joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d10ef
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [0x531b44], 1
lea eax, [ebp - 0xc]
push eax
push 0x61
push 0x533134
call fcn.004b25d4
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d1135
jmp 0x4d12a5
push 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004d0d2d
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d12a5
cmp dword [ebp - 0x14], 0
je 0x4d129e
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4d1195
mov dword [ebp - 0x14], 0
jmp 0x4d119c
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x4d1299
cmp dword [ebp + 8], 2
jne 0x4d1299
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x1de], 0
je 0x4d128f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1e6]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1de]
push eax
push 9
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4d126b
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x1de], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x1e6], 0
push 0
push 0xffffffffffffffff
push 0x6c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00462894
add esp, 0x14
push 0
push 0xffffffffffffffff
push 0x6a
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00462894
add esp, 0x14
push 0
push 0xffffffffffffffff
push 0x6e
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00462894
add esp, 0x14
jmp 0x4d1281
push 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1de]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4d12a5
mov dword [ebp - 0x10], 1
mov dword [0x531b44], 0
cmp dword [ebp - 0x10], 0
je 0x4d12e3
push 0
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4d12e3
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x4d12f7
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x4d130b
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d2098
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 8], 0
call fcn.004e3d0e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4d20d2
mov eax, 1
jmp 0x4d2261
push 5
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d20f5
mov eax, 1
jmp 0x4d2261
push 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4d2118
mov eax, 1
jmp 0x4d2261
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x66
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x26]
push eax
call fcn.0047a899
add esp, 0xc
push 0
mov eax, dword [ebp - 0x30]
push eax
push 0x66
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x32]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 0x24]
push eax
call fcn.004ae123
add esp, 0x14
test eax, eax
je 0x4d2186
cmp dword [ebp - 0x30], 0
jne 0x4d2186
mov dword [ebp - 0x30], 1
push 0
mov eax, dword [ebp - 0x30]
push eax
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
cmp dword [ebp - 0x30], 0
je 0x4d220d
mov eax, dword [ebp - 0x2c]
shr eax, 0x10
and eax, 0xffff
movsx eax, ax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 0x65
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x26]
push eax
call fcn.00476b89
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4d220d
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004d1f51
add esp, 8
mov dword [ebp - 0x38], eax
push 0
mov eax, dword [ebp - 0x28]
push eax
push 0x6a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
mov eax, dword [ebp - 0x38]
push eax
push 0x6c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e2270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push esi
push edi
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
lea eax, [ebp - 0x31c]
push eax
push 0x6a6
call fcn.004e3fc4
add esp, 8
lea eax, [ebp - 0x10c]
push eax
push 0x6a5
call fcn.004e3fc4
add esp, 8
push 0
mov eax, dword [0x5334e8]
push eax
push 0x66
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
mov eax, dword [0x5334e8]
push eax
push 0x69
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
mov eax, dword [0x5334ec]
push eax
push 0x6d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
cmp dword [0x5334f0], 0
je 0x4e232d
push 0
mov eax, dword [0x5334f0]
push eax
push 0xcb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
mov eax, dword [0x5334f4]
push eax
push 0xca
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
lea eax, [ebp - 0x214]
push eax
push 0x105
push 0xd
mov eax, dword [0x5334e4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x214]
push eax
push 0x6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x5334f8]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x4e23ec
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004e4014
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x328]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4e23f3
mov byte [ebp - 0x31c], 0
lea eax, [ebp - 0x31c]
push eax
push 0x6c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [0x533500], 0
jne 0x4e241f
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
jmp 0x4e2430
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e27a6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x4e29fc
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
push 0
push 0x410
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x52c774]
mov eax, dword [eax + 0x18]
push eax
push 0x413
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [0x52c774]
cmp dword [eax + 0x20], 1
sbb eax, eax
neg eax
push eax
push 0x42e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [0x52c774]
mov eax, dword [eax + 0x20]
push eax
push 0x42f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
mov eax, dword [0x52c774]
mov eax, dword [eax + 0x24]
push eax
push 0x48f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
mov eax, dword [0x52c774]
mov eax, dword [eax + 0x28]
push eax
push 0x48e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x4e2a1b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004e58b1
add esp, 0x14
mov eax, dword [ebp - 0xc]
and eax, 0xffff
mov dword [ebp - 0x18], eax
jmp 0x4e29b1
push 0x40
call fcn.004bb488
add esp, 4
jmp 0x4e29f2
mov eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
jmp 0x4e2928
push 0x413
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ecx, dword [0x52c774]
mov dword [ecx + 0x18], eax
push 0x42f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ecx, dword [0x52c774]
mov dword [ecx + 0x20], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0x48f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov ecx, dword [0x52c774]
mov dword [ecx + 0x24], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0x48e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov ecx, dword [0x52c774]
mov dword [ecx + 0x28], eax
xor eax, eax
jmp 0x4e2a22
cmp dword [ebp - 0x1c], 0
je 0x4e28ab
jmp 0x4e2937
jmp 0x4e29f2
mov eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 0x20], eax
jmp 0x4e2960
mov dword [0x5334d8], 1
jmp 0x4e296f
cmp dword [ebp - 0x20], 1
je 0x4e294c
jmp 0x4e296f
jmp 0x4e29f2
mov eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 0x24], eax
jmp 0x4e2998
push 0x40
call fcn.004bb488
add esp, 4
jmp 0x4e29a7
cmp dword [ebp - 0x24], 0
je 0x4e2984
jmp 0x4e29a7
jmp 0x4e29f2
cmp dword [ebp - 0x18], 0x40e
jg 0x4e29d3
je 0x4e2974
cmp dword [ebp - 0x18], 1
je 0x4e289b
jmp 0x4e29f2
cmp dword [ebp - 0x18], 0x470
je 0x4e293c
cmp dword [ebp - 0x18], 0x7531
je 0x4e288c
jmp 0x4e29f2
jmp 0x4e2a1b
cmp dword [ebp - 0x14], 0x110
je 0x4e27ba
cmp dword [ebp - 0x14], 0x111
je 0x4e2860
jmp 0x4e2a1b
xor eax, eax
jmp 0x4e2a22
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4e483d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 4], 3
mov dword [ebp - 8], 0x80000000
mov dword [ebp - 0x20], pe_nt_image_headers32
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], 0x200
jne 0x4e4883
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xffffffff
jmp 0x4e4919
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
and eax, 2
mov ecx, dword [ebp + 0x10]
and ecx, 1
or eax, ecx
je 0x4e48b3
or dword [ebp - 8], 0x40000000
cmp dword [ebp + 0x10], 0x1000
jne 0x4e48cc
mov dword [ebp - 4], 1
jmp 0x4e48dd
test byte [ebp + 0x11], 0x10
je 0x4e48dd
mov dword [ebp - 4], 4
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4e4911
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
jmp 0x4e4919
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f7376
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
cmp dword [ebp + 0x14], 0xffffffff
jne 0x4f739e
push 0xa
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4f73b5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0x148
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
call fcn.00523124
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 0xc], eax
jl 0x4f73de
cmp dword [ebp - 0x10], 0
jge 0x4f741e
cmp dword [ebp - 0x10], 0
jge 0x4f73f4
mov dword [ebp - 0x10], 0
jmp 0x4f73fa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0x5338fc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x4f742d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x505a49
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x533a28
push 0xf
push str.DigsPrePosExp
push 0x533a44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c820], eax
cmp dword [0x52c820], 1
jge 0x505a87
mov dword [0x52c820], 1
jmp 0x505aa1
cmp dword [0x52c820], 0xc8
jle 0x505aa1
mov dword [0x52c820], 0xc8
mov eax, dword [0x52c820]
push eax
call fcn.00506158
add esp, 4
fstp qword [0x52c7f0]
push 0x533a50
push 8
push str.DigsPreNegExp
push 0x533a6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c800], eax
cmp dword [0x52c800], 1
jge 0x505aed
mov dword [0x52c800], 1
jmp 0x505b07
cmp dword [0x52c800], 0xc8
jle 0x505b07
mov dword [0x52c800], 0xc8
mov eax, dword [0x52c800]
neg eax
push eax
call fcn.00506158
add esp, 4
fstp qword [0x52c830]
push 0x533a78
push 0
push str.UseNegExp
push 0x533a90
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c7f8], eax
push 0x533a9c
push 0
push str.AlwaysUseExp
push 0x533ab8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c838], eax
push 0x533ac4
push 0
push str.OverrideDecDigs
push 0x533ae0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c828], eax
push 0x533aec
push 0xf
push str.NumOverrideDecDigs
push str.AMOUNTEDIT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52c83c], eax
cmp dword [0x52c83c], 0
jge 0x505ba9
mov dword [0x52c83c], 0
jmp 0x505bc0
cmp dword [0x52c83c], 0xf
jle 0x505bc0
mov dword [0x52c83c], 0xf
xor eax, eax
jmp 0x505bc7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51880e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x533e1c
push 0
push str.SuppressAutoRecalc
push 0x533e3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x533e18], eax
call fcn.0051891f
test eax, eax
je 0x5188ea
push 0x533e44
push 1
push 0x533e50
push 0x533e5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x518893
jmp case.default.0x5188a3
mov eax, dword [ebp - 4]
push eax
call fcn.00523f29
add esp, 4
jmp case.default.0x5188a3
call fcn.00518f83
push eax
call fcn.00523f29
add esp, 4
jmp case.default.0x5188a3
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
ja case.default.0x5188a3
mov eax, dword [ebp - 0xc]
jmp dword [eax*4 + 0x5188aa]
cmp dword [ebp - 8], 1
jne 0x5188ea
push 0x533e64
push 1
push 0x533e70
push 0x533e78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00523f29
add esp, 4
xor eax, eax
jmp 0x5188f1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x51891f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x533e80
push 0
push str.EnableQA
push 0x533e98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x518953
xor eax, eax
jmp 0x51895d
mov eax, 1
jmp 0x51895d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51b40c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push 0x534104
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0x534110
lea eax, [ebp - 0x21c]
push eax
push str.OLESETCOLORMAP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x110], 0
jle 0x51b525
mov eax, dword [ebp - 0x110]
push eax
push 0x2c
mov eax, dword [ebp - 0x224]
push eax
call fcn.00523154
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x51b4be
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x224]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x51b4ca
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x224]
push eax
call fcn.00523124
add esp, 4
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp + 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0x228]
cmp dword [ebp - 0x228], 0xff
jl 0x51b500
jmp 0x51b525
mov eax, dword [ebp - 0x220]
inc eax
add dword [ebp - 0x224], eax
xor eax, eax
mov ecx, dword [ebp - 0x220]
inc ecx
sub eax, ecx
neg eax
sub dword [ebp - 0x110], eax
jmp 0x51b472
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 0x228], 0
jne 0x51b5aa
push 0x534124
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x51b5aa
mov dword [ebp - 0x114], 0
jmp 0x51b56c
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0x10
jge 0x51b597
mov eax, dword [ebp - 0x114]
mov eax, dword [eax*4 + 0x534080]
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0xc]
mov dword [edx + ecx*4], eax
jmp 0x51b566
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x10
mov eax, 0x10
jmp 0x51b5b5
mov eax, dword [ebp - 0x228]
jmp 0x51b5b5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x523660
Capabilities:
Move file

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x52367d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x523691
push eax
call fcn.00526021
add esp, 4
mov eax, 0xffffffff
jmp 0x523693
xor eax, eax
ret

Function at 0x523f8a
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5306d0
push 0x5279f8
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x535158], eax
mov al, ah
and eax, 0xff
mov dword [0x535164], eax
mov eax, dword [0x535158]
shr dword [0x535158], 0x10
and eax, 0xff
mov dword [0x535160], eax
shl eax, 8
add eax, dword [0x535164]
mov dword [0x53515c], eax
call fcn.0052794b
mov dword [ebp - 4], 0
call fcn.0052785d
call fcn.00525e97
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x52f1b8], eax
call fcn.005275fd
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x534860], eax
call fcn.00527532
call fcn.005273fe
mov esi, dword [0x52f1b8]
mov al, byte [esi]
cmp al, 0x22
je 0x52403e
cmp al, 0x20
jbe 0x52406a
inc esi
cmp byte [esi], 0x20
ja 0x524036
jmp 0x52406a
inc esi
cmp byte [esi], 0x22
je 0x524069
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x524064
movzx eax, bl
push eax
call fcn.005274ef
add esp, 4
test eax, eax
je 0x52405e
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x524047
cmp byte [esi], 0x22
jne 0x52406a
inc esi
cmp byte [esi], 0
je 0x52407a
cmp byte [esi], 0x20
ja 0x52407a
inc esi
cmp byte [esi], 0
jne 0x52406f
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x52409a
movzx eax, word [ebp - 0x40]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0052742e
jmp 0x5240d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x527450
Capabilities:
Terminate process

Disassembly:
mov dword [0x535190], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x53518c], bl
jne 0x5274ac
cmp dword [0x52f1b4], 0
je 0x52749a
mov esi, dword [0x52f1b0]
sub esi, 4
cmp dword [0x52f1b4], esi
ja 0x52749a
mov eax, dword [esi]
test eax, eax
je 0x52748f
call eax
sub esi, 4
cmp dword [0x52f1b4], esi
jbe 0x527487
push 0x535de4
push 0x535ddc
call fcn.005274cf
add esp, 8
push 0x535dec
push 0x535de8
call fcn.005274cf
add esp, 8
test ebx, ebx
jne 0x5274cc
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x52827e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x410
cmp eax, dword [0x535198]
push ebx
push esi
push edi
jb 0x5282b4
mov dword [0x53514c], 9
mov dword [0x535150], 0
mov eax, 0xffffffff
jmp 0x528410
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], esi
jne 0x5282c5
xor eax, eax
jmp 0x528410
mov eax, dword [ebp + 8]
test byte [eax + 0x5351a0], 0x20
je 0x5282de
push 2
push 0
push eax
call fcn.00528417
add esp, 0xc
mov eax, dword [ebp + 8]
test byte [eax + 0x5351a0], 0x80
je 0x528368
mov dword [ebp - 0xc], 0
mov edi, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x5283a0
lea ebx, [ebp - 0x410]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x528332
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x52831e
inc esi
mov byte [ebx], 0xd
inc ebx
lea ecx, [ebp - 0x410]
mov byte [ebx], al
inc ebx
mov eax, ebx
sub eax, ecx
cmp eax, 0x400
jl 0x528308
lea eax, [ebp - 0x410]
push 0
sub ebx, eax
lea ecx, [ebp - 0x410]
lea eax, [ebp - 4]
push eax
push ebx
push ecx
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x5351e0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x528397
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
cmp eax, ebx
jge 0x5282f4
jmp 0x5283a0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax*4 + 0x5351e0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x528397
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x5283a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x52840b
cmp dword [ebp - 0xc], 0
je 0x5283d8
cmp dword [ebp - 0xc], 5
jne 0x5283c6
mov dword [0x53514c], 9
mov eax, dword [ebp - 0xc]
mov dword [0x535150], eax
jmp 0x5283d1
push dword [ebp - 0xc]
call fcn.00526021
add esp, 4
mov eax, 0xffffffff
jmp 0x528410
mov eax, dword [ebp + 8]
test byte [eax + 0x5351a0], 0x40
je 0x5283f0
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x5283f0
xor eax, eax
jmp 0x528410
mov dword [0x53514c], 0x1c
mov dword [0x535150], 0
mov eax, 0xffffffff
jmp 0x528410
mov eax, dword [ebp - 8]
sub eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret