joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aebd8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aed83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4aed64
mov dl, 1
mov eax, dword [0x4311fc]
call fcn.0043d8f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.00406894
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4aed53
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047b374
test al, al
je 0x4aed46
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4aed94
lea eax, [ebp - 0x394]
call fcn.0041bcb4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4aed46
xor eax, eax
push ebp
push 0x4aed3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4aee04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4aed28
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407264
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4aed28
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aed46
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4aec49
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.0043d830
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aed8a
lea eax, [ebp - 0x3a0]
call fcn.00406894
ret

Function at 0x4af8e0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4c324c]
cmp byte [eax + 0xad], 0
jne 0x4af952
cmp dword [0x4c3264], 0
jne 0x4af912
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4bce78]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4c3264], eax
cmp dword [0x4c3260], 0
jne 0x4af92d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4c3260], eax
cmp dword [0x4c3268], 0
jne 0x4af952
push esp
push 0
push 0
mov eax, dword [0x4bce74]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4c3268], eax
pop edx
ret
Function at 0x4afc68
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4afc7f
add esp, 0xfffffff0
call fcn.004053a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004460a4
mov eax, dword [0x4bcedc]
cmp byte [eax], 0
jne 0x4afcac
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4bd114]
cmp word [eax + 2], 0
jne 0x4afcc6
mov eax, dword [0x4bd114]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b1d30
mov eax, dword [0x4bd1e4]
cmp word [eax + 2], 0
jne 0x4afce0
mov eax, dword [0x4bd1e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b1f34
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44cf38]
call fcn.004521cc
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b24ac
mov dl, 1
mov eax, dword [0x42ea20]
call fcn.00404e5c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x42ea20]
call fcn.00404e5c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x450830]
call fcn.00459014
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4afec0
mov eax, dword [0x4bd018]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004594a8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b2794
mov dl, 1
mov eax, dword [0x42ea20]
call fcn.00404e5c
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4bd018]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0041badc
test eax, eax
je 0x4afdf1
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0041b890
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041bac0
test eax, eax
je 0x4afe09
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00407264
push ebx
push 0x4b171c
call fcn.004a5a78
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4bcedc]
cmp byte [eax], 0
jne 0x4afe5a
mov eax, ebx
call fcn.004b0034
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b29c0
mov eax, ebx
call fcn.004b35f0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4afeb7
call fcn.004053fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0300
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b03a2
cmp dword [ebx + 0x94], 0
jne 0x4b039c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b024c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b039c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b0362
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b039c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00439d8c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b0371
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b05c0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4c324c]
cmp dword [eax + 0x170], 0
je 0x4b0725
test bl, bl
jne 0x4b0673
cmp dword [esi + 0x9c], 0
jne 0x4b0668
mov eax, esi
call fcn.004b3440
push eax
push 0x4b04cc
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b0639
mov eax, dword [0x4c324c]
cmp byte [eax + 0xd3], 0
je 0x4b0639
mov eax, dword [esi + 0xd8]
call fcn.00408144
mov edi, eax
cmp edi, 0
jl 0x4b0639
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b0622
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b0668
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00439d8c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b0648
inc dword [esi + 0x9c]
jmp 0x4b0725
cmp dword [esi + 0x9c], 0
jle 0x4b0725
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b0725
cmp dword [esi + 0x44], 0
je 0x4b06d0
mov eax, dword [0x4c324c]
cmp byte [eax + 0xd3], 0
je 0x4b06d0
mov eax, dword [esi + 0xd8]
call fcn.00408144
mov edi, eax
cmp edi, 0
jl 0x4b06d0
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b06b9
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b06ff
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00439d8c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b06df
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a3950]
call fcn.00408304
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b1368
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b13d3
cmp byte [ebx + 0xd3], 0
jne 0x4b13d3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004069fc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b13c0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b13e0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c54
jmp 0x4b13e0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c54
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b2ba8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b2c16
mov eax, esi
call fcn.00475454
test al, al
je 0x4b2c16
mov eax, dword [ebx + 0x84]
call fcn.004750a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b2c16
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b2c0a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004750a8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046c024
jmp 0x4b2c16
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b29e0
pop esi
pop ebx
ret
Function at 0x401c15
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c90
call fcn.0040b070
push esi
push dword [ebp + 8]
call fcn.00403351
mov esi, eax
cmp esi, 0xffffffff
pop ecx
mov dword [ebp - 4], esi
je 0x401d6c
push edi
xor edi, edi
push 0x2c82
lea eax, [ebp - 0x2c8e]
push edi
push eax
mov word [ebp - 0x2c90], di
call sub.msvcrt.dll_memset
push 4
lea eax, [ebp - 0x2c90]
push eax
push esi
call fcn.00403e03
add esp, 0x18
cmp word [ebp - 0x2c90], 0xc350
jne 0x401d62
cmp word [ebp - 0x2c8e], 0x80
jae 0x401d62
movzx eax, word [ebp - 0x2c8e]
imul eax, eax, 0x59
push eax
lea eax, [ebp - 0x2c8c]
push eax
push esi
call fcn.00403e03
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401d62
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x401d5c
cmp word [ebp - 0x2c8e], di
mov dword [ebp + 8], edi
jbe 0x401d5c
lea esi, [ebp - 0x2c8a]
push ebx
movzx eax, word [esi - 2]
cmp ax, 0xc000
mov dword [ebp - 8], eax
jb 0x401cf2
lea eax, [esi + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
movzx eax, ax
mov dword [ebp - 8], eax
push dword [esi]
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x401d45
mov edi, dword [esi]
push 0
push 0
push dword [esi + 4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push edi
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00403e03
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
movzx eax, word [ebp - 8]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
xor edi, edi
movzx eax, word [ebp - 0x2c8e]
inc dword [ebp + 8]
add esi, 0x59
cmp dword [ebp + 8], eax
jb 0x401cd5
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
leave
ret 4

Function at 0x402f98
Capabilities:
Link many functions at runtime

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x402fa4
xor eax, eax
inc eax
pop edi
ret
push str.GDIPlus.dll
call fcn.00403feb
cmp eax, edi
pop ecx
mov dword [esi], eax
je 0x40301d
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GdiplusStartup
push eax
call edi
push str.GdiplusShutdown
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.GdipSaveImageToFile
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.GdipGetImageEncodersSize
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.GdipGetImageEncoders
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.GdipCreateBitmapFromHBITMAP
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.GdipDisposeImage
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GdipLoadImageFromFile
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
xor edi, edi
mov dword [esi + 0x20], eax
inc edi
mov eax, edi
pop edi
ret
Function at 0x40352c
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00403351
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x4035bb
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4035a4
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4035a4
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x4035ad
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x4035c4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4037c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x40395d
Capabilities:
Get common file path

Disassembly:
cmp byte [0x40fbd8], 0
push esi
mov esi, 0x40fbd8
jne 0x40397d
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dword [0x40fce0], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_strcpy
mov eax, dword [0x40fce0]
pop ecx
pop ecx
pop esi
ret

Function at 0x403c40
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40c3f4
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x403feb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3ff
lea eax, [ebp - 0x3ff]
push 0
push eax
mov byte [ebp - 0x400], 0
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [0x40fce8], 0
mov esi, 0x40fce8
jne 0x404031
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x40fdf0], eax
lea eax, [ebp - 0x400]
push esi
push eax
call sub.msvcrt.dll_strcpy
lea esi, [ebp - 0x400]
call fcn.004033a5
push dword [ebp + 8]
mov eax, esi
push eax
call sub.msvcrt.dll_strcat
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x40406b
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x404a7e
Capabilities:
Read .ini file

Disassembly:
push 0x40f868
push dword [esp + 0xc]
mov byte [esi], 0
push esi
push 0x40c3f4
push dword [esp + 0x14]
push 0x40f970
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov eax, esi
ret
Function at 0x404aa2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040b070
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40f868
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40c3f4
push dword [ebp + 8]
push 0x40f970
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
pop esi
je 0x404b0e
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_strcpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x404b12
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040b070
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x40f868
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40c3f4
push dword [ebp + 8]
mov esi, 0x40f970
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
jne 0x404b7a
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
jmp 0x404b7c
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x404e60
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.004037c2
test eax, eax
pop ecx
je 0x404ee7
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x40f868
push edi
call sub.msvcrt.dll_strcpy
push str.general
mov esi, 0x40f970
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
push edi
push 0
push 0x40c88c
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x40f9b8
mov dword [0x40f9b4], eax
call fcn.00404a7e
push 0x3f
push str.TranslatorName
mov esi, 0x40f9f8
call fcn.00404a7e
push 0xff
push str.TranslatorURL
mov esi, 0x40fa38
call fcn.00404a7e
add esp, 0x18
pop edi
pop esi
ret
Function at 0x40697c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor eax, eax
cmp dword [esi + 0x1a4], eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x406a17
cmp dword [esi + 0x1ac], eax
je 0x4069e7
push 0x15c
push eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4001
push 0x160
lea eax, [esp + 0x20]
push eax
push 0
push 0x40c3f4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [esi + 0x198], eax
push eax
jmp 0x406a08
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
push 1
push eax
mov dword [esi + 0x198], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x198]
push 1
push 0x1003
push dword [esi + 0x190]
call edi
cmp dword [esi + 0x1a8], 0
je 0x406a50
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebx
push 1
push eax
mov dword [esi + 0x19c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x19c]
push 0
push 0x1003
push dword [esi + 0x190]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0
mov dword [esi + 0x194], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0
mov dword [esp + 0x14], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0
push dword [esi + 0x194]
mov dword [esp + 0x14], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push dword [esi + 0x194]
call ebx
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esi + 0x194]
call ebx
push dword [esp + 0x10]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
call ebx
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x194]
mov esi, dword [esi + 0x190]
push eax
push 0
push 0x1208
push esi
call fcn.0040254b
pop ecx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407836
Capabilities:
Delete file
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
push esi
call fcn.00406b60
test eax, eax
je 0x4078ac
lea edi, [ebp - 0x104]
call fcn.00403776
mov eax, dword [esi + 0x394]
push 1
push 2
mov ecx, edi
push ecx
push esi
call fcn.00407806
test eax, eax
je 0x4078b7
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407887
mov eax, edi
push eax
call fcn.0040352c
pop ecx
jmp 0x40788d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40789d
push dword [esi + 0x108]
call fcn.004033c7
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x4078b7
lea edi, [esi + 0x39c]
call fcn.00402f00
pop edi
leave
ret
Function at 0x408039
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00407f01
mov edi, eax
test edi, edi
je 0x408095
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [ebp + 0xc]
call fcn.0040336a
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x408087
push dword [ebp - 4]
push edi
push ebx
call fcn.00403e22
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x408095
push dword [esi + 0x108]
xor eax, eax
call fcn.004033c7
pop ecx
mov eax, esi
call fcn.00407e86
pop edi
pop esi
pop ebx
leave
ret 8