp eax, 0x19
jg 0x471fdf
mov byte [eax + 0x5517d4], 0
push 0x2c
push 0x5517d4
call fcn.0051833c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x471fdf
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x471fdf
push 0x5517d4
call fcn.0052175c
pop ecx
mov esi, eax
push ebx
call fcn.0052175c
pop ecx
mov ebx, eax
cmp dword [0x52ec28], 0
je 0x471fa0
push 0x52ec32
push 0x52ec96
push ebx
push esi
push 0
push 0xc1f
call fcn.00415c87
push eax
push 0x5535b5
call sub.USER32.dll_wsprintfA
add esp, 0x18
push dword [0x52a390]
push 0x5535b5
push dword [0x537430]
call fcn.004c7cd0
push dword [0x52a380]
push dword [0x537430]
call fcn.004c7b7f
push 0x52ec32
push 0x52ec96
push ebx
push esi
push str._d___d_:_USERID_:__s_:__s_r_n
push 0x5517d4
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0x22
push 0x42c
push dword [0x537420]
push dword [0x52ecd4]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0
call fcn.00472007
jmp 0x472001
cmp dword [0x52b4d0], 0
je 0x471ffa
cmp dword [0x52ec2c], 0
je 0x471ffa
push 0
call fcn.00471c66
jmp 0x472001
push 1
call fcn.00471c66
pop esi
pop ebx
pop ebp
ret 4
Function at 0x473e7f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, 0x5519d8
cmp dword [ebp + 0x20], 0
jne 0x473ea2
mov dword [0x5519cc], 1
jmp 0x473f10
cmp dword [edi + 4], 0
jne 0x473ec3
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call fcn.004bf5f3
jmp 0x4740aa
cmp dword [edi + 0x30], 0
jne 0x473ed3
mov eax, 2
jmp 0x4740aa
mov edx, dword [edi + 0x30]
cmp dword [edx + 0x18], 1
je 0x473ee6
mov eax, 1
jmp 0x4740aa
mov edx, dword [edi + 0x30]
cmp dword [edx + 8], 0
jne 0x474088
mov ecx, dword [edi + 0x30]
push dword [ecx]
call fcn.0052175c
pop ecx
mov dword [0x5519cc], eax
cmp dword [0x5519cc], 0
jl 0x474088
push dword [0x537420]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x474088
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x5519c8], eax
cmp dword [0x5519c8], 0
je 0x474083
push dword [0x5519c8]
call sub.KERNEL32.dll_GlobalLock
mov dword [0x5519dc], eax
cmp dword [0x5519dc], 0
je 0x474083
mov byte [esi], 0
push dword [0x5519dc]
call fcn.005183dc
pop ecx
mov dword [0x5519d4], eax
xor eax, eax
mov dword [0x5519d0], eax
push 0xa
push dword [0x5519dc]
call fcn.0051833c
add esp, 8
mov dword [ebx], eax
inc dword [0x5519d0]
mov edx, dword [0x5519d0]
cmp edx, dword [0x5519cc]
jne 0x473fe1
cmp dword [ebx], 0
je 0x473fa4
mov ecx, dword [ebx]
mov byte [ecx], 0
push 0x3b5
push dword [0x5519dc]
push esi
call fcn.005185e8
add esp, 0xc
mov byte [esi + 0x3b5], 0
mov eax, dword [ebx]
test eax, eax
je 0x473fc8
mov byte [eax], 0xa
push 0xd
push esi
call fcn.0051833c
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x474002
mov edx, dword [ebx]
mov byte [edx], 0
jmp 0x474002
cmp dword [ebx], 0
je 0x474002
inc dword [ebx]
mov ecx, dword [ebx]
cmp byte [ecx], 0xd
jne 0x473ff1
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0
je 0x474002
mov dword [0x5519dc], eax
jmp 0x473f74
cmp dword [0x5519cc], 0
jne 0x47401f
push dword [0x5519d0]
push 0x52eecc
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [edi + 0xc], 0
je 0x474078
push 0x2e
push dword [edi]
call fcn.005186c4
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x474078
push str..len
push dword [ebx]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x474075
cmp dword [0x5519cc], 0
je 0x47405f
push esi
call fcn.005183dc
pop ecx
mov dword [0x5519d4], eax
push dword [0x5519d4]
push 0x52eed6
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x474078
mov byte [esi], 0
push dword [0x5519c8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp + 0x20], 1
jne 0x4740a5
push dword [edi + 0x30]
mov edx, dword [ebp + 0xc]
push dword [edx]
call fcn.0049dd87
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
mov dword [edi + 4], eax
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x476625
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, 0x551be4
cmp dword [esi + 4], 0
jne 0x476654
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [edi]
push dword [ebp + 8]
call fcn.004bf5f3
jmp 0x47678d
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x476665
mov eax, 2
jmp 0x47678d
cmp dword [eax + 0x18], 1
jne 0x476788
cmp dword [eax + 8], 0
jne 0x476770
xor edx, edx
mov dword [0x551be0], edx
mov edx, dword [eax]
cmp byte [edx], 0x3d
jne 0x47673a
mov eax, edx
inc eax
mov dword [0x551be8], eax
cmp byte [eax], 0
je 0x476749
xor ecx, ecx
mov dword [ebx], ecx
push dword [0x529f1c]
call fcn.0041f683
test eax, eax
je 0x4766e5
mov eax, dword [0x529f1c]
cmp dword [eax + 0x51c], 0
je 0x4766e5
push dword [0x551be8]
mov edx, dword [0x529f1c]
add edx, 0x3f0
push edx
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4766e5
mov ecx, dword [0x529f1c]
mov dword [ebx], ecx
cmp dword [ebx], 0
jne 0x476725
mov eax, dword [0x529f18]
mov dword [ebx], eax
jmp 0x476720
mov eax, dword [ebx]
cmp dword [eax + 0x51c], 3
jne 0x476716
push dword [0x551be8]
add eax, 0x3f0
push eax
call fcn.005185a0
add esp, 8
test eax, eax
je 0x476725
mov edx, dword [ebx]
mov ecx, dword [edx + 0x87c]
mov dword [ebx], ecx
cmp dword [ebx], 0
jne 0x4766f3
cmp dword [ebx], 0
je 0x476749
mov eax, dword [ebx]
push dword [eax]
call fcn.004f9c59
mov dword [0x551be0], eax
jmp 0x476749
mov edx, dword [esi + 0x30]
push dword [edx]
call fcn.004f9bfc
mov dword [0x551be0], eax
mov eax, dword [0x551be0]
test eax, eax
je 0x476770
cmp dword [eax + 0x744], 0
je 0x476770
push dword [ebp + 0x14]
push 0x1f4
push 0xd
push dword [eax + 0x744]
call sub.USER32.dll_SendMessageA
push dword [esi + 0x30]
push dword [edi]
call fcn.0049dd87
mov dword [edi], eax
xor edx, edx
mov dword [esi + 4], edx
mov eax, 2
jmp 0x47678d
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x486e3a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, 0x552583
push dword [ebp + 0x10]
call fcn.0049dfbe
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push 0x5300f8
push 0x55296a
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebp + 0x14]
push 0x3e7
push edi
push 0x5300fe
push 0x55296a
push dword [ebp + 8]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x486f6a
cmp esi, 1
jne 0x486f16
push 0x530102
push edi
call fcn.005186f0
add esp, 8
test eax, eax
jne 0x486f50
push esi
push edi
mov esi, 0x55296a
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x3a
push 0x55296a
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x486eec
inc ebx
jmp 0x486e58
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x486efb
inc ebx
jmp 0x486e58
push eax
push 0x55296a
push 0x55296a
push str._sSERVER:_s:_s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x486f50
cmp esi, 2
jne 0x486f33
push 0x53011a
push edi
call fcn.005186f0
add esp, 8
test eax, eax
jne 0x486f50
inc ebx
jmp 0x486e58
cmp esi, 3
jne 0x486f50
push 0x53011f
push edi
call fcn.005186f0
add esp, 8
test eax, eax
jne 0x486f50
inc ebx
jmp 0x486e58
push 0
push 0
push edi
push dword [ebp - 4]
call fcn.0049d9f0
test eax, eax
je 0x486f64
mov dword [ebp - 4], eax
inc ebx
jmp 0x486e58
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x4884cf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
jne 0x48855c
test edi, edi
jne 0x488537
push 0x52ffb0
push 0x3dd
push 0x552583
push 0x530248
push 0
push dword [ebp + 0x10]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x552583], 0
je 0x488537
mov esi, ebx
mov edi, 0x52ffb0
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x488644
push esi
push edi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.00416498
push 0x54bcbb
push 0x54bbbb
push 0x54babb
push 0x54bab8
push ebx
call fcn.0051d600
add esp, 0x14
cmp byte [0x54bab8], 0
jne 0x488591
cmp byte [0x54babb], 0
je 0x4885a1
push 1
push ebx
call fcn.00416273
test eax, eax
jne 0x488644
push 0x54bcbb
push 0x54bbbb
push 0x52feac
push 0x53024c
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 1
push ebx
call fcn.00416273
test eax, eax
jne 0x488644
test edi, edi
jne 0x48861b
push 0x52ffb0
push 0x3dd
push 0x552583
push 0x530254
push 0
push dword [ebp + 0x10]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x552583], 0
je 0x48861b
mov esi, ebx
mov edi, 0x52ffb0
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x488644
push esi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push ebx
call fcn.00416498
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x489d25
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffa8
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push 0x530c29
push 0
call fcn.004c748b
cmp dword [0x536ca8], 0
je 0x489d83
push dword [0x537420]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x489d83
mov dword [esp + 0x10], 3
jmp 0x489dbb
push dword [0x537420]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x489d9c
mov dword [esp + 0x10], 1
jmp 0x489dbb
push dword [0x537420]
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x489db5
mov dword [esp + 0x10], 2
jmp 0x489dbb
xor ecx, ecx
mov dword [esp + 0x10], ecx
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x489de2
cmp dword [0x536ca4], 0
je 0x489dda
mov dword [esp + 0x10], 3
jmp 0x489de2
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
jne 0x489e1e
lea eax, [esp + 0x48]
push eax
push dword [0x537420]
call sub.USER32.dll_GetWindowRect
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp + 0x50]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x54]
sub edx, eax
mov dword [esp + 0xc], edx
jmp 0x489e59
mov dword [esp + 0x1c], 0x2c
lea ecx, [esp + 0x1c]
push ecx
push dword [0x537420]
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov edx, dword [esp + 0x40]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x44]
sub edx, eax
mov dword [esp + 0xc], edx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x18]
push 0x530c2f
push 0x55296a
call sub.USER32.dll_wsprintfA
add esp, 0x24
push 0x52ffb0
push 0x55296a
push 0x530c4e
push 0x530c45
call fcn.00486c04
add esp, 0x58
ret
Function at 0x49d16c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [0x532a54], 0
je 0x49d195
lea eax, [ebp - 4]
push eax
push 0x53203c
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
jmp 0x49d1aa
lea eax, [ebp - 4]
push eax
push 0x53204b
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
je 0x49d1b2
xor eax, eax
jmp 0x49d1e0
push esi
call fcn.005183dc
pop ecx
inc eax
push eax
push esi
push 1
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49d1db
xor eax, eax
jmp 0x49d1e0
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x49d1e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [esi], 0
cmp dword [0x532a54], 0
je 0x49d215
lea eax, [ebp - 8]
push eax
push 0x532051
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x49d22a
lea eax, [ebp - 8]
push eax
push 0x532060
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x49d232
xor eax, eax
jmp 0x49d260
mov dword [ebp - 4], 0x3e7
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49d25b
xor eax, eax
jmp 0x49d260
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x49d268
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
cmp dword [0x532a54], 0
je 0x49d28d
lea eax, [ebp - 4]
push eax
push str.SoftwaremIRC
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x49d2a2
lea eax, [ebp - 4]
push eax
push 0x532075
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x49d2aa
xor eax, eax
jmp 0x49d2cc
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteKeyA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x49d2c7
xor eax, eax
jmp 0x49d2cc
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x49fac4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x532349
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x49faf1
mov esi, 0x532358
mov edi, 0x5535b5
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49fb4e
push 0x532360
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x49fb14
mov esi, str.messages
mov edi, 0x5535b5
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x49fb4e
push 0x20
push esi
call fcn.0051833c
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x49fb29
mov ebx, esi
jmp 0x49fb2a
inc ebx
mov esi, 0x5535b5
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0xc], 0
jne 0x49fb5b
mov eax, 0x5535b5
jmp 0x49fbbd
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x532383
push 0x5535b5
push 0x53237a
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, 0x555704
jmp 0x49fb86
inc ebx
cmp byte [ebx], 0x20
je 0x49fb85
cmp byte [ebx], 0
jne 0x49fb94
xor eax, eax
jmp 0x49fbbd
mov esi, 0x5535b5
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x5535b5
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4a3e97
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, 0x55296a
mov ebp, 0x532624
cmp byte [0x529a14], 0
jne 0x4a3ebe
push edi
lea esi, [ebp + 0x11d]
mov edi, 0x529a14
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
push edi
lea esi, [ebp + 0x122]
mov edi, 0x529a14
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
call fcn.004a56ad
call sub.USER32.dll_CreatePopupMenu
mov ebx, eax
mov dword [0x532530], ebx
test ebx, ebx
je 0x4a3fd3
xor esi, esi
push esi
lea eax, [ebp + 0x127]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push 0x3e7
push 0x552583
lea edx, [ebp + 0x138]
push edx
push edi
lea ecx, [ebp + 0x12c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x552583], 0
je 0x4a3fc3
xor ebx, ebx
push edi
push 4
push 0x552583
call fcn.0041bdc6
push 2
call fcn.0043d398
test eax, eax
je 0x4a3f89
lea eax, [ebp + 0x13c]
push eax
push 0x529a14
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4a3f64
mov ebx, 1
jmp 0x4a3f8e
push 0x529a14
push edi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4a3f7d
mov ebx, 1
jmp 0x4a3f8e
cmp byte [edi], 0
jne 0x4a3f8e
mov ebx, 1
jmp 0x4a3f8e
mov ebx, 1
test ebx, ebx
je 0x4a3fb9
push edi
push 1
push 0x552583
call fcn.0041bdc6
cmp byte [edi], 0
je 0x4a3fb9
push edi
lea eax, [esi + 0x514]
push eax
push 0
push dword [0x532530]
call sub.USER32.dll_AppendMenuA
inc esi
cmp esi, 0x14
jl 0x4a3eea
test esi, esi
jne 0x4a3fd3
call fcn.004a56ad
push 0
call fcn.00415bea
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a497d
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x532528
call fcn.004a56ad
push 2
push dword [ebp]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x4a49b4
cmp dword [0x536414], 0
je 0x4a49db
push 0x400
push 2
push dword [ebp]
call sub.USER32.dll_DeleteMenu
jmp 0x4a49db
cmp dword [0x536414], 0
jne 0x4a49db
push 0
push 0xefc
call fcn.00415c87
push eax
push 0x7c
push 0x400
push 2
push dword [ebp]
call sub.USER32.dll_InsertMenuA
push 3
push dword [ebp]
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
jne 0x4a49f7
push 4
push dword [ebp]
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
je 0x4a4a7f
push 3
push ebx
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7f
jne 0x4a4a31
cmp dword [0x536414], 0
je 0x4a4a6a
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
jmp 0x4a4a6a
cmp dword [0x536414], 0
jne 0x4a4a6a
push 0x5327cb
push 0
push 0x800
push 2
push ebx
call sub.USER32.dll_InsertMenuA
push 0
push 0xefc
call fcn.00415c87
push eax
push 0x7f
push 0x400
push 3
push ebx
call sub.USER32.dll_InsertMenuA
cmp dword [0x532a38], 0
je 0x4a4a7f
push 8
push 0x7f
push dword [ebp]
call sub.USER32.dll_CheckMenuItem
push dword [ebp]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x4a4aaf
push ebx
push dword [ebp]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7d
je 0x4a4aaf
push 0x400
push ebx
push dword [ebp]
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x4a4a8e
cmp dword [0x537418], 0
je 0x4a4b59
push 0x5327cf
push 0
push 0x800
push dword [ebp]
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x320
mov esi, dword [0x537418]
test esi, esi
je 0x4a4b59
push 0x3c
push 0x555704
push dword [esi]
call sub.USER32.dll_GetWindowTextA
push 0x555704
call fcn.005183dc
pop ecx
cmp eax, 0x32
jbe 0x4a4b13
push esi
push edi
mov esi, 0x5327d3
mov edi, 0x555736
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x555704
push ebx
push 0x5327d8
push 0x555aeb
call sub.USER32.dll_wsprintfA
add esp, 0x10
inc ebx
mov edx, dword [0x53742c]
cmp edx, dword [esi]
jne 0x4a4b3d
mov eax, 8
jmp 0x4a4b3f
xor eax, eax
push 0x555aeb
push edi
push eax
push dword [ebp]
call sub.USER32.dll_AppendMenuA
inc edi
mov esi, dword [esi + 0x9a8]
test esi, esi
jne 0x4a4ae4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a4b5e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov edx, dword [ebp + 8]
cmp edx, 0x320
jl 0x4a4c33
cmp edx, 0x352
jg 0x4a4c33
mov eax, 0x320
mov ebx, dword [0x537418]
test ebx, ebx
je 0x4a4c33
cmp edx, eax
jne 0x4a4c24
push 4
push dword [ebx]
call sub.USER32.dll_ShowWindow
push dword [ebx]
call sub.USER32.dll_BringWindowToTop
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_SetForegroundWindow
push dword [ebx]
call sub.USER32.dll_SetFocus
cmp dword [0x532a38], 0
je 0x4a4be1
push 0
push 0x7c
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
cmp dword [0x532a30], 0
je 0x4a4c00
push 0
push 0x7a
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x4a4c1d
cmp dword [0x532a34], 0
je 0x4a4c1d
push 0
push 0x7b
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x4a4c35
inc eax
mov ebx, dword [ebx + 0x9a8]
test ebx, ebx
jne 0x4a4b90
xor eax, eax
pop ebx
pop ebp
ret 4