joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cc13
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push edi
push 0x487d3e
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, dword [esi + 0x11d]
cmp eax, 7
je 0x41cc44
cmp eax, 0x18
jne 0x41cc52
mov eax, dword [esi + 0x28]
add eax, dword [0x487d42]
mov dword [0x487d4a], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cwde
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
cwde
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x14]
shl edi, 4
add edi, 0x49f276
cmp dword [ebp + 0x10], 0
jne 0x41ccc4
mov eax, dword [esi + 0x11d]
or eax, eax
je 0x41ce02
mov dword [0x487d52], 1
mov eax, dword [ebp - 8]
mov dword [0x487d6a], eax
mov eax, dword [ebp - 4]
mov dword [0x487d6e], eax
push dword [ebp + 0x14]
push 0
push 0x487d3e
push dword [ebp + 8]
call fcn.0041b96d
push 0x487d3e
push edi
call sub.user32.dll_CopyRect
jmp 0x41ce02
cmp dword [ebp + 0x10], 1
jne 0x41cd75
mov eax, dword [ebp - 8]
sub eax, dword [0x487d6a]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
sub eax, dword [0x487d6e]
mov dword [ebp - 4], eax
push dword [edi]
pop dword [ebp - 0x10]
push dword [edi + 4]
pop dword [ebp - 0xc]
push 0x487d3e
push edi
call sub.user32.dll_CopyRect
mov eax, dword [ebp - 8]
add dword [edi], eax
add dword [edi + 8], eax
mov eax, dword [ebp - 4]
add dword [edi + 4], eax
add dword [edi + 0xc], eax
push edi
push dword [ebp + 8]
call fcn.0041cb86
mov eax, dword [edi]
mov edx, dword [edi + 4]
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 8]
call fcn.0041b96d
push dword [ebp + 8]
call fcn.0041bd9b
mov dword [ebp - 0x14], eax
mov dword [0x487d5e], 0
mov dword [0x487d62], 0
push 0x487d5e
push dword [ebp - 0x14]
call sub.user32.dll_ClientToScreen
mov eax, dword [edi]
sub eax, dword [0x487d5e]
mov dword [0x487d5e], eax
mov eax, dword [edi + 4]
sub eax, dword [0x487d62]
mov dword [0x487d62], eax
jmp 0x41ce02
cmp dword [ebp + 0x10], 2
jne 0x41ce02
push dword [ebp + 0x14]
push 2
push edi
push dword [ebp + 8]
call fcn.0041b96d
push 0
push dword [0x453900]
call sub.user32.dll_ShowWindow
push dword [ebp + 8]
call fcn.0041bd9b
mov dword [ebp - 0x14], eax
mov dword [0x487d5e], 0
mov dword [0x487d62], 0
push 0x487d5e
push dword [ebp - 0x14]
call sub.user32.dll_ClientToScreen
mov eax, dword [edi]
sub eax, dword [0x487d5e]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
sub eax, dword [0x487d62]
mov dword [ebp - 4], eax
mov dword [0x487d52], 0
call sub.user32.dll_ReleaseCapture
push 5
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call sub.user32.dll_SetWindowPos
pop edi
pop esi
leave
ret 0x10
Function at 0x41f75c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
cmp dword [0x487d66], 0
je 0x41f83f
push 0xffffffffffffffeb
push dword [0x487d66]
call sub.user32.dll_GetWindowLongA
or eax, eax
je 0x41f953
mov esi, eax
mov eax, dword [esi + 0x11d]
or eax, eax
je 0x41f83a
push 4
push dword [0x4538c4]
call sub.user32.dll_GetWindowLongA
mov edx, eax
mov eax, dword [edx + 0x70]
mov dword [esi + 0x14d], eax
mov dword [edx + 0x70], esi
mov dword [esi], 0xffffffff
push dword [esi + 0x125]
call fcn.0041bc50
mov eax, dword [esi + 0x151]
or eax, eax
je 0x41f7db
push eax
call sub.gdi32.dll_DeleteObject
mov dword [esi + 0x151], 0
cmp dword [esi + 0x10], 0
je 0x41f7fd
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [esi + 0x10]
call sub.user32.dll_SendMessageA
push dword [esi + 0x10]
call sub.user32.dll_DestroyWindow
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [0x487d66]
call sub.user32.dll_SendMessageA
push dword [0x487d66]
call sub.user32.dll_DestroyWindow
call fcn.0041bf01
push 0
push 1
call fcn.0041bdc7
push 0
push dword [0x4538cc]
call fcn.0041c8a0
jmp 0x41f953
cmp dword [0x487d36], 0
je 0x41f953
jmp 0x41f930
push dword [0x487d36]
call sub.user32.dll_GetParent
mov dword [ebp - 4], eax
mov eax, 8
jmp 0x41f888
push eax
push 0xffffffffffffffeb
push dword [0x487d36]
call sub.user32.dll_GetWindowLongA
push eax
push dword [0x487d36]
call sub.user32.dll_DestroyWindow
pop eax
mov dword [0x487d36], eax
pop eax
dec eax
or eax, eax
jne 0x41f866
push 0xffffffffffffffeb
push dword [ebp - 4]
call sub.user32.dll_GetWindowLongA
or eax, eax
je 0x41f930
mov esi, eax
mov eax, dword [esi + 0x11d]
or eax, eax
je 0x41f930
push 4
push dword [0x4538c4]
call sub.user32.dll_GetWindowLongA
push dword [eax + 0x70]
mov dword [eax + 0x70], esi
mov dword [esi], 0xffffffff
pop dword [esi + 0x14d]
push dword [esi + 0x125]
call fcn.0041bc50
mov eax, dword [esi + 0x151]
or eax, eax
je 0x41f8f2
push eax
call sub.gdi32.dll_DeleteObject
mov dword [esi + 0x151], 0
cmp dword [esi + 0x10], 0
je 0x41f914
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [esi + 0x10]
call sub.user32.dll_SendMessageA
push dword [esi + 0x10]
call sub.user32.dll_DestroyWindow
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [ebp - 4]
call sub.user32.dll_SendMessageA
push dword [ebp - 4]
call sub.user32.dll_DestroyWindow
cmp dword [0x487d36], 0
jne 0x41f851
push 0
push 1
call fcn.0041bdc7
push 0
push dword [0x4538cc]
call fcn.0041c8a0
push 0
push 0
push 0x201
push dword [0x4538c4]
call sub.user32.dll_SendMessageA
pop esi
leave
ret
Function at 0x41ff20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov esi, eax
cmp dword [esi + 0x11d], 0
je 0x41ffc7
mov eax, dword [esi + 0x151]
or eax, eax
je 0x41ff5a
push eax
call sub.gdi32.dll_DeleteObject
mov dword [esi + 0x151], 0
cmp dword [esi + 0x10], 0
je 0x41ff7c
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [esi + 0x10]
call sub.user32.dll_SendMessageA
push dword [esi + 0x10]
call sub.user32.dll_DestroyWindow
push 0xd
call sub.gdi32.dll_GetStockObject
push 0
push eax
push 0x30
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
push dword [ebp + 8]
call sub.user32.dll_DestroyWindow
push esi
call fcn.0041e37f
mov dword [ebp + 8], eax
add esi, 0x175
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x41ffa1
or eax, eax
je 0x420017
push 3
push 0
push 0
push 0
push 0
push eax
push dword [ebp + 8]
call sub.user32.dll_SetWindowPos
jmp 0x420017
push dword [esi + 0x14]
pop dword [ebp - 4]
or dword [ebp - 4], 0x56000000
and dword [ebp - 4], 0x56ffffff
push dword [ebp - 4]
push 0xfffffffffffffff0
push dword [ebp + 8]
call sub.user32.dll_SetWindowLongA
push dword [esi + 0x18]
push 0xffffffffffffffec
push dword [ebp + 8]
call sub.user32.dll_SetWindowLongA
lea eax, [esi + 0x2c]
push eax
push dword [ebp + 8]
call sub.user32.dll_SetWindowTextA
push 0x26
push dword [esi + 0x28]
push dword [esi + 0x24]
push 0
push 0
push 0
push dword [ebp + 8]
call sub.user32.dll_SetWindowPos
push dword [ebp + 8]
call sub.user32.dll_UpdateWindow
cmp dword [0x487d4e], 0
jne 0x420034
push 0
push dword [ebp + 8]
call fcn.0041c8a0
jmp 0x42003d
push dword [ebp + 8]
pop dword [0x487d66]
push 0
push 1
call fcn.0041bdc7
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x420245
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cwde
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
cwde
mov dword [ebp - 4], eax
cmp dword [0x45c63a], 0
je 0x420292
mov eax, dword [ebp - 8]
xor edx, edx
idiv dword [0x45c62a]
imul dword [0x45c62a]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor edx, edx
idiv dword [0x45c62e]
imul dword [0x45c62e]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x420322
push dword [ebp + 8]
call fcn.0041bd70
mov dword [ebp - 0xc], eax
mov dword [0x487d56], 1
push dword [ebp + 8]
call sub.user32.dll_SetCapture
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 8]
mov dword [0x487d6a], eax
mov dword [0x487d3e], eax
mov dword [0x487d46], eax
mov eax, dword [ebp - 4]
mov dword [0x487d6e], eax
mov dword [0x487d42], eax
mov dword [0x487d4a], eax
mov dword [0x4a02a2], 1
push 0
push 0
push 0x487d3e
push dword [ebp + 8]
call fcn.0041b96d
mov dword [0x4a02a2], 0
push 0x487d3e
push 0x49f276
call sub.user32.dll_CopyRect
jmp 0x4204c5
cmp dword [ebp + 0x10], 1
jne 0x4203c0
push 0x7f03
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
cmp dword [0x487d56], 0
je 0x4204c5
cmp dword [0x45c63a], 0
je 0x42035a
inc dword [ebp - 8]
inc dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 8]
sub eax, dword [0x487d6a]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
sub eax, dword [0x487d6e]
mov dword [ebp - 4], eax
push 0x487d3e
push 0x49f276
call sub.user32.dll_CopyRect
mov eax, dword [ebp - 8]
add dword [0x49f27e], eax
mov eax, dword [ebp - 4]
add dword [0x49f282], eax
push 0
push 1
push 0x49f276
push dword [ebp + 8]
call fcn.0041b96d
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041bf59
jmp 0x4204c5
cmp dword [ebp + 0x10], 2
jne 0x4204c5
push dword [ebp + 8]
call fcn.0041bd70
mov dword [ebp - 0xc], eax
mov dword [0x487d56], 0
push 0
push 2
push 0x49f276
push dword [ebp + 8]
call fcn.0041b96d
mov dword [0x487d5e], 0
mov dword [0x487d62], 0
push 0x487d5e
push dword [ebp - 0xc]
call sub.user32.dll_ClientToScreen
mov eax, dword [0x487d5e]
sub dword [0x49f276], eax
sub dword [0x49f27e], eax
mov eax, dword [0x487d62]
sub dword [0x49f27a], eax
sub dword [0x49f282], eax
mov eax, dword [0x49f276]
cmp eax, dword [0x49f27e]
jle 0x42044b
xchg dword [0x49f27e], eax
mov dword [0x49f276], eax
sub dword [0x49f27e], eax
mov eax, dword [0x49f27a]
cmp eax, dword [0x49f282]
jle 0x420469
xchg dword [0x49f282], eax
mov dword [0x49f27a], eax
sub dword [0x49f282], eax
call sub.user32.dll_ReleaseCapture
mov eax, dword [0x487d12]
cmp eax, 1
jb 0x4204b8
cmp eax, dword [0x451c05]
jae 0x4204b8
push dword [0x49f282]
push dword [0x49f27e]
push dword [0x49f27a]
push dword [0x49f276]
push eax
push dword [ebp - 0xc]
call fcn.0041f2fd
or eax, eax
je 0x4204b3
push 0
push eax
call fcn.0041c8a0
call fcn.004312d4
push 0
push dword [0x453900]
call sub.user32.dll_ShowWindow
leave
ret 0xc
Function at 0x4209ac
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
lea edi, [ebp - 0x2f8]
dec esi
inc esi
mov al, byte [esi]
cmp al, 0x26
je 0x4209b5
mov byte [edi], al
inc edi
or al, al
jne 0x4209b5
pop edi
lea esi, [ebp - 0x2f8]
push esi
call fcn.004010ef
mov ebx, eax
lea eax, [ebp - 0x78]
push eax
push ebx
push esi
push dword [ebp - 8]
call sub.gdi32.dll_GetTextExtentPoint32A
pop esi
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp eax, dword [0x4a027a]
jae 0x420a03
add eax, dword [ebp - 0x78]
cmp eax, dword [0x4a027a]
jbe 0x420a03
inc edx
or edx, edx
je 0x420a70
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
dec eax
shl eax, 0x10
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x18]
dec eax
mov dword [0x4a027e], eax
push dword [ebp - 0x2fc]
pop dword [0x4a0286]
push 0x17
call sub.user32.dll_GetSystemMetrics
or eax, eax
je 0x420a3b
mov eax, 2
jmp 0x420a40
mov eax, 1
push eax
call sub.user32.dll_GetAsyncKeyState
and eax, 0x8000
or eax, eax
je 0x420a56
mov eax, 2
jmp 0x420a5b
mov eax, 4
dec dword [ebp - 0x1c]
push 0xf
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call sub.user32.dll_DrawEdge
inc dword [ebp - 0x1c]
push esi
call fcn.004010ef
mov ebx, eax
add dword [ebp - 0x24], 2
push 4
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
push dword [ebp - 8]
call sub.user32.dll_DrawTextA
sub dword [ebp - 0x24], 2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [0x4a0276], eax
ret
Function at 0x421568
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push 0xff
push 0x45cf22
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push 0x45cf22
push 0x44ed66
call fcn.00401105
or eax, eax
je 0x42159e
cmp dword [ebp + 0x10], 0
je 0x42161f
push 0x4c
push 0x453998
call sub.kernel32.dll_RtlZeroMemory
mov dword [0x453998], 0x4c
push dword [0x4538b0]
pop dword [0x45399c]
push dword [0x453904]
pop dword [0x4539a0]
mov dword [0x4539a4], 0x44e97b
mov dword [0x4539b4], 0x45cf22
mov byte [0x45cf22], 0
mov dword [0x4539b8], 0x104
mov dword [0x4539cc], 0x1806
mov dword [0x4539d4], 0x44e991
push 0x453998
call sub.comdlg32.dll_GetSaveFileNameA
or eax, eax
jne 0x42162b
mov eax, 1
pop esi
leave
ret 0xc
push 1
push 0x45cf22
call fcn.00415c84
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4216f8
mov dword [ebp - 8], eax
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x70], 0
add esi, 0x90
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x421672
push esi
call fcn.0042153b
jmp 0x421678
add esi, 0x175
mov eax, dword [esi]
or eax, eax
jne 0x421663
mov eax, esi
sub eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
add eax, 0x90
mov eax, dword [eax]
push eax
call fcn.0041bce1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.kernel32.dll_WriteFile
push 4
push 0
push dword [ebp - 8]
push 0x483
push dword [ebp + 8]
call fcn.00408423
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
jne 0x4216d9
push dword [ebp + 8]
push 0
call fcn.0041bdc7
cmp dword [0x45c642], 0
je 0x4216ec
push 1
push dword [ebp + 8]
call fcn.00421277
push dword [ebp + 8]
call fcn.00404423
xor eax, eax
jmp 0x42172e
push 0x44ece9
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push 0
call sub.user32.dll_MessageBoxA
mov eax, 1
pop esi
leave
ret 0xc
Function at 0x424ade
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push esi
push edi
push 0x60000
push 0x40
call fcn.00401030
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.kernel32.dll_GlobalLock
mov esi, dword [0x451a51]
mov edi, dword [ebp - 4]
mov ecx, 0x28
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push 0x199
push 0x9dd
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x424b5f
or eax, eax
je 0x424b5a
mov esi, eax
push edi
push dword [ebp - 8]
push 0x19a
push 0x9dd
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x424b5a
mov ecx, 0x78
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 8]
jmp 0x424b14
push dword [0x451a51]
call sub.kernel32.dll_GlobalUnlock
push dword [0x451a51]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 4]
pop dword [0x451a51]
mov eax, 0
cmp dword [ebp + 0xc], 0
je 0x424c62
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x424c2b
mov dword [ebp - 0xc], eax
mov esi, dword [0x451a51]
add esi, 0x28
mov eax, dword [esi]
or eax, eax
je 0x424bc5
add esi, 0x78
jmp 0x424bba
mov eax, esi
sub eax, dword [0x451a51]
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [0x451a51]
push dword [ebp - 0xc]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0
cmp dword [0x45c642], 0
je 0x424c62
push 1
push dword [ebp + 8]
call fcn.00424785
inc dword [0x44f339]
push 0x2000
push 0x45cf22
push 2
push 0x48e
push dword [0x4538b0]
call fcn.00408423
jmp 0x424c62
push 0x44ece9
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
mov eax, 1
pop edi
pop esi
leave
ret 8
Function at 0x425d7d
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x425e79
mov dword [ebp - 4], eax
push 0x60000
push 0x40
call fcn.00401030
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalLock
cmp dword [ebp + 8], 2
jne 0x425dfb
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov esi, dword [ebp - 0xc]
push str.IDR_MENU
lea eax, [esi]
push eax
call fcn.004010a7
mov eax, dword [0x451a44]
mov word [esi + 0x20], ax
mov eax, dword [0x451a48]
mov word [esi + 0x24], ax
mov word [esi + 0x26], 0x64
jmp 0x425e19
push 0
lea eax, [ebp - 8]
push eax
push 0x60000
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0xc]
call fcn.00425d35
cmp dword [ebp + 8], 3
jne 0x425e2f
mov eax, dword [ebp - 0xc]
jmp 0x425eb0
push dword [ebp - 0xc]
pop dword [0x451a51]
push 0x45cf22
call sub.kernel32.dll_GetFileAttributesA
and eax, 1
push eax
push 0x424ddd
push dword [0x4538b0]
push 0x9c4
push dword [0x453904]
call fcn.004019a1
push dword [0x451a51]
call sub.kernel32.dll_GlobalUnlock
push dword [0x451a51]
call sub.kernel32.dll_GlobalFree
jmp 0x425eb0
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
xor eax, eax
pop esi
leave
ret 4
Function at 0x426127
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call fcn.004011b7
push 0x45cc16
push 0x80
push 0x45ca0e
push 0x44ef8c
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
jne 0x42616f
jmp 0x4261c8
lea eax, [ebp - 0x108]
push eax
push 0x45ca0e
call fcn.0040cd48
lea eax, [ebp - 0x108]
push eax
push 0
push 0x143
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [ebp - 0x10c], eax
push 0x45ca0e
call fcn.00425eb5
push eax
push dword [ebp - 0x10c]
push 0x151
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
inc dword [ebp - 4]
jmp 0x426137
push 0x45cb12
push 0x80
lea eax, [ebp - 0x108]
push eax
push 0x44ef8c
push dword [ebp + 0x10]
push str.VerInf
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
jne 0x426212
push 0x45cc16
push 0x80
lea eax, [ebp - 0x108]
push eax
push 0x44ef8c
push dword [ebp + 0x10]
push str.VerInf
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x108]
push eax
call fcn.00425eb5
mov dword [ebp - 0x110], eax
mov dword [ebp - 8], 0
jmp 0x426253
dec dword [ebp - 4]
push 0
push dword [ebp - 4]
push 0x150
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, dword [ebp - 0x110]
jne 0x426253
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x42622d
push 0
push dword [ebp - 8]
push 0x14e
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
leave
ret 0xc
Function at 0x427021
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push 0x400
push 0x40
call fcn.00401030
mov dword [ebp - 0x144], eax
push dword [ebp - 0x144]
call sub.kernel32.dll_GlobalLock
mov edi, dword [ebp - 0x144]
push 0x45cb12
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
push str.LANGUAGE
push str.LANGUAGE
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4270de
push str.LANGUAGE
push edi
call fcn.00420b04
add edi, eax
mov al, 0x20
stosb byte es:[edi], al
lea eax, [ebp - 0x100]
push eax
push edi
call fcn.004010a7
push edi
call fcn.004010ef
add edi, eax
mov al, 0x2c
stosb byte es:[edi], al
push 0x45cb12
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
push str.SubLang
push str.LANGUAGE
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x100]
push eax
push edi
call fcn.004010a7
push edi
call fcn.004010ef
add edi, eax
mov ax, 0xa0d
stosw word es:[edi], ax
cmp dword [ebp + 8], 0
je 0x427105
push 2
call fcn.0042ec60
call fcn.004305a1
call fcn.0042ed4b
push dword [ebp - 0x144]
call fcn.00430605
jmp 0x427249
mov word [ebp - 0x100], 0x30
push 0x45cb12
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.MakeFiles
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
sub eax, 4
mov byte ss:[eax + ebp - 0x100], 0
push 0x45de5e
lea eax, [ebp - 0x140]
push eax
call fcn.004010a7
push str.Res_
lea eax, [ebp - 0x140]
push eax
call fcn.004010c5
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004010c5
push str.Lng.rc
lea eax, [ebp - 0x140]
push eax
call fcn.004010c5
lea eax, [ebp - 0x140]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4271c0
push 0x800000
push 0x45cb12
push 0xfffffffffffffffb
push 0x478
push dword [0x4538b0]
call fcn.00408423
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x140]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x427249
mov dword [ebp - 0x148], eax
push dword [ebp - 0x144]
call fcn.004010ef
mov dword [ebp - 0x14c], eax
push 0
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x144]
push dword [ebp - 0x148]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x148]
call sub.kernel32.dll_CloseHandle
inc dword [0x44f339]
push 0x2000
lea eax, [ebp - 0x140]
push eax
push 7
push 0x48e
push dword [0x4538b0]
call fcn.00408423
push dword [ebp - 0x144]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 0x144]
call sub.kernel32.dll_GlobalFree
leave
ret 4