joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427656
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
lea eax, [ebp - 0x104]
push eax
call fcn.004010ef
dec eax
cmp byte ss:[eax + ebp - 0x104], 0x5c
je 0x427697
push 0x44ef92
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x44efa0
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x4637e8
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x42789e
mov dword [ebp - 0x108], eax
mov eax, dword [0x4637e8]
and eax, 0x10
or eax, eax
je 0x42774e
mov ax, word [0x463814]
cmp ax, 0x2e
je 0x42787b
cmp ax, 0x2e2e
je 0x42787b
cmp dword [ebp + 0xc], 0
jne 0x42787b
mov word [ebp - 0x104], 0x44
push 0x463814
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
lea eax, [ebp - 0x104]
push eax
push 0
push 0x180
push dword [0x45394c]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x10c], eax
push 0
push dword [ebp - 0x10c]
push 0x19a
push dword [0x45394c]
call sub.user32.dll_SendMessageA
jmp 0x42787b
cmp dword [ebp + 0xc], 0
jne 0x427830
mov eax, dword [0x44f717]
or eax, eax
je 0x4277c2
push esi
lea esi, [0x463814]
push esi
call fcn.004010ef
add esi, eax
jmp 0x427779
dec esi
cmp byte [esi], 0x2e
je 0x42777d
dec eax
or eax, eax
jne 0x427772
or eax, eax
je 0x4277bc
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
push esi
call fcn.004010ef
mov word ss:[eax + ebp - 0x104], 0x2e
lea eax, [ebp - 0x104]
push eax
push 0x45eb92
call fcn.0040ccb3
cmp eax, 0xffffffff
je 0x4277c1
mov eax, 0
jmp 0x4277c1
mov eax, 1
pop esi
or eax, eax
jne 0x42787b
mov word [ebp - 0x104], 0x46
push 0x463814
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
lea eax, [ebp - 0x104]
push eax
push 0
push 0x180
push dword [0x45394c]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x10c], eax
push 0x463814
call fcn.00428ce6
cmp eax, 0x1e
jb 0x427817
mov eax, 7
push eax
push dword [ebp - 0x10c]
push 0x19a
push dword [0x45394c]
call sub.user32.dll_SendMessageA
jmp 0x42787b
mov ecx, dword [ebp + 0xc]
lea edx, [0x463814]
dec ecx
dec edx
inc ecx
inc edx
mov al, byte [ecx]
or al, al
je 0x427860
mov ah, byte [edx]
cmp al, 0x61
jb 0x42784f
cmp al, 0x7a
ja 0x42784f
and al, 0x5f
cmp ah, 0x61
jb 0x42785c
cmp ah, 0x7a
ja 0x42785c
and ah, 0x5f
sub al, ah
je 0x42783b
or al, al
jne 0x42787b
push 0x463814
push 0
push 0x180
push dword [0x45394c]
call sub.user32.dll_SendMessageA
push 0x4637e8
push dword [ebp - 0x108]
call sub.kernel32.dll_FindNextFileA
or eax, eax
jne 0x4276c8
push dword [ebp - 0x108]
call sub.kernel32.dll_FindClose
leave
ret 8
Function at 0x427de4
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov ebx, 0x463d32
cmp byte [0x45cb12], 0
je 0x427e51
mov dword [ebx], 0x203126
push 0x45c97e
push ebx
call fcn.004010c5
push ebx
call fcn.004010ef
cmp eax, 0x1a
jbe 0x427e25
mov eax, 0x17
mov dword [eax + ebx], 0x2e2e2e
mov dword [ebp - 0x100], 0x2c502c
lea eax, [ebp - 0x100]
push eax
push ebx
call fcn.004010c5
push 0x45cb12
push ebx
call fcn.004010c5
push ebx
call fcn.004010ef
lea ebx, [eax + ebx + 1]
mov dword [ebx], 0
mov esi, 1
jmp 0x427f22
lea eax, [ebp - 0x100]
push eax
push esi
call fcn.004011b7
push 0x45cc16
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.MRU_Projects
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x100]
push eax
push 0x463932
call fcn.004010a7
push 0x45ca0e
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
push 0x45ca0e
lea eax, [ebp - 0x100]
push eax
call fcn.0040cd48
movzx eax, byte [ebp - 0x100]
or eax, eax
je 0x427f00
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x427f01
push 0x45cb12
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x427efc
dec eax
jmp 0x427efe
xor eax, eax
jmp 0x427f01
dec eax
cmp eax, 0xffffffff
je 0x427f21
push 0x463932
push ebx
call fcn.004010a7
push ebx
call fcn.004010ef
lea ebx, [eax + ebx + 1]
mov dword [ebx], 0
inc esi
cmp esi, 0xa
jb 0x427e61
mov ebx, 0x463d32
mov esi, 1
jmp 0x427f91
lea eax, [ebp - 0x100]
push eax
push esi
call fcn.004011b7
cmp byte [ebx], 0
je 0x427f75
mov al, byte [ebp - 0x100]
mov byte [ebx + 1], al
push 0x45cc16
push ebx
lea eax, [ebp - 0x100]
push eax
push str.MRU_Projects
call sub.kernel32.dll_WritePrivateProfileStringA
push ebx
call fcn.004010ef
lea ebx, [eax + ebx + 1]
jmp 0x427f90
push 0x45cc16
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.MRU_Projects
call sub.kernel32.dll_WritePrivateProfileStringA
inc esi
cmp esi, 0xa
jb 0x427f37
pop esi
pop ebx
leave
ret

Function at 0x42809f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push edi
cmp dword [0x44f32d], 0
je 0x42815f
push 0x45cb12
push 0x40
lea eax, [ebp - 0x40]
push eax
push 0x44ef8c
push str.Menu
push str.MakeDef
call sub.kernel32.dll_GetPrivateProfileStringA
mov edi, 0x4539fc
push edi
mov al, byte [edi + 0x104]
cmp al, 0x4d
jne 0x428150
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040cd48
mov al, byte [ebp - 0x80]
cmp al, 0x31
jne 0x428124
push 0
push dword [edi + 0x109]
push dword [0x4538b4]
call sub.user32.dll_EnableMenuItem
push 1
push dword [edi + 0x109]
push 0x401
push dword [0x4538b8]
call sub.user32.dll_SendMessageA
jmp 0x42814f
push 1
push dword [edi + 0x109]
push dword [0x4538b4]
call sub.user32.dll_EnableMenuItem
push 0
push dword [edi + 0x109]
push 0x401
push dword [0x4538b8]
call sub.user32.dll_SendMessageA
pop eax
pop edi
add edi, 0x115
or al, al
jne 0x4280d7
pop edi
leave
ret
Function at 0x428162
Capabilities:
Set environment variable

Disassembly:
push esi
push edi
mov edi, dword [0x463926]
or edi, edi
je 0x4281af
jmp 0x42818d
mov esi, edi
push esi
call fcn.004010ef
inc eax
add esi, eax
push esi
push edi
call sub.kernel32.dll_SetEnvironmentVariableA
push esi
call fcn.004010ef
inc eax
add esi, eax
mov edi, esi
cmp byte [edi], 0
jne 0x428170
push dword [0x463926]
call sub.kernel32.dll_GlobalUnlock
push dword [0x463926]
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov dword [0x463926], eax
pop edi
pop esi
ret

Function at 0x4281b2
Capabilities:
Query environment variable
Read .ini file
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push edi
call fcn.00428162
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 4], eax
xor edx, edx
jmp 0x4282f7
inc edx
push edx
lea eax, [ebp - 0x44]
push eax
push edx
call fcn.004011b7
push 0x45cd1a
push 0x104
push 0x45ca0e
push 0x44ef8c
lea eax, [ebp - 0x44]
push eax
push str.Environment
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4282f6
lea eax, [ebp - 0x44]
push eax
push 0x45ca0e
call fcn.0040cd48
push 0x45ca0e
call fcn.004010ef
or eax, eax
je 0x428220
dec eax
mov byte [0x46c23e], 0
cmp byte [eax + 0x45ca0e], 0x3b
jne 0x4282a2
push 0x400
push 0x46c23e
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
push 0x45ca0e
push 0x46c23e
call fcn.0040ccb3
inc eax
or eax, eax
jne 0x4282b0
push 0x45ca0e
push 0x46ba3e
call fcn.004010a7
cmp byte [0x46c23e], 0
je 0x428280
push 0x46c23e
push 0x46ba3e
call fcn.004010c5
jmp 0x428292
push 0x46ba3e
call fcn.004010ef
dec eax
mov byte [eax + 0x46ba3e], 0
push 0x46ba3e
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
jmp 0x4282b0
push 0x45ca0e
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [0x463926], 0
jne 0x4282cc
push 0x4000
push 0x40
call fcn.00401030
mov dword [0x463926], eax
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.004010a7
push edi
call fcn.004010ef
inc eax
add edi, eax
push 0x46c23e
push edi
call fcn.004010a7
push edi
call fcn.004010ef
inc eax
add edi, eax
xor eax, eax
inc eax
pop edx
or eax, eax
jne 0x4281cd
push dword [ebp - 4]
call sub.kernel32.dll_FreeEnvironmentStringsA
pop edi
leave
ret
Function at 0x428862
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push 0x45de5e
lea eax, [ebp - 0x122]
push eax
call fcn.004010a7
lea eax, [ebp - 0x122]
push eax
call fcn.004010ef
mov byte ss:[eax + ebp - 0x123], 0
call fcn.00429432
mov eax, dword [0x4538b0]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x122]
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], 0
mov word [ebp - 0xe], 0x444
mov dword [ebp - 0xc], 0
lea eax, [0x44e752]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
cmp dword [ebp - 0xc], 0
jne 0x4288f0
call fcn.00427de4
call fcn.0040ac61
call fcn.0040b024
leave
ret
Function at 0x428eae
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.004011b7
push 0x45cb12
push 0
lea eax, [ebp - 8]
push eax
push str.Group
call sub.kernel32.dll_GetPrivateProfileIntA
or eax, eax
jne 0x428f4e
cmp dword [0x4a32d6], 0
je 0x428f24
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x428eef
cmp eax, 2
jne 0x428ef6
mov eax, 2
jmp 0x428f29
cmp eax, 4
je 0x428f05
cmp eax, 5
je 0x428f05
cmp eax, 6
jne 0x428f0c
mov eax, 3
jmp 0x428f29
cmp eax, 1
je 0x428f16
cmp eax, 0xa
jne 0x428f1d
mov eax, 5
jmp 0x428f29
mov eax, 4
jmp 0x428f29
mov eax, 1
push eax
mov edx, eax
lea eax, [ebp - 0x10]
push eax
push edx
call fcn.004011b7
push 0x45cb12
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push str.Group
call sub.kernel32.dll_WritePrivateProfileStringA
pop eax
leave
ret 8

Function at 0x428f52
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push 0x45de5e
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
mov edx, eax
mov word [ebp - 0x104], 0x34
push 0x45cb12
push 0x80
lea eax, [edx + ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x104]
push eax
push str.MakeFiles
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x428fbe
xor eax, eax
leave
ret
Function at 0x4298f0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push esi
push edi
push 0x45cb12
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x429bba
lea eax, [ebp - 0x120]
push eax
push 0x45de5e
push dword [ebp + 8]
call fcn.0042986b
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x134], 0
cmp dword [ebp + 0x10], 0
je 0x42994e
mov dword [ebp - 0x138], 0x3e9
jmp 0x429958
mov dword [ebp - 0x138], 1
push dword [ebp - 0x138]
call fcn.004275b1
or eax, eax
je 0x429988
mov dword [ebp - 0x134], 0
push eax
push dword [ebp - 0x140]
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4299a3
jmp 0x429bba
inc dword [ebp - 0x134]
cmp dword [ebp - 0x13c], 0
jne 0x4299a3
push dword [ebp - 0x138]
pop dword [ebp - 0x13c]
inc dword [ebp - 0x138]
cmp dword [ebp - 0x134], 0xa
jne 0x429958
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x13c]
call fcn.004011b7
push 0x45cb12
push dword [ebp - 0x140]
lea eax, [ebp - 0x128]
push eax
push 0x44f811
call sub.kernel32.dll_WritePrivateProfileStringA
cmp dword [0x44f369], 0
jne 0x4299fa
push 0x8000
push 0x40
call fcn.00401030
mov dword [0x44f369], eax
push 0x45cb12
push 0x7fff
push dword [0x44f369]
push 0x44f811
call sub.kernel32.dll_GetPrivateProfileSectionA
cmp dword [ebp + 0xc], 0
je 0x429b90
cmp dword [0x45ca02], 0
je 0x429b80
push 0
push 9
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], 4
lea eax, [ebp - 0x168]
push eax
push 0
push 0x110c
push dword [0x453910]
call sub.user32.dll_SendMessageA
cmp dword [ebp - 0x144], 0
jle 0x429ac9
push dword [ebp - 0x164]
push 3
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], 4
lea eax, [ebp - 0x168]
push eax
push 0
push 0x110c
push dword [0x453910]
call sub.user32.dll_SendMessageA
cmp dword [ebp - 0x144], 0
jle 0x429abf
xor edx, edx
jmp 0x429ad1
mov edx, dword [ebp - 0x144]
neg edx
jmp 0x429ad1
mov edx, dword [ebp - 0x144]
neg edx
lea eax, [ebp - 0x130]
push eax
push edx
call fcn.004011b7
push 0x45cb12
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
push str.Group
call sub.kernel32.dll_WritePrivateProfileStringA
push 0
push 0
push 0xb
push dword [0x453910]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
xor edi, edi
push eax
push dword [0x453910]
call fcn.0042b54f
call fcn.0042b43f
push dword [0x453910]
call fcn.0042b7bd
push 0
push dword [0x453910]
call fcn.0042b749
push 0
push 1
push 0xb
push dword [0x453910]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
xor edi, edi
push eax
push dword [0x453910]
call fcn.0042b5c5
jmp 0x429b90
call fcn.0042b43f
push dword [0x453910]
call fcn.0042b7bd
push 0x45de5e
push 0x45cf22
call fcn.004010a7
push dword [ebp - 0x140]
push 0x45cf22
call fcn.004010c5
mov eax, 0
pop edi
pop esi
leave
ret 0xc
mov eax, 1
pop edi
pop esi
leave
ret 0xc
Function at 0x429e7d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push 0x4c
push 0x453998
call sub.kernel32.dll_RtlZeroMemory
mov dword [0x453998], 0x4c
push dword [ebp + 8]
pop dword [0x45399c]
push dword [0x453904]
pop dword [0x4539a0]
mov dword [0x4539c4], 0x45de5e
cmp dword [ebp + 0xc], 0
jne 0x429ee2
mov dword [0x4539a4], 0x44e7cb
mov dword [0x4539d4], 0
mov dword [0x4539c8], 0x44ed7e
jmp 0x429f78
cmp dword [ebp + 0xc], 1
jne 0x429f08
mov dword [0x4539a4], 0x44e97b
mov dword [0x4539d4], 0
mov dword [0x4539c8], 0x44ed9f
jmp 0x429f78
cmp dword [ebp + 0xc], 2
jne 0x429f2e
mov dword [0x4539a4], 0x44e995
mov dword [0x4539d4], 0
mov dword [0x4539c8], 0x44edc0
jmp 0x429f78
cmp dword [ebp + 0xc], 3
jne 0x429f54
mov dword [0x4539a4], 0x44e9ad
mov dword [0x4539d4], 0
mov dword [0x4539c8], 0x44edd2
jmp 0x429f78
cmp dword [ebp + 0xc], 4
jne 0x429f78
mov dword [0x4539a4], 0x4707f2
mov dword [0x4539d4], 0
mov dword [0x4539c8], 0x44edfa
cmp dword [ebp + 0xc], 5
jne 0x429fb0
push 0x4000
push 0x463932
call sub.kernel32.dll_RtlZeroMemory
push 0x104
push 0x463932
push dword [0x4538c4]
call sub.user32.dll_GetWindowTextA
mov dword [ebp + 0xc], 0
mov eax, 1
jmp 0x429fdf
mov dword [0x4539b4], 0x463932
mov byte [0x463932], 0
mov dword [0x4539b8], 0x4000
mov dword [0x4539cc], 0x81a04
push 0x453998
call sub.comdlg32.dll_GetOpenFileNameA
or eax, eax
je 0x42a06d
mov dword [0x45ff6a], 0
mov esi, 0x463932
push esi
call fcn.004010ef
add esi, eax
inc esi
cmp byte [esi], 0
jne 0x42a01a
push 0x463932
push 0x45cf22
call fcn.004010a7
call fcn.0042a086
jmp 0x42a058
jmp 0x42a053
push 0x463932
push 0x45cf22
call fcn.004010a7
push 0x44ef92
push 0x45cf22
call fcn.004010c5
push esi
push 0x45cf22
call fcn.004010c5
push esi
call fcn.004010ef
add esi, eax
inc esi
call fcn.0042a086
cmp byte [esi], 0
jne 0x42a01c
cmp dword [0x45ff6a], 0
je 0x42a081
call fcn.0040f4d4
call fcn.0040f493
jmp 0x42a081
cmp dword [0x4538c8], 0
je 0x42a081
push dword [0x4538c8]
call sub.user32.dll_SetFocus
pop esi
leave
ret 8
Function at 0x42a130
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push 0x45cb12
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42a2dc
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x108], 1
push dword [ebp - 0x108]
call fcn.004275b1
or eax, eax
je 0x42a1cd
push eax
push 0x45de5e
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
pop eax
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x100]
push eax
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFullPathNameA
mov dword [ebp - 0x104], 0
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcmpiA
or eax, eax
je 0x42a217
jmp 0x42a1d3
inc dword [ebp - 0x104]
inc dword [ebp - 0x108]
cmp dword [ebp - 0x104], 0xa
jne 0x42a209
cmp dword [ebp - 0x108], 0x3e9
jae 0x42a20e
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x108], 0x3e9
jmp 0x42a160
jmp 0x42a160
mov eax, 1
leave
ret 4
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x108]
call fcn.004011b7
push 0x45cb12
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push 0x44f811
call sub.kernel32.dll_WritePrivateProfileStringA
push 0x45cb12
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.Group
call sub.kernel32.dll_WritePrivateProfileStringA
push 0x45cb12
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.Size
call sub.kernel32.dll_WritePrivateProfileStringA
push 0x45cb12
push 0x7fff
push dword [0x44f369]
push 0x44f811
call sub.kernel32.dll_GetPrivateProfileSectionA
push dword [0x4a32d2]
push 9
push 0x110a
push dword [0x453910]
call sub.user32.dll_SendMessageA
push eax
push 0
push 0x1101
push dword [0x453910]
call sub.user32.dll_SendMessageA
cmp dword [0x4538c8], 0
je 0x42a2d3
push dword [0x4538c8]
call sub.user32.dll_SetFocus
mov eax, 0
leave
ret 4
cmp dword [0x4538c8], 0
je 0x42a2f0
push dword [0x4538c8]
call sub.user32.dll_SetFocus
mov eax, 1
leave
ret 4
Function at 0x42adde
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push 0x45cb12
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42afcc
push 0x10
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
or eax, eax
je 0x42afcc
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xa4]
call fcn.004011b7
push 0x104
push 0x45cf22
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push dword [ebp + 8]
call sub.user32.dll_IsIconic
or eax, eax
jne 0x42ae47
push dword [ebp + 8]
call sub.user32.dll_IsZoomed
or eax, eax
je 0x42ae73
xor eax, eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0042b008
jmp 0x42aef0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xbc]
push eax
push dword [0x4538c0]
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0xb4]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0xbc]
sub dword [ebp - 0xb4], eax
sub dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xb8]
sub dword [ebp - 0xb0], eax
sub dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0xb4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa0], 0
push 1
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xb4]
call fcn.0040cdd5
push 1
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xb0]
call fcn.0040cdd5
push 1
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xac]
call fcn.0040cdd5
push 0
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
cmp eax, 0xffdd
je 0x42af4b
cmp eax, 0xffdf
jne 0x42af9e
push 1
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xa8]
call fcn.0040cdd5
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.user32.dll_GetWindowLongA
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xc8]
push eax
push 0
push 0x434
push dword [ebp - 0xc0]
call sub.user32.dll_SendMessageA
push 0
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xc8]
call fcn.0040cdd5
jmp 0x42afb2
push 0
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xa8]
call fcn.0040cdd5
push 0x45cb12
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Size
call sub.kernel32.dll_WritePrivateProfileStringA
leave
ret 4
Function at 0x42b008
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
cmp dword [0x44f32d], 0
je 0x42b253
push 0x45cb12
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42b253
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x168], 1
push dword [ebp - 0x168]
call fcn.004275b1
or eax, eax
je 0x42b212
mov dword [ebp - 0x164], 0
push eax
push 0x45de5e
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
pop eax
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x100]
push eax
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetFullPathNameA
lea eax, [ebp - 0x100]
push eax
push 0x45cf22
call fcn.0040ccb3
cmp eax, 0xffffffff
je 0x42b218
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x168]
call fcn.004011b7
push 0x45cb12
push 0x40
lea eax, [ebp - 0x160]
push eax
push 0x44ef8c
lea eax, [ebp - 0x120]
push eax
push str.Size
call sub.kernel32.dll_GetPrivateProfileStringA
mov al, byte [ebp - 0x160]
or al, al
je 0x42b206
cmp dword [0x45c494], 0
je 0x42b206
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x120]
push eax
call fcn.00401168
cmp eax, 0
jge 0x42b132
xor eax, eax
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x120]
push eax
call fcn.00401168
cmp eax, 0
jge 0x42b15e
xor eax, eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x120]
push eax
call fcn.00401168
cmp eax, 0
jge 0x42b18a
xor eax, eax
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x120]
push eax
call fcn.00401168
cmp eax, 0
jge 0x42b1b6
xor eax, eax
mov dword [ebp - 0x178], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x16c]
mov dword [edx], eax
mov eax, dword [ebp - 0x170]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x174]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x178]
mov dword [edx + 0xc], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040cd48
lea eax, [ebp - 0x120]
push eax
call fcn.00401168
mov dword [0x45ffba], eax
mov eax, dword [ebp - 0x168]
leave
ret 4
inc dword [ebp - 0x164]
inc dword [ebp - 0x168]
cmp dword [ebp - 0x164], 0xa
jne 0x42b24e
cmp dword [ebp - 0x168], 0x3e9
jae 0x42b253
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x168], 0x3e9
jmp 0x42b045
jmp 0x42b045
xor eax, eax
leave
ret 4