joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4fa4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x65]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4d4fcb
mov eax, 3
jmp 0x4d509c
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401198
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.00401128
add esp, 0xc
mov cx, word [ebx + 0xca]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x118], esi
cmp esi, 0xffffffff
jne 0x4d5051
mov eax, 1
jmp 0x4d509c
push esi
call fcn.004ef808
push 0x10
push 0x439
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [ebx + 0x118]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebx + 0x118]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4d509a
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4d509a
mov eax, 2
jmp 0x4d509c
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d8d1c
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebx
call fcn.004d8c94
test eax, eax
je 0x4d8e16
push 0
mov eax, dword [0x4fd9e8]
push eax
push 0
mov edx, dword [0x4fd9ec]
push edx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x4fcd20
push 0x4fccf8
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x4fccd8], ebx
test ebx, ebx
je 0x4d8e16
mov dword [0x4fcb9c], ebx
push 0x4f7dec
push 0x3e7
push 0x521360
push 0x4fcd3b
push 0x4fcd30
push 0x4fcd24
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x521360], 0
jne 0x4d8dcc
push 0x4f7cec
push 0x4fcd3f
push 0x521360
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x521360
call fcn.00404694
add esp, 8
test eax, eax
je 0x4d8dcc
mov byte [0x521360], 0
cmp byte [0x521360], 0
je 0x4d8df0
push 0x521360
call fcn.0041fbd4
push 0
push 0x521360
push 0x4fcb9c
call fcn.004211bc
cmp dword [0x4fccb4], 0
je 0x4d8e08
push 5
mov eax, dword [0x4fccd8]
push eax
call sub.USER32.dll_ShowWindow
pop ebx
ret
push 0
mov edx, dword [0x4fccd8]
push edx
call sub.USER32.dll_ShowWindow
pop ebx
ret
Function at 0x4da87c
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4fd9f0
push esi
call fcn.004e8a90
test eax, eax
jne 0x4da8d9
push 6
push esi
call sub.USER32.dll_ShowWindow
cmp dword [0x4fda44], 0
je 0x4da8b9
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4da8b9
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x4fd9f8]
jne 0x4da8c8
xor eax, eax
mov dword [0x4fd9f8], eax
push esi
call fcn.004eae80
push eax
call fcn.004d9d04
jmp 0x4daa2e
cmp dword [ebp + 0xc], 0
je 0x4da9cc
push 5
mov edx, dword [edi]
push edx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4da93f
push ebx
call fcn.004e8a90
test eax, eax
je 0x4da931
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
je 0x4da931
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4da931
push ebx
call fcn.004d99bc
test eax, eax
je 0x4da931
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 5
mov eax, dword [edi]
push eax
call sub.USER32.dll_GetWindow
mov ebx, eax
jmp 0x4da8ef
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4da8f3
push 5
mov eax, dword [edi]
push eax
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x4da9cc
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4da975
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4da975
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4da95d
test ebx, ebx
je 0x4da99f
cmp esi, ebx
je 0x4da99f
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.004eae80
push eax
call fcn.004d9d04
jmp 0x4da9cc
mov eax, dword [0x4fd9fc]
push eax
call fcn.004e8a90
test eax, eax
je 0x4da9cc
mov edx, dword [0x4fd9fc]
push edx
call sub.USER32.dll_SetFocus
mov ebx, dword [0x4fd9fc]
push ebx
call fcn.004eae80
push eax
call fcn.004d9d04
push 0
push esi
call sub.USER32.dll_ShowWindow
mov eax, dword [edi]
push eax
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
mov edx, dword [edi]
push edx
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
mov ecx, dword [edi]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [edi]
push eax
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.004da758
push esi
call fcn.004eae80
push eax
call fcn.004d9d04
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4dafc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x52175c
mov esi, 0x521764
mov eax, dword [ebp + 8]
push eax
call fcn.004eae80
mov edi, eax
mov dword [0x521758], edi
test edi, edi
jne 0x4dafec
xor eax, eax
jmp 0x4db16d
mov edx, dword [edi + 0x5d0]
mov dword [0x521768], edx
mov edi, dword [0x521768]
test edi, edi
je 0x4db00b
call sub.USER32.dll_GetFocus
cmp edi, eax
je 0x4db012
xor eax, eax
jmp 0x4db16d
push 0
push 0
push 0xe
mov edx, dword [0x521768]
push edx
call sub.USER32.dll_SendMessageA
mov dword [0x52176c], eax
cmp dword [0x52176c], 0
jle 0x4db04c
cmp dword [0x4fcdb4], 0
jne 0x4db04c
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x4db16d
push 0x515aff
push 0x3e6
push 0xd
mov edx, dword [0x521768]
push edx
call sub.USER32.dll_SendMessageA
mov edi, eax
mov dword [0x52176c], edi
test edi, edi
jg 0x4db07a
mov eax, 1
jmp 0x4db16d
mov edx, dword [0x52176c]
mov byte [edx + 0x515aff], 0
mov dword [ebx], 0x515aff
jmp 0x4db091
inc dword [ebx]
mov ecx, dword [ebx]
cmp byte [ecx], 0x20
je 0x4db08f
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x4db0a9
mov eax, 1
jmp 0x4db16d
push 5
push 0x4fce24
push eax
call fcn.00401540
add esp, 0xc
test eax, eax
je 0x4db0c7
mov eax, 1
jmp 0x4db16d
add dword [ebx], 5
jmp 0x4db0ce
inc dword [ebx]
mov edx, dword [ebx]
cmp byte [edx], 0x20
je 0x4db0cc
mov ecx, dword [ebx]
cmp byte [ecx], 0
jne 0x4db0e6
mov eax, 1
jmp 0x4db16d
push 0x20
mov edx, dword [ebx]
push edx
call fcn.00401278
add esp, 8
mov edi, eax
mov dword [0x521760], edi
test edi, edi
je 0x4db102
mov byte [edi], 0
mov eax, dword [0x4fcdb0]
mov dword [esi], eax
jmp 0x4db15b
mov edx, dword [ebx]
push edx
mov ecx, dword [eax]
push ecx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4db154
mov eax, dword [esi]
push eax
mov edx, dword [0x4fcdb0]
push edx
call fcn.00498fb0
mov dword [0x4fcdb0], eax
xor ecx, ecx
mov dword [0x4fcdb4], ecx
push 0x4fce2b
push 0
push 0xc
mov eax, dword [0x521768]
push eax
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4db16d
mov edx, dword [esi]
mov ecx, dword [edx + 0x30]
mov dword [esi], ecx
mov eax, dword [esi]
test eax, eax
jne 0x4db10b
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4dee74
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x4fcf7c
mov ebx, 0x25
xor edx, edx
mov eax, 0x5223a4
cmp ebx, edx
jle 0x4def16
mov dword [eax], edx
lea ecx, [edx + 0xc9]
mov dword [eax + 4], ecx
mov byte [eax + 8], 4
mov byte [eax + 9], 0
mov ecx, edx
cmp ecx, 0x22
ja case.0x4deeb1.0
mov cl, byte [ecx + 0x4deeb8]
jmp dword [ecx*4 + 0x4deedb]
mov byte [eax + 8], 8
jmp case.0x4deeb1.0
cmp dword [0x4fccb4], 0
je case.0x4deeb1.0
mov byte [eax + 8], 8
jmp case.0x4deeb1.0
mov dword [eax], 0xffffffff
mov byte [eax + 9], 1
inc edx
add eax, 0xc
cmp ebx, edx
jg 0x4dee91
push 0
call fcn.004e0358
call fcn.004decfc
test eax, eax
je 0x4defc1
push 0
mov eax, dword [0x4fd9e8]
push eax
push 0xc8
mov edx, dword [0x4fd9ec]
push edx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x4fd218
push 0x4fd1f0
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [ebp], esi
test esi, esi
je 0x4defc1
mov dword [0x4fcfb8], esi
mov dword [0x4fd0cc], esi
movzx eax, word [0x4fd9e8]
or eax, 0x1c0000
push eax
mov edi, ebx
push edi
push 0x413
push esi
call sub.USER32.dll_SendMessageA
push 0x5223a4
push edi
push 0x414
mov eax, dword [ebp]
push eax
call sub.USER32.dll_SendMessageA
cmp dword [0x4fcf78], 0
je 0x4defb6
push 5
mov edx, dword [ebp]
push edx
call sub.USER32.dll_ShowWindow
jmp 0x4defc1
push 0
mov ecx, dword [ebp]
push ecx
call sub.USER32.dll_ShowWindow
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4df0c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1c
jne 0x4df0ed
mov edx, dword [0x4fd0d0]
test edx, edx
je 0x4df0ed
mov eax, edx
jmp 0x4df1e6
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x4df104
xor eax, eax
jmp 0x4df1e6
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
mov edi, eax
push edi
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x4df120
xor eax, eax
jmp 0x4df1e6
lea edx, [ebx + 0x28]
mov dword [ebp - 0x1c], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x1c], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4df1dd
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4df1d5
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x10]
push edx
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4df1cc
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
push 0xcc0020
push 0
push ebx
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x18]
push ecx
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_StretchDIBits
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.GDI32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
push edi
call sub.KERNEL32.dll_FreeResource
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e3bd4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x4e3be6.0
jmp dword [eax*4 + 0x4e3bed]
push 0
push 0x4fd558
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4e3c6a
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4e3c45
cmp ebx, dword [0x4fd9ec]
je 0x4e3c45
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4e3c1b
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4e3c1b
cmp ebx, dword [0x4fd9ec]
jne 0x4e3c6a
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4e3c6a
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4e3c6a
call fcn.004e3cc8
test eax, eax
jne case.0x4e3be6.0
cmp dword [0x4f9f54], 0
je 0x4e3c89
push 0
push 0
push 0x443
mov eax, dword [0x4fd9ec]
push eax
call sub.USER32.dll_PostMessageA
jmp case.0x4e3be6.0
cmp dword [0x4fd514], 0
je 0x4e3ca7
push 0
push 2
push 0x447
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_PostMessageA
push 5
mov ecx, dword [0x4fd9ec]
push ecx
call sub.USER32.dll_ShowWindow
call fcn.004e3ac8
jmp case.0x4e3be6.0
call fcn.004e378c
pop ebx
pop ebp
ret 4

Function at 0x4e3cc8
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4e3cdf
mov word [0x522808], 1
jmp 0x4e3ce8
mov word [0x522808], 0
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4e3d19
mov eax, dword [0x4f9f48]
test eax, eax
je 0x4e3d04
mov dword [0x4f9f54], eax
jmp 0x4e3d19
push 1
push 0
push 0x443
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_PostMessageA
cmp dword [0x4fd51c], 0
jne 0x4e3d45
cmp dword [0x4fd518], 0
je 0x4e3d38
cmp word [0x522808], 0
je 0x4e3d45
xor eax, eax
ret
cmp word [0x522808], 0
jne 0x4e3d45
xor eax, eax
ret
push 1
call fcn.004e4198
test eax, eax
jne 0x4e3d53
xor eax, eax
ret
cmp dword [0x4fd518], 0
je 0x4e3d86
cmp word [0x522808], 0
je 0x4e3d76
push 6
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_ShowWindow
jmp 0x4e3dad
push 0
mov ecx, dword [0x4fd9ec]
push ecx
call sub.USER32.dll_ShowWindow
jmp 0x4e3dad
cmp word [0x522808], 0
je 0x4e3d9f
push 0
mov eax, dword [0x4fd9ec]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4e3dad
push 6
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
Function at 0x4e45f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4fd590], 0
je 0x4e4614
test edi, edi
je 0x4e4625
push ebx
push 0x4fd780
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4e4634
push ebx
push 0x4fd7a1
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xffffffffffffffff
push 2
push 0x4fd7c8
push esi
push 0x4fd7bb
call fcn.00450490
test eax, eax
je 0x4e468d
cmp dword [0x4fd594], 0
je 0x4e472b
test edi, edi
jne 0x4e472b
push 0xffffffffffffffff
push 2
push 0x4fd7ea
push 0x4fd7da
push 0x4fd7cc
call fcn.00450490
test eax, eax
jne 0x4e472b
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4e472b
call fcn.004c2eb8
cmp byte [0x51a338], 0
jne 0x4e46ca
mov esi, 0x4fd7ee
mov edi, 0x51a338
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [0x4fb13c], 4
push 0
push 0x67
push 0x111
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_PostMessageA
jmp 0x4e472b
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x4f7cec
push ebx
push 0x51a338
push 0x4fd7f7
mov ecx, dword [0x4fd9ec]
push ecx
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x4e4724
mov esi, 0x4fd7fd
mov edi, 0x51a338
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
call sub.USER32.dll_MessageBeep
push 0
push 0x51a
push 0x111
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_PostMessageA
push 0
call sub.KERNEL32.dll_SetErrorMode
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4e8c44
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x4cc]
test al, al
jne 0x4e8c60
mov eax, 0x4fdbec
jmp 0x4e8cfd
cmp al, 1
jne 0x4e8c6c
lea eax, [ebx + 4]
jmp 0x4e8cfd
cmp al, 2
jne 0x4e8ca3
mov al, byte [ebx + 0x4cd]
cmp al, 1
jne 0x4e8c7f
lea eax, [ebx + 4]
jmp 0x4e8cfd
cmp al, 2
jne 0x4e8c8a
mov eax, 0x4fdbf5
jmp 0x4e8cfd
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.00401278
add esp, 8
test eax, eax
jne 0x4e8ca0
mov eax, esi
jmp 0x4e8cfd
inc eax
jmp 0x4e8cfd
mov al, byte [ebx + 0x4cc]
cmp al, 3
jne 0x4e8cc4
cmp byte [ebx + 0x4cd], 1
jne 0x4e8cbd
mov eax, 0x4fdbff
jmp 0x4e8cfd
mov eax, 0x4fdc06
jmp 0x4e8cfd
cmp al, 4
jne 0x4e8ccf
mov eax, 0x4fdc0d
jmp 0x4e8cfd
cmp al, 5
jne 0x4e8cda
mov eax, 0x4fdc14
jmp 0x4e8cfd
cmp al, 6
jne 0x4e8ce5
mov eax, 0x4fdc1d
jmp 0x4e8cfd
cmp al, 7
jne 0x4e8cf0
mov eax, 0x4fdc23
jmp 0x4e8cfd
cmp al, 8
jne 0x4e8cfb
mov eax, 0x4fdc2c
jmp 0x4e8cfd
xor eax, eax
test eax, eax
je 0x4e8d30
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdc3b
push eax
push 0x4fdc34
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x515718], 0
je 0x4e8d30
mov eax, 1
jmp 0x4e8d32
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4e92e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.004eae80
mov ebx, eax
test ebx, ebx
je 0x4e92fe
cmp byte [ebx + 0x4cc], 1
je 0x4e930a
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4e945b
push 0x453fdc
push 0x71
push esi
call fcn.00451600
mov esi, eax
test esi, esi
jle 0x4e945b
push ebx
call fcn.004e8a54
test eax, eax
je 0x4e945b
test esi, 1
je 0x4e933b
xor edi, edi
jmp 0x4e9374
test esi, 2
je 0x4e934a
mov edi, 1
jmp 0x4e9374
test esi, 4
je 0x4e9359
mov edi, 2
jmp 0x4e9374
push 0x4f7dec
push 0
lea eax, [ebx + 4]
push eax
push 0x4fdd3c
call fcn.0048326c
mov edi, dword [0x4fdb60]
test esi, 0x10
je 0x4e939d
test esi, 8
je 0x4e9397
push 0x4f7dec
push 0
push 0
push 0x4fdd46
call fcn.0048326c
mov dword [0x4fdb60], edi
mov eax, edi
mov byte [ebx + 0x4e8], al
cmp edi, 2
jne 0x4e93c8
push 0
mov edx, dword [ebx + 0x5d4]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebx + 0x5d4]
push ecx
call sub.USER32.dll_EnableWindow
jmp 0x4e93e4
push 1
mov eax, dword [ebx + 0x5d4]
push eax
call sub.USER32.dll_EnableWindow
push 8
mov edx, dword [ebx + 0x5d4]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebx]
push ecx
call fcn.004eb4c8
call fcn.00485c5c
test esi, 8
jne 0x4e945b
test esi, 0x10
jne 0x4e945b
cmp byte [ebx + 0x4e8], 0
jne 0x4e941d
mov esi, 0x4fdd50
mov edi, 0x515718
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4e9443
cmp byte [ebx + 0x4e8], 1
jne 0x4e9436
mov esi, 0x4fdd57
mov edi, 0x515718
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4e9443
mov esi, 0x4fdd5d
mov edi, 0x515718
mov eax, edi
movsd dword es:[edi], dword [esi]
push 0x4f7dec
push 0x515718
add ebx, 4
push ebx
push 0x4fdd62
call fcn.0048326c
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4e9464
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.004eae80
test eax, eax
je 0x4e947d
cmp byte [eax + 0x4cc], 1
je 0x4e9487
mov eax, dword [0x4fdb60]
jmp 0x4e950b
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdd76
add eax, 4
push eax
push 0x4fdd6c
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x515718], 0
je 0x4e9506
push 0x4fdd7a
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4e94cc
xor eax, eax
jmp 0x4e950b
push 0x4fdd81
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4e94e9
mov eax, 1
jmp 0x4e950b
push 0x4fdd87
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4e9506
mov eax, 2
jmp 0x4e950b
mov eax, dword [0x4fdb60]
pop ebp
ret 4
Function at 0x4ea1ec
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x4fde2d
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea22b
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fde50
push 0x4fde46
push 0x4fde3d
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4ea279
push 0x20
push ebx
call fcn.004015cc
add esp, 8
mov esi, eax
mov dword [0x523fe4], esi
test esi, esi
je 0x4ea254
inc dword [0x523fe4]
mov eax, dword [0x523fe4]
cmp byte [eax], 0
je 0x4ea254
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4ea25a
inc ebx
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fde5e
push ebx
push 0x4fde55
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4fde63
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea296
mov eax, 1
jmp 0x4ea298
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4ea370
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x4fde89
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea3af
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdead
push 0x4fdea3
push 0x4fde99
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4ea3fd
push 0x20
push ebx
call fcn.004015cc
add esp, 8
mov esi, eax
mov dword [0x523fe8], esi
test esi, esi
je 0x4ea3d8
inc dword [0x523fe8]
mov eax, dword [0x523fe8]
cmp byte [eax], 0
je 0x4ea3d8
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4ea3de
inc ebx
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdebc
push ebx
push 0x4fdeb2
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4fdec1
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea41a
mov eax, 1
jmp 0x4ea41c
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4ea624
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x4fdb88
mov al, byte [ebx + 0x4cc]
test al, al
jne 0x4ea647
lea eax, [esi + 0x39b]
jmp 0x4ea6ef
cmp al, 1
jne 0x4ea653
lea eax, [ebx + 4]
jmp 0x4ea6ef
cmp al, 2
jne 0x4ea68e
mov al, byte [ebx + 0x4cd]
cmp al, 1
jne 0x4ea669
lea eax, [ebx + 4]
jmp 0x4ea6ef
cmp al, 2
jne 0x4ea675
lea eax, [esi + 0x3a4]
jmp 0x4ea6ef
push 0x20
lea edi, [ebx + 4]
push edi
call fcn.00401278
add esp, 8
test eax, eax
jne 0x4ea68b
mov eax, edi
jmp 0x4ea6ef
inc eax
jmp 0x4ea6ef
mov al, byte [ebx + 0x4cc]
cmp al, 3
jne 0x4ea6b1
cmp byte [ebx + 0x4cd], 1
jne 0x4ea6a9
lea eax, [esi + 0x3ae]
jmp 0x4ea6ef
lea eax, [esi + 0x3b5]
jmp 0x4ea6ef
cmp al, 4
jne 0x4ea6bd
lea eax, [esi + 0x3bc]
jmp 0x4ea6ef
cmp al, 5
jne 0x4ea6c9
lea eax, [esi + 0x3c3]
jmp 0x4ea6ef
cmp al, 6
jne 0x4ea6d5
lea eax, [esi + 0x3cc]
jmp 0x4ea6ef
cmp al, 7
jne 0x4ea6e1
lea eax, [esi + 0x3d2]
jmp 0x4ea6ef
cmp al, 8
jne 0x4ea6ed
lea eax, [esi + 0x3db]
jmp 0x4ea6ef
xor eax, eax
mov ebx, 2
test eax, eax
je 0x4ea773
push 0x4f7dec
push 0x3e7
push 0x515718
lea edx, [esi + 0x3ec]
push edx
push eax
lea eax, [esi + 0x3e3]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [esi + 0x3f0]
push ecx
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea737
xor ebx, ebx
jmp 0x4ea773
lea eax, [esi + 0x3f3]
push eax
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea756
mov ebx, 1
jmp 0x4ea773
lea eax, [esi + 0x3f6]
push eax
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea773
mov ebx, 3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4ea84c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x4fdfa3
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea88b
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdfc7
push 0x4fdfbd
push 0x4fdfb3
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4ea8d9
push 0x20
push ebx
call fcn.004015cc
add esp, 8
mov esi, eax
mov dword [0x523fec], esi
test esi, esi
je 0x4ea8b4
inc dword [0x523fec]
mov eax, dword [0x523fec]
cmp byte [eax], 0
je 0x4ea8b4
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4ea8ba
inc ebx
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fdfd6
push ebx
push 0x4fdfcc
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4fdfdb
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4ea8f6
mov eax, 1
jmp 0x4ea8f8
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4ead60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x4cc]
test al, al
jne 0x4ead79
mov eax, 0x4fe01c
jmp 0x4eadbd
cmp al, 1
jne 0x4ead82
lea eax, [ebx + 4]
jmp 0x4eadbd
cmp al, 2
jne 0x4eadb9
mov al, byte [ebx + 0x4cd]
cmp al, 1
jne 0x4ead95
lea eax, [ebx + 4]
jmp 0x4eadbd
cmp al, 2
jne 0x4eada0
mov eax, 0x4fe025
jmp 0x4eadbd
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.00401278
add esp, 8
test eax, eax
jne 0x4eadb6
mov eax, esi
jmp 0x4eadbd
inc eax
jmp 0x4eadbd
xor eax, eax
jmp 0x4eae18
push 0x4f7dec
push 0x3e7
push 0x515718
push 0x4fe03a
push eax
push 0x4fe02f
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4fe03e
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4eadf6
xor eax, eax
jmp 0x4eae18
push 0x4fe043
push 0x515718
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4eae13
mov eax, 1
jmp 0x4eae18
mov eax, 2
pop esi
pop ebx
pop ebp
ret 4