joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47dd60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x5b5698]
sub esp, 0x208
cmp eax, 1
push esi
jne 0x47dd86
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, 2
pop esi
add esp, 0x208
ret
mov eax, dword [0x5b5510]
test eax, eax
je 0x47de80
lea eax, [esp + 4]
push 8
push eax
push 0x5b96e0
call fcn.004c93e0
add esp, 0xc
call fcn.0047c1b0
test eax, eax
jne 0x47ddda
push 0x5b96e0
call fcn.004381b0
add esp, 4
test eax, eax
jne 0x47de80
lea ecx, [esp + 4]
push ecx
call fcn.004d6713
add esp, 4
test eax, eax
jne 0x47de80
push 0x5b9260
push 0
push str.SaveChanges
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x47de80
mov esi, dword [esp + 0x210]
test esi, esi
je 0x47de23
mov edx, dword [0x5b5528]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x47de23
mov eax, dword [0x5b5528]
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5b5574]
push 0x80
push 0x5b6fc0
push 0x4e82
push ecx
mov dword [0x5b5698], 1
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x23
push 0x5b96a0
push 0x5b6fc0
push 0
call fcn.0047da80
add esp, 4
push eax
call fcn.00446950
add esp, 0x10
cmp eax, 6
mov dword [0x5b5698], 0
jne 0x47de97
push esi
call fcn.0047dc50
add esp, 4
mov dword [0x5b5698], 0
mov eax, 1
pop esi
add esp, 0x208
ret
cmp eax, 2
jne 0x47de80
pop esi
add esp, 0x208
ret

Function at 0x47e360
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
push esi
xor esi, esi
cmp word [0x5b9040], si
je 0x47e49f
cmp dword [0x5b569c], 1
jne 0x47e391
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
pop esi
add esp, 0x210
ret
lea eax, [esp + 4]
push 0x5b9040
push eax
mov dword [0x5b569c], 1
call fcn.004d631b
add esp, 8
lea ecx, [esp + 4]
push ecx
push 0x46a480
push 1
call fcn.0047da80
mov edx, dword [0x5b5574]
add esp, 4
push eax
push 0x55c
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x47e490
lea eax, [esp + 4]
push 0x5b9040
push eax
call fcn.004d7652
add esp, 8
cmp eax, esi
mov eax, dword [0x5b5628]
jne 0x47e43a
cmp eax, esi
jne 0x47e43e
mov eax, dword [esp + 0x218]
mov dword [0x5b5648], esi
cmp eax, esi
je 0x47e47d
mov ecx, dword [0x5b54fc]
push esi
push esi
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
mov dword [0x5b569c], esi
mov dword [0x5b5648], eax
mov eax, 1
pop esi
add esp, 0x210
ret
cmp eax, esi
je 0x47e45a
push 0x5b9260
push 9
push str.FileSortOrder
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x59f744], eax
lea edx, [esp + 4]
push edx
call fcn.004d7731
push esi
push 1
push 1
mov dword [0x5b5628], esi
call fcn.00477270
add esp, 0x10
mov dword [0x5b5648], esi
mov dword [0x5b569c], esi
mov eax, 1
pop esi
add esp, 0x210
ret
push esi
call fcn.004c25a0
add esp, 4
mov dword [0x5b569c], esi
xor eax, eax
pop esi
add esp, 0x210
ret
Function at 0x47e5d0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x47e600
cmp dword [0x5b55a4], 1
jle 0x47e600
mov eax, dword [esp + 0x10]
mov ecx, dword [0x5b5528]
push 0
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x47e66b
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x47e66b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47e64e
mov edx, dword [esp + 0x10]
mov eax, dword [0x5b5528]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edx
push 0x111
push eax
call esi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 8]
and ecx, 0xffff
push 0
push ecx
push 0x115
push edx
call esi
pop esi
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
and eax, 0xffff
push 0
push eax
push 0x115
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
ret
mov eax, dword [esp + 0xc]
push 0
test eax, eax
je 0x47e68c
mov edx, dword [esp + 0x14]
mov eax, dword [0x5b5528]
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [0x5b5528]
push ecx
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
ret
Function at 0x47e6b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [0x5b5528]
sub esp, 0x218
push esi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x47e6d6
mov ecx, dword [0x5b5528]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x5b5528]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x228]
test eax, eax
je 0x47e6f8
mov dword [0x5b5628], 0
push 0x5b96e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47e730
mov eax, dword [0x5b5574]
push 1
push 0
push 0x5b96e0
push 0
push 0x511
push eax
call fcn.004cc7f0
add esp, 0x18
xor eax, eax
pop esi
add esp, 0x218
ret
and eax, 0x10
cmp al, 0x10
jne 0x47e7a9
push 0x5b96e0
call fcn.004d7731
push 0
push 1
push 1
mov dword [0x5b5628], 0
call fcn.00477270
mov ecx, dword [0x5b5528]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
push 0
push 0x43e
push 0x111
push ecx
call esi
mov edx, dword [0x5b554c]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x47e8f4
push eax
mov eax, dword [0x5b5528]
push 0x49a
push 0x111
push eax
call esi
mov eax, 1
pop esi
add esp, 0x218
ret
lea ecx, [esp + 0x14]
push 3
push ecx
push 0x5b96e0
call fcn.004c93e0
mov edx, dword [esp + 0x20]
and edx, 0xffff
push edx
call fcn.004d84d0
sub eax, 0x40
add esp, 0x10
cmp eax, 1
jl 0x47e7e3
cmp eax, 0x1a
jg 0x47e7e3
push eax
call fcn.004d80c5
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.004d7731
lea ecx, [esp + 0x18]
push 0x5b9040
push ecx
call fcn.004d7652
add esp, 0xc
test eax, eax
jne 0x47e81c
mov edx, dword [0x5b54fc]
push 0x5b96e0
push edx
call fcn.00474f70
add esp, 8
mov dword [0x5b5648], eax
push 0
push 1
push 0
push 0x5b55a0
push 0x5b55b0
push 0
push 0x59f718
push 0
push 0
push 0
push 1
push 0
push 1
push 0
push 0
push 1
push 0x5b96e0
call fcn.004a86a0
add esp, 0x44
mov dword [0x5b5510], eax
test eax, eax
jne 0x47e882
mov eax, dword [0x5b5568]
test eax, eax
jne 0x47e882
push 0
push 0
call fcn.0047a580
add esp, 8
call fcn.0047dbe0
mov eax, 1
pop esi
add esp, 0x218
ret
mov eax, dword [esp + 0x220]
mov dword [eax], 0
mov eax, dword [esp + 0x224]
test eax, eax
je 0x47e8db
mov ecx, dword [0x5b5510]
lea edx, [esp + 4]
push ecx
push edx
call fcn.004c85c0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub esp, 8
mov eax, esp
push 0
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0x5b5510]
push eax
call fcn.004199f0
add esp, 0x18
push 0x11
push 1
push 1
push 1
push 1
push 1
call fcn.004788e0
add esp, 0x18
call fcn.0047dbe0
mov eax, 1
pop esi
add esp, 0x218
ret
Function at 0x47e910
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 1
mov eax, dword [0x5b5648]
dec eax
cmp eax, 0xffffffff
mov dword [0x5b5648], eax
jg 0x47e934
mov dword [0x5b5648], 0xffffffff
push 2
call fcn.004c25a0
add esp, 4
push 0x5b9260
push 0
push str.JumpAfterDelete
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x47e987
call fcn.0047c0e0
push 2
call fcn.004c25a0
mov ecx, dword [0x5b5528]
add esp, 4
push 0
push 0x465
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x47e990
Capabilities:
Log keystrokes via polling
Read .ini file

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push 0x5b9260
push 1
push str.AskDelete
push str.Others
mov dword [esp + 0x20], 0
call esi
push 0x5b9260
push 1
push str.DelToRecycle
push str.Others
mov ebx, eax
call esi
push 0x5b9260
push 0
push str.DelSideCars
push str.Others
mov ebp, eax
call esi
push 0x10
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x47e9f3
xor ebp, ebp
mov edx, dword [esp + 0x40]
test ebx, ebx
jne 0x47ea28
test ebp, ebp
jne 0x47ea28
test esi, esi
jne 0x47ea28
cmp edx, 1
jne 0x47ea28
mov eax, dword [esp + 0x3c]
push eax
call fcn.004d7368
add esp, 4
test eax, eax
je 0x47eb24
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x38]
stosw word es:[edi], ax
xor edi, edi
mov dword [esp + 0x14], ecx
cmp ebx, edi
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], edi
mov word [esp + 0x24], 4
jne 0x47ea5f
mov word [esp + 0x24], 0x14
cmp ebp, edi
je 0x47ea68
or byte [esp + 0x24], 0x40
cmp esi, edi
mov dword [esp + 0x26], edi
jne 0x47ea76
mov edx, dword [esp + 0x3c]
jmp 0x47ea9d
mov eax, dword [esp + 0x3c]
push edi
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004cbb00
add esp, 0x10
cmp eax, 0xffffffff
jne 0x47ea99
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], edx
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x47eaee
cmp eax, edi
je 0x47ead6
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x10]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x26]
xor eax, eax
cmp ecx, 1
pop edi
setne al
pop esi
pop ebp
lea eax, [eax + eax - 3]
pop ebx
add esp, 0x24
ret
cmp eax, edi
je 0x47eb10
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [esp + 0x10]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x26], 1
jne 0x47eb24
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x24
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x47eb30
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x418]
cmp word [esi], 0
jne 0x47eb4f
or eax, 0xffffffff
pop esi
add esp, 0x410
ret
push str.Admin_EnableDelete
push str.Others
call fcn.004c56d0
add esp, 8
test eax, eax
jne 0x47eb78
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
or eax, 0xffffffff
pop esi
add esp, 0x410
ret
push esi
call fcn.004381b0
add esp, 4
test eax, eax
jne 0x47eba8
push 1
push eax
push esi
push eax
mov eax, dword [0x5b5574]
push 0x511
push eax
call fcn.004cc7f0
add esp, 0x18
or eax, 0xffffffff
pop esi
add esp, 0x410
ret
push edi
push 1
call fcn.00437cd0
push 0
call fcn.00476530
add esp, 8
call fcn.00476500
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 8]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004d631b
lea edx, [esp + 0x10]
push edx
call fcn.004d6713
add esp, 0xc
mov word [esp + eax*2 + 0xa], 0
lea eax, [esp + 8]
push 1
push eax
push 1
call fcn.0047da80
add esp, 4
push eax
call fcn.0047e990
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
pop edi
jne 0x47ec32
mov ecx, dword [0x5b5574]
push 0
push 0
push 0
push 0
push 0x4f8
push ecx
call fcn.004cc7f0
add esp, 0x18
mov eax, esi
pop esi
add esp, 0x410
ret

Function at 0x48bde0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
push 0
push 0x5b96a0
call esi
test eax, eax
je 0x48be81
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 0
push str.OneInstance
push str.Others
call edi
cmp eax, 1
jne 0x48be81
push 0x5b9260
push 0
push str.SaveChanges
push str.Others
call edi
push 0
push 0x5b96a0
test eax, eax
je 0x48be4d
call esi
push 0
push 0x438
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
ret
call esi
test eax, eax
je 0x48be81
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x438
push 0x111
push eax
call edi
push 0x14
call ebx
push 0
push 0x5b96a0
call esi
test eax, eax
jne 0x48be60
pop ebx
pop edi
pop esi
ret
Function at 0x48cf70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa28
lea eax, [esp + 0x208]
push ebx
push ebp
mov ebp, dword [esp + 0xa34]
push esi
mov esi, dword [esp + 0xa3c]
push edi
push 0
push 0x104
push eax
push esi
push ebp
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov edi, dword [esp + 0xa44]
test edi, edi
je 0x48cffc
lea ecx, [esp + 0x218]
push 9
push ecx
call fcn.004d75ed
add esp, 8
test eax, eax
je 0x48cffc
lea edx, [esp + 0x218]
xor ecx, ecx
sub eax, edx
sar eax, 1
test eax, eax
setle cl
dec ecx
and ecx, eax
lea eax, [esp + 0x10]
lea edx, [esp + ecx*2 + 0x218]
push edx
push eax
call fcn.004d631b
lea ecx, [esp + 0x18]
lea edx, [esp + 0x220]
push ecx
push edx
call fcn.004d631b
add esp, 0x10
mov ebx, dword [esp + 0xa4c]
lea eax, [esp + 0x10]
and ebx, 0xffff
push ebx
push 0x5a08d4
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x224]
push ecx
push edx
call fcn.004d6acd
add esp, 0x14
test eax, eax
jne 0x48d0b0
mov ecx, dword [esp + 0xa48]
push 0x5b9260
lea eax, [esp + 0x14]
push 0x104
push eax
push 0x5aae60
push ecx
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test edi, edi
je 0x48d082
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
lea ecx, [esp + 0x42c]
push str.__c___s__s
push ecx
call fcn.004d5ee1
add esp, 0x14
jmp 0x48d09d
lea edx, [esp + 0x10]
lea eax, [esp + 0x420]
push edx
push ebx
push str.__c___s
push eax
call fcn.004d5ee1
add esp, 0x10
lea ecx, [esp + 0x420]
push ecx
push esi
push 0
push esi
push ebp
call dword [sym.imp.USER32.dll_ModifyMenuW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa28
ret

Function at 0x48d110
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push 1
push esi
call fcn.004c94a0
push str.Adobe_8BF
push esi
call fcn.004d62f1
mov eax, dword [esp + 0x224]
add esp, 0x10
test eax, eax
jne 0x48d198
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004d6c3f
add esp, 0xc
lea ecx, [esp + 8]
push 0x5b9260
push 0x104
push esi
push ecx
push str.8BFPath
push str.Plugins
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
pop edi
jne 0x48d198
lea edx, [esp + 4]
push 0x104
push edx
push esi
call fcn.004d6c3f
add esp, 0xc
push esi
call fcn.004c9990
add esp, 4
pop esi
add esp, 0x208
ret
Function at 0x48d1b0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x868
push ebx
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esp + 0x45c]
push 0
push eax
call fcn.0048d110
lea ecx, [esp + 0x464]
push str..8bf
push ecx
call fcn.004d62f1
add esp, 0x10
lea edx, [esp + 0x20c]
lea eax, [esp + 0x45c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48d30a
push ebp
mov ebp, dword [sym.imp.USER32.dll_AppendMenuW]
push esi
push edi
mov edi, dword [esp + 0x87c]
xor esi, esi
test byte [esp + 0x218], 0x12
jne 0x48d2cc
lea ecx, [esp + 0x10]
push 4
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.004c93e0
lea eax, [esp + 0x1c]
push str.Perspective
push eax
call fcn.004d7652
add esp, 0x14
test eax, eax
je 0x48d2cc
lea ecx, [esp + 0x10]
push str.Smartcurve
push ecx
call fcn.004d7652
add esp, 8
test eax, eax
je 0x48d2cc
lea edx, [esp + 0x10]
push str.HarrysFilters
push edx
call fcn.004d7652
add esp, 8
test eax, eax
je 0x48d2cc
lea eax, [esp + 0x10]
push 0x5a06a0
push eax
call fcn.004d7652
add esp, 8
test eax, eax
je 0x48d2cc
lea ecx, [esp + 0x10]
push str.Wireworm
push ecx
call fcn.004d7652
add esp, 8
test eax, eax
je 0x48d2cc
lea edx, [esp + 0x244]
lea eax, [esi + 0x4a83]
push edx
push eax
push 0
push edi
inc esi
call ebp
cmp esi, 0x1e
jge 0x48d2e3
lea eax, [esp + 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48d222
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x5b561c]
push ecx
push edi
call fcn.00446320
mov edx, dword [0x5b5528]
add esp, 8
push edx
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop edi
pop esi
pop ebp
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop ebx
add esp, 0x868
ret
Function at 0x48f330
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [esp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, dword [esp + 0x10]
push edi
mov edx, eax
mov word [esi], 0
call fcn.0048ee50
add esp, 4
test eax, eax
je 0x48f363
or dh, 1
mov eax, dword [esp + 0x14]
push eax
push esi
shl edx, 0x10
push edx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push esi
call fcn.004d6713
mov edi, eax
add esp, 4
cmp edi, 1
jle 0x48f39a
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
sub ecx, esi
sar ecx, 1
sub edi, ecx
push edi
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48f3b0
push 0x5a0ae4
push esi
call fcn.004d62f1
add esp, 8
mov edx, dword [esp + 0x1c]
push esi
push edx
call fcn.004d62f1
add esp, 8
pop edi
pop esi
ret
Function at 0x48fbb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa4c
mov ecx, 0x110
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x61c]
push 0x5b9260
rep stosd dword es:[edi], eax
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push 0x1fe
push eax
push 0x5aae60
push str.ChangedHotkeys
push 0x5a09b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x598e0c
lea ecx, [esp + 0x220]
push 0x200
push ecx
call fcn.004c9b60
lea edx, [esp + 0x228]
push 0x7c
push edx
call fcn.004c9a70
mov ebp, dword [esp + 0xa74]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jle 0x48fd14
xor esi, esi
test ebx, ebx
jle 0x48fd14
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x9c]
push 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0xa0]
push 0x7c
push eax
lea ecx, [esp + 0x228]
push esi
push ecx
call fcn.004c9ab0
lea edx, [esp + 0xb0]
push edx
call fcn.004d6713
add esp, 0x18
test eax, eax
jle 0x48fd0b
lea eax, [esp + 0x9c]
lea ecx, [esp + 0x1c]
push eax
push 0x5a0b08
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x28]
lea eax, [esp + 0x128]
push edx
push eax
call fcn.004d631b
mov ecx, ebp
lea edx, [esp + 0x30]
and ecx, 0xffff
push ecx
push str._d_
push edx
call fcn.004d5ee1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x13c]
push eax
push ecx
call fcn.004d6acd
add esp, 0x28
test eax, eax
jne 0x48fd0b
lea edx, [esp + 0x9c]
lea eax, [esp + 0x1c]
push edx
push 0x5a0b08
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x28]
lea edx, [esp + 0x628]
push ecx
push edx
call fcn.004d62f1
add esp, 0x14
inc esi
cmp esi, ebx
jl 0x48fc43
mov esi, dword [esp + 0xa64]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x12]
push eax
push ecx
push esi
call fcn.0048f060
lea edx, [esp + 0x24]
mov ecx, ebp
push 0
lea eax, [esp + 0x26]
push edx
and ecx, 0xffff
push eax
push ecx
call fcn.0048f540
mov ax, word [esp + 0x32]
add esp, 0x1c
cmp bp, 0x4b4
jne 0x48fd5c
cmp ax, 0xbb
je 0x48fd69
jmp 0x48fd6e
cmp bp, 0x4b5
jne 0x48fd6e
cmp ax, 0xbd
jne 0x48fd6e
or dword [esp + 0x18], 1
cmp word [esp + 0x12], ax
jne 0x48fd81
mov dx, word [esp + 0x18]
cmp word [esp + 0x14], dx
je 0x48fd98
push esi
lea eax, [esp + 0x20]
push ebp
lea ecx, [esp + 0x624]
push eax
push ecx
call fcn.0048fb70
add esp, 0x10
lea edx, [esp + 0x61c]
push 0x5b9260
push edx
push str.ChangedHotkeys
push 0x5a09b8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4c
ret
Function at 0x48ffb0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x490
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetMenu]
push esi
push edi
push eax
call ebp
mov esi, eax
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0xa0]
rep stosd dword es:[edi], eax
push 0x5b9260
lea ecx, [esp + 0xa4]
push 0x1fe
push ecx
push 0x5aae60
push str.ChangedHotkeys
push 0x5a09b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0xa0]
push edx
call fcn.004d6713
add esp, 4
test eax, eax
jle 0x49015c
push 0x598e0c
lea eax, [esp + 0xa4]
push 0x200
push eax
xor ebx, ebx
call fcn.004c9b60
lea ecx, [esp + 0xac]
push 0x7c
push ecx
call fcn.004c9a70
add esp, 0x14
cmp eax, ebx
mov dword [esp + 0x1c], eax
jle 0x49015c
mov dword [esp + 0x14], ebx
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x20]
push 0x3f
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push 0x7c
push edx
lea ecx, [esp + 0xac]
push eax
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x34]
push edx
call fcn.004d6713
add esp, 0x18
test eax, eax
jle 0x490130
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x28]
push 0x5a0b30
push edx
call fcn.004d6c09
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp ax, 0x4ae7
jb 0x490105
cmp ax, 0x4af6
ja 0x490105
test ebx, ebx
jne 0x490105
push ebx
push ebx
and eax, 0xffff
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuStringW]
test eax, eax
jne 0x490101
mov ecx, dword [esp + 0x4ac]
push 1
push eax
push eax
mov eax, dword [esp + 0x4b4]
push eax
push ecx
call fcn.0048dd70
mov edx, dword [esp + 0x4b8]
add esp, 0x14
push edx
call ebp
mov esi, eax
mov ebx, 1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ecx
push eax
push esi
call fcn.0048ff40
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x5b554c]
add esp, 0xc
push edx
push eax
push ecx
call ebp
push eax
call fcn.0048ff40
add esp, 0xc
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
and eax, 0xffff
push edx
push eax
call fcn.0048fec0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add esp, 8
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x490053
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x490
ret

Function at 0x490490
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5b9260
push 0x63
push esi
push str.Disabled_PlugIns
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x63
jne 0x4904cc
push esi
call fcn.00490340
add esp, 4
test eax, eax
je 0x4904d3
push 0
push esi
call fcn.00490430
add esp, 8
mov eax, 1
pop esi
ret
cmp eax, 1
jne 0x4904d3
pop esi
ret
xor eax, eax
pop esi
ret