joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5410
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
push edi
mov edi, 0x60
call fcn.004c5c70
cmp eax, 8
jl 0x4c54b3
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 8]
push ecx
call fcn.004d6713
add esp, 4
cmp word [esp + eax*2 + 6], 0x5c
je 0x4c5462
lea edx, [esp + 8]
push 0x598458
push edx
call fcn.004d62f1
add esp, 8
lea eax, [esp + 8]
push str.User32.dll
push eax
call fcn.004d62f1
add esp, 8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4c54a8
push str.GetDpiForWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c54a1
mov edx, dword [esp + 0x41c]
push edx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x410
ret
mov eax, dword [esp + 0x41c]
push eax
call fcn.004c5370
add esp, 4
pop edi
pop esi
add esp, 0x410
ret

Function at 0x4c56d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x288
lea eax, [esp + 0x80]
push eax
call fcn.004c56b0
mov eax, dword [esp + 0x294]
add esp, 4
lea ecx, [esp + 0x80]
lea edx, [esp]
push ecx
mov ecx, dword [esp + 0x290]
push 0x40
push edx
push 0x5aae60
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp]
push edx
call fcn.004d6713
add esp, 4
test eax, eax
jbe 0x4c5735
lea eax, [esp]
push eax
call fcn.004d6be0
add esp, 4
add esp, 0x288
ret
mov eax, 0xfffffc19
add esp, 0x288
ret

Function at 0x4c5850
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push eax
call fcn.004c56b0
mov edx, dword [esp + 0x220]
mov esi, dword [esp + 0x21c]
mov eax, dword [esp + 0x218]
add esp, 4
lea ecx, [esp + 4]
mov word [esi], 0
push ecx
mov ecx, dword [esp + 0x214]
push edx
push esi
push 0x5aae60
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call fcn.004d6713
xor edx, edx
add esp, 4
cmp edx, eax
sbb eax, eax
pop esi
neg eax
add esp, 0x208
ret

Function at 0x4c5ae0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.004d6713
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov edi, eax
call fcn.004d6713
mov ecx, eax
add esp, 4
add ecx, ecx
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4c5b43
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4c6df0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
push ebx
push ebp
mov ebp, dword [esp + 0x42c]
push esi
mov esi, dword [esp + 0x434]
push edi
push esi
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
call fcn.004c5c70
cmp eax, 8
jl 0x4c6ee0
lea eax, [esp + 0x20]
push 0x104
push eax
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x20]
push ecx
call fcn.004d6713
add esp, 4
cmp word [esp + eax*2 + 0x1e], 0x5c
je 0x4c6e6a
lea edx, [esp + 0x20]
push 0x598458
push edx
call fcn.004d62f1
add esp, 8
lea eax, [esp + 0x20]
push str.Dwmapi.dll
push eax
call fcn.004d62f1
add esp, 8
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4c6ee0
push str.DwmGetWindowAttribute
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c6eab
lea edx, [esp + 0x10]
push 0x10
push edx
push 9
push ebp
call eax
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jl 0x4c6ee0
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x10]
mov edi, ecx
sub edi, eax
cmp edx, edi
je 0x4c6ee0
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xc], ecx
mov eax, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x4c6f0a
mov edx, dword [esp]
mov ecx, dword [esp + 4]
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
add esp, 0x420
ret

Function at 0x4c7910
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push esi
je 0x4c796c
cmp word [eax], 0
je 0x4c796c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c796c
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x10]
push esi
mov dword [esp + 0x10], eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov edx, ebx
pop edi
pop ebx
pop esi
add esp, 8
ret
xor eax, eax
xor edx, edx
pop esi
add esp, 8
ret

Function at 0x4c7a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c7a73
xor eax, eax
ret
and eax, 0xff
shr eax, 4
and eax, 1
ret
Function at 0x4c8880
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 4]
push 0x10
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2e
lea edx, [esp + 4]
push 0x2c
push edx
call fcn.004c8760
lea eax, [esp + 0xc]
push eax
call fcn.004c5910
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
add esp, 0x30
ret

Function at 0x4c8a30
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [0x5b5574]
sub esp, 0x100
lea eax, [esp]
push 0x80
push eax
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp]
push str.__U__m__d__Y__
push edx
call fcn.004d62f1
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x10c]
add esp, 8
test eax, eax
je 0x4c8aa0
mov eax, dword [esp + 0x108]
push 0x5b9260
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.PasteName
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x100
ret
lea eax, [esp]
push eax
push ecx
call fcn.004d631b
add esp, 8
add esp, 0x100
ret
Function at 0x4c8fb0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x258
push ebx
mov ebx, dword [esp + 0x260]
push esi
xor esi, esi
test eax, eax
jne 0x4c9077
mov eax, dword [esp + 0x274]
test eax, eax
je 0x4c8fec
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 8]
jmp 0x4c9092
push ebx
call fcn.004d6713
add esp, 4
test eax, eax
je 0x4c91e6
xor ecx, ecx
push ebx
mov dword [esp + 0xc], ecx
mov esi, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call fcn.004d6713
add esp, 4
cmp eax, 0xa
jne 0x4c9045
lea edx, [esp + 0xe]
lea eax, [esp + 0xa]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
push str._d:_d:_d
push ebx
call fcn.004d6c09
mov edx, dword [esp + 0x1c]
add esp, 0x14
jmp 0x4c9092
lea edx, [esp + 0x14]
lea eax, [esp + 0x12]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x16]
push ecx
lea eax, [esp + 0x16]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push str._d:_d:_d__d:_d:_d
push ebx
call fcn.004d6c09
mov edx, dword [esp + 0x28]
add esp, 0x20
jmp 0x4c9092
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xe]
and edx, 0xffff
and ecx, 0xffff
sub edx, 0x76c
mov dword [esp + 0x34], edx
xor edx, edx
lea eax, [ecx - 1]
test eax, eax
setle dl
dec edx
and edx, eax
mov eax, dword [esp + 0x12]
cmp ax, 1
mov dword [esp + 0x30], edx
jbe 0x4c90e0
and eax, 0xffff
mov dword [esp + 0x2c], eax
jmp 0x4c90e8
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
and eax, 0xffff
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x16]
and eax, 0xffff
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
and eax, 0xffff
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
and eax, 0xffff
test esi, esi
mov dword [esp + 0x38], eax
je 0x4c9135
lea ecx, [esp + 0x20]
push ecx
call fcn.004d8ff9
add esp, 4
lea edx, [esp + 0x64]
push 0xff
push edx
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4c9162
lea eax, [esp + 0x64]
push eax
push 5
call fcn.004d8f49
add esp, 8
mov esi, dword [esp + 0x26c]
push 0x5a5358
push esi
call fcn.004d6acd
mov edi, dword [esp + 0x278]
add esp, 8
test eax, eax
je 0x4c9196
push 0x5985ac
push 0x5a5358
push edi
push esi
call fcn.004c8d90
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
call fcn.004d8eb0
push 0x5b3c54
push 5
call fcn.004d883a
mov eax, dword [esp + 0x294]
add esp, 0x18
test eax, eax
pop edi
je 0x4c91e6
mov edx, dword [esp + 0x16]
lea eax, [esp + 0x40]
and edx, 0xffff
push edx
push str.__.3d
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x4c]
push ecx
push ebx
call fcn.004d62f1
add esp, 0x14
pop esi
pop ebx
add esp, 0x258
ret
Function at 0x4c9590
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x254
push ebx
mov ebx, dword [esp + 0x264]
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
push 9
push eax
push 0xe
push 0x400
mov word [ebx], 0
call esi
lea edx, [esp + 0x38]
push 9
push edx
lea ecx, [esp + 0x54]
push 0xf
push 0x400
mov dword [esp + 0x3c], ecx
call esi
lea ecx, [esp + 0xc]
push 9
push ecx
lea eax, [esp + 0x40]
push 0x12
push 0x400
mov dword [esp + 0x40], eax
call esi
lea edx, [esp + 0xc]
push edx
call fcn.004d6be0
add esp, 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
push 9
push eax
push 0x10
push 0x400
call esi
lea ecx, [esp + 0xc]
push ecx
call fcn.004d6be0
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 0x28], eax
push 9
push edx
push 0x1010
push 0x400
call esi
lea eax, [esp + 0xc]
push eax
call fcn.004d6be0
mov ecx, dword [esp + 0x26c]
mov edx, dword [esp + 0x268]
mov dword [esp + 0x38], eax
push ecx
push edx
lea eax, [esp + 0x6c]
push str._I64d
push eax
call fcn.004d5ee1
add esp, 0x14
lea ecx, [esp + 0x20]
lea edx, [esp + 0x60]
push 0x40
push ebx
push ecx
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x254
ret

Function at 0x4c9bd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa00
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push esi
push edi
mov edi, dword [esp + 0xa14]
push 0
push 0
push 0x14b
push edi
call ebx
push 0
push 0x40
push 0x141
push edi
call ebx
mov ecx, dword [esp + 0xa18]
push 0x5b9260
lea eax, [esp + 0x214]
push 0x400
push eax
push 0x5aae60
push str.Profiles
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x210]
push 0x7c
push edx
call fcn.004c9a70
mov ebp, eax
add esp, 8
xor esi, esi
test ebp, ebp
jle 0x4c9c74
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push 0x7c
push eax
lea ecx, [esp + 0x21c]
push esi
push ecx
call fcn.004c9ab0
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 0
push 0x14a
push edi
call ebx
inc esi
cmp esi, ebp
jl 0x4c9c43
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa00
ret
Function at 0x4c9c80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa00
lea eax, [esp + 0x200]
push ebx
push ebp
mov ebp, dword [esp + 0xa0c]
push esi
push edi
push 0x5b9260
push 0x400
push eax
push 0x5aae60
push str.Profiles
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x210]
push 0x7c
push ecx
call fcn.004c9a70
mov ebx, dword [esp + 0xa20]
mov edi, eax
add esp, 8
xor esi, esi
test edi, edi
jle 0x4c9d06
push pe_nt_image_headers32
lea edx, [esp + 0x14]
push 0x7c
push edx
lea eax, [esp + 0x21c]
push esi
push eax
call fcn.004c9ab0
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.004d7652
add esp, 0x1c
test eax, eax
je 0x4c9d42
inc esi
cmp esi, edi
jl 0x4c9cd5
lea edx, [esp + 0x210]
push ebx
push edx
call fcn.004d62f1
lea eax, [esp + 0x218]
push 0x598e0c
push eax
call fcn.004d62f1
add esp, 0x10
lea ecx, [esp + 0x210]
push 0x5b9260
push ecx
push str.Profiles
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa00
ret
Function at 0x4c9d50
Capabilities:
Get graphical window text
Read .ini file

Disassembly:
sub esp, 0xc0c
lea eax, [esp + 4]
push ebx
mov ebx, dword [esp + 0xc14]
push 0x40
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 8], 0
jne 0x4c9d7f
or eax, 0xffffffff
pop ebx
add esp, 0xc0c
ret
push ebp
push esi
push edi
mov edi, dword [esp + 0xc24]
push 0x5b9260
lea ecx, [esp + 0x420]
push 0x400
push ecx
push 0x5aae60
push str.Profiles
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x41c]
push 0x7c
push edx
call fcn.004c9a70
add esp, 8
xor ebp, ebp
test eax, eax
mov dword [esp + 0x10], eax
jle 0x4c9f24
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push pe_nt_image_headers32
lea eax, [esp + 0x220]
push 0x7c
push eax
lea ecx, [esp + 0x428]
push ebp
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x28]
lea eax, [esp + 0x230]
push edx
push eax
call fcn.004d7652
add esp, 0x1c
test eax, eax
jne 0x4c9e4f
lea ecx, [esp + 0x14]
lea edx, [esp + 0x21c]
push ecx
push str.Profile__s
push edx
call fcn.004d5ee1
add esp, 0xc
lea eax, [esp + 0x21c]
push 0x5b9260
push 0x5aae60
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push 0x14c
push ebx
call esi
cmp eax, 0xffffffff
jne 0x4c9e69
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jl 0x4c9dd2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc0c
ret
push 0
push eax
push 0x144
push ebx
call esi
push 0
push 0xffffffffffffffff
push 0x14e
push ebx
call esi
xor ebp, ebp
mov ecx, 0x200
push ebp
xor eax, eax
lea edi, [esp + 0x420]
push ebp
push 0x146
push ebx
rep stosd dword es:[edi], eax
call esi
test eax, eax
jle 0x4c9f04
lea edx, [esp + 0x14]
mov ecx, 0x82
push edx
xor eax, eax
lea edi, [esp + 0x18]
push ebp
push 0x148
push ebx
rep stosd dword es:[edi], eax
call esi
lea eax, [esp + 0x14]
push eax
call fcn.004d6713
add esp, 4
test eax, eax
jbe 0x4c9ef3
lea ecx, [esp + 0x14]
lea edx, [esp + 0x41c]
push ecx
push edx
call fcn.004d62f1
lea eax, [esp + 0x424]
push 0x598e0c
push eax
call fcn.004d62f1
add esp, 0x10
push 0
push 0
push 0x146
push ebx
inc ebp
call esi
cmp ebp, eax
jl 0x4c9ea0
mov edx, dword [esp + 0xc24]
lea ecx, [esp + 0x41c]
push 0x5b9260
push ecx
push str.Profiles
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc0c
ret
Function at 0x4c9f40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x490
mov ecx, 0x82
xor eax, eax
push edi
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x498]
lea eax, [esp + 4]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 4], 0
jne 0x4c9f7f
or eax, 0xffffffff
pop edi
add esp, 0x490
ret
mov edx, dword [esp + 0x4a0]
push esi
push edx
lea eax, [esp + 0x294]
push 0x5985ac
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x29c]
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.004d62f1
lea eax, [esp + 0x9c]
push 0x599e98
push eax
call fcn.004d62f1
mov edi, dword [esp + 0x4c8]
add esp, 0x1c
xor esi, esi
test edi, edi
jle 0x4ca00d
push ebx
mov ebx, dword [esp + 0x4ac]
mov ecx, dword [ebx + esi*4]
lea edx, [esp + 0x294]
push ecx
push 0x598118
push edx
call fcn.004d5ee1
lea eax, [esp + 0x2a0]
lea ecx, [esp + 0x98]
push eax
push ecx
call fcn.004d62f1
add esp, 0x14
inc esi
cmp esi, edi
jl 0x4c9fd9
pop ebx
lea edx, [esp + 0x88]
push 0x599e98
push edx
call fcn.004d62f1
mov eax, dword [esp + 0x4bc]
mov ecx, dword [esp + 0x4b8]
push eax
push ecx
lea edx, [esp + 0x2a0]
push str._.2f
push edx
call fcn.004d5ee1
lea eax, [esp + 0x2a8]
lea ecx, [esp + 0xa0]
push eax
push ecx
call fcn.004d62f1
lea edx, [esp + 0xa8]
push 0x599e98
push edx
call fcn.004d62f1
lea eax, [esp + 0x30]
lea ecx, [esp + 0x2b8]
push eax
push str.Profile__s
push ecx
call fcn.004d5ee1
mov esi, dword [esp + 0x4d4]
add esp, 0x34
lea edx, [esp + 0x88]
lea eax, [esp + 0x290]
push 0x5b9260
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.004c9c80
add esp, 8
xor eax, eax
pop esi
pop edi
add esp, 0x490
ret
Function at 0x4ca0c0
Capabilities:
Get graphical window text
Read .ini file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x494
lea eax, [esp + 4]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 4], 0
je 0x4ca213
lea edx, [esp + 4]
lea eax, [esp + 0x84]
push edx
push str.Profile__s
push eax
call fcn.004d5ee1
mov eax, dword [esp + 0x4a8]
add esp, 0xc
lea ecx, [esp + 0x28c]
lea edx, [esp + 0x84]
push 0x5b9260
push 0x104
push ecx
push 0x5aae60
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x28c]
push 0x3b
push ecx
call fcn.004c9a70
add esp, 8
cmp eax, 3
jne 0x4ca213
push esi
push edi
push 0x104
lea edx, [esp + 0x90]
push 0x3b
push edx
lea eax, [esp + 0x2a0]
push 0
push eax
call fcn.004c9ab0
push 0x104
lea ecx, [esp + 0xa4]
push 0x3b
push ecx
lea edx, [esp + 0x2b4]
push 1
push edx
call fcn.004c9ab0
mov edi, dword [esp + 0x4d4]
add esp, 0x28
xor esi, esi
test edi, edi
jle 0x4ca1c9
push ebx
mov ebx, dword [esp + 0x4ac]
push 0x40
lea eax, [esp + 0x14]
push 0x7c
push eax
lea ecx, [esp + 0x9c]
push esi
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x24]
push edx
call fcn.004d6be0
add esp, 0x18
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jl 0x4ca19c
pop ebx
push 0x104
lea eax, [esp + 0x90]
push 0x3b
push eax
lea ecx, [esp + 0x2a0]
push 2
push ecx
call fcn.004c9ab0
lea edx, [esp + 0xa0]
push edx
call fcn.004c5910
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov eax, dword [esp + 0x4c8]
add esp, 0x18
fstp qword [eax]
pop edi
xor eax, eax
pop esi
add esp, 0x494
ret
or eax, 0xffffffff
add esp, 0x494
ret
Function at 0x4ca220
Capabilities:
Get graphical window text
Read .ini file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x8a0
lea eax, [esp]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp], 0
je 0x4ca39a
lea edx, [esp]
lea eax, [esp + 0x80]
push edx
push str.Profile__s
push eax
call fcn.004d5ee1
mov eax, dword [esp + 0x8b4]
add esp, 0xc
lea ecx, [esp + 0x490]
lea edx, [esp + 0x80]
push 0x5b9260
push 0x104
push ecx
push 0x5aae60
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x490]
push 0x3b
push ecx
call fcn.004c9a70
add esp, 8
cmp eax, 3
jne 0x4ca39a
push ebx
push esi
push edi
push 0x208
lea edx, [esp + 0x90]
push 0x3b
push edx
lea eax, [esp + 0x4a8]
push 0
push eax
call fcn.004c9ab0
push 0x208
lea ecx, [esp + 0xa4]
push 0x3b
push ecx
lea edx, [esp + 0x4bc]
push 1
push edx
call fcn.004c9ab0
mov edi, dword [esp + 0x8e4]
add esp, 0x28
xor esi, esi
test edi, edi
jle 0x4ca328
mov ebx, dword [esp + 0x8b8]
push 0x40
lea eax, [esp + 0x10]
push 0x7c
push eax
lea ecx, [esp + 0x98]
push esi
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x20]
push edx
call fcn.004d6be0
add esp, 0x18
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jl 0x4ca2fc
push 0x208
lea eax, [esp + 0x90]
push 0x3b
push eax
lea ecx, [esp + 0x4a8]
push 2
push ecx
call fcn.004c9ab0
mov ebx, dword [esp + 0x8d8]
add esp, 0x14
xor esi, esi
test ebx, ebx
jle 0x4ca38e
mov edi, dword [esp + 0x8c0]
push ebp
mov ebp, dword [esp + 0x8cc]
mov edx, dword [edi + esi*4]
push ebp
push 0x7c
push edx
lea eax, [esp + 0x9c]
push esi
push eax
call fcn.004c9ab0
mov ecx, dword [edi + esi*4]
push 0
push ecx
call fcn.00454070
add esp, 0x1c
inc esi
cmp esi, ebx
jl 0x4ca365
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x8a0
ret
or eax, 0xffffffff
add esp, 0x8a0
ret
Function at 0x4ca3b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x8a0
mov ecx, 0x104
xor eax, eax
push edi
lea edi, [esp + 0x494]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x8a8]
lea eax, [esp + 4]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 4], 0
jne 0x4ca3ef
or eax, 0xffffffff
pop edi
add esp, 0x8a0
ret
mov edx, dword [esp + 0x8b0]
push ebx
push esi
push edx
lea eax, [esp + 0x90]
push 0x5985ac
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x98]
lea edx, [esp + 0x4a8]
push ecx
push edx
call fcn.004d62f1
lea eax, [esp + 0x4b0]
push 0x599e98
push eax
call fcn.004d62f1
mov edi, dword [esp + 0x8dc]
add esp, 0x1c
xor esi, esi
test edi, edi
jle 0x4ca47c
mov ebx, dword [esp + 0x8bc]
mov ecx, dword [ebx + esi*4]
lea edx, [esp + 0x8c]
push ecx
push 0x598118
push edx
call fcn.004d5ee1
lea eax, [esp + 0x98]
lea ecx, [esp + 0x4a8]
push eax
push ecx
call fcn.004d62f1
add esp, 0x14
inc esi
cmp esi, edi
jl 0x4ca449
lea edx, [esp + 0x49c]
push 0x599e98
push edx
call fcn.004d62f1
mov ebx, dword [esp + 0x8d0]
add esp, 8
xor esi, esi
test ebx, ebx
jle 0x4ca4fb
mov edi, dword [esp + 0x8c4]
push ebp
mov ebp, dword [esp + 0x8d0]
test ebp, ebp
je 0x4ca4c4
mov eax, dword [edi + esi*4]
lea ecx, [esp + 0x90]
push eax
push str.__s_
push ecx
jmp 0x4ca4d5
mov edx, dword [edi + esi*4]
lea eax, [esp + 0x90]
push edx
push 0x5a4098
push eax
call fcn.004d5ee1
add esp, 0xc
lea ecx, [esp + 0x90]
lea edx, [esp + 0x4a0]
push ecx
push edx
call fcn.004d62f1
add esp, 8
inc esi
cmp esi, ebx
jl 0x4ca4ad
pop ebp
lea eax, [esp + 0x49c]
push 0x599e98
push eax
call fcn.004d62f1
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
push str.Profile__s
push edx
call fcn.004d5ee1
mov esi, dword [esp + 0x8c8]
add esp, 0x14
lea eax, [esp + 0x49c]
lea ecx, [esp + 0x8c]
push 0x5b9260
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esp + 0xc]
push edx
push esi
call fcn.004c9c80
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x8a0
ret

Function at 0x4ca570
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 9
push str.SortOrder
push esi
call edi
mov ecx, dword [esp + 0x18]
push 0x5b9260
push 0
push str.AutoSort
push esi
mov dword [ecx], eax
call edi
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
mov dword [edx], eax
je 0x4ca5c0
push 0x5b9260
push 0
push str.SortBeforeSel
push esi
call edi
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret