joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0600
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x4f0616
cmp eax, 2
jne 0x4f07e6
mov eax, dword [esi + 0x30]
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
test eax, eax
je 0x4f0668
test ebx, ebx
jle 0x4f065a
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4f065a
push 0xe
push ecx
push ebx
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x4f0674
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4f0674
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov dword [edi + eax], 0x57
jmp 0x4f0674
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov dword [edi + edx], 6
mov eax, dword [esi + 0x674]
mov ecx, dword [esi + 0x340c]
test eax, eax
je 0x4f06d2
test ebx, ebx
jle 0x4f06bc
test ecx, ecx
jle 0x4f06bc
push 0xe
push ecx
push ebx
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x4f06e6
mov eax, dword [esi + 0x670]
mov ebx, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x670], eax
mov ebx, dword [ebp + 8]
jmp 0x4f06e6
mov ecx, dword [esi + 0x670]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x670], 0x57
jmp 0x4f06e6
mov eax, dword [esi + 0x670]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x670], 6
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x3410]
lea edx, [esi + 0x2310]
sub eax, dword [esi + 0x340c]
mov ecx, ebx
call fcn.004c8ad0
push str.ScanImgCropWnd_ClientWnd
lea eax, [esi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x4c]
mov ecx, eax
test eax, eax
jne 0x4f071d
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x4f074a
test ecx, ecx
je 0x4f074a
cmp word [ecx], ax
je 0x4f074a
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4f073f
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call edi
sub ebx, eax
mov eax, dword [esi + 0x4c]
mov ecx, eax
test eax, eax
jne 0x4f075a
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x4f0781
test ecx, ecx
je 0x4f0781
cmp word [ecx], ax
je 0x4f0781
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4f0776
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0x3428]
sub edi, eax
mov eax, dword [esi + 0x3424]
push 1
add edx, edi
push edx
push eax
lea ecx, [esi + 0x88]
call fcn.0051c380
mov ecx, dword [esi + 0x3418]
mov edx, dword [esi + 0x3414]
push 1
add ecx, edi
push ecx
add edx, ebx
push edx
lea ecx, [esi + 0x118]
call fcn.0051c380
mov eax, dword [esi + 0x3420]
mov ecx, dword [esi + 0x341c]
push 1
add eax, edi
add ecx, ebx
push eax
push ecx
lea ecx, [esi + 0x3c4]
call fcn.0051c380
call fcn.004f08f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f1a10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540e00
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x700000
mov byte [ebp - 0xd], 0
call fcn.00513ea0
push 0x20000
call fcn.00514110
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.004edd10
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4f1b81
mov eax, dword [ebx + 0xd7c]
lea esi, [ebx + 0xd74]
mov ecx, 9
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 0xddc]
sub edi, dword [ebx + 0xd78]
lea ecx, [eax + eax]
mov eax, dword [ebx + 0xdd8]
add edi, dword [ebx + 0xd94]
sub esp, 0xc
sub eax, ecx
lea edx, [ebx + 0x4238]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
mov dword [ebp + 0x10], eax
call fcn.005072b0
sub esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebx + 0x422c]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.005072b0
sub esp, 0xc
lea edx, [ebx + 0x4220]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
mov byte [ebp - 4], 1
call fcn.005072b0
lea esi, [ebx + 0xdec]
mov dword [ebp - 4], 0xffffffff
call fcn.004f0220
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push ecx
push edx
mov edx, dword [ebp - 0x28]
push esi
mov eax, edi
call fcn.004eff00
mov esi, eax
test esi, esi
je 0x4f1b7c
push edi
mov dword [ebx + 0xdcc], esi
call fcn.005136e0
push esi
call fcn.005137f0
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4f1b58
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx + 0x2c], 6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00515de0
call fcn.00513f70
call fcn.005141e0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f9d60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edx, ebx
mov byte [ebp - 0xd], 0
call fcn.004fab70
mov edx, dword [ebp + 0x10]
mov edi, eax
call fcn.004fab70
mov esi, eax
test edi, edi
je 0x4f9e9b
test esi, esi
je 0x4f9e9b
cmp dword [edi + 4], 0
jne 0x4f9dce
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004f9f40
cmp dword [edi + 4], 0
je 0x4f9e9b
cmp dword [esi + 4], 0
jne 0x4f9e9b
mov edi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x34]
push eax
mov esi, ebx
call fcn.004fba00
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0x10]
push ecx
call fcn.004fba00
push esi
push edi
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 1
call fcn.004fb850
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4f9e1a
mov eax, 0x54ee24
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00449e10
test al, al
je 0x4f9e50
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x4f9e34
mov ecx, 0x54ee24
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4f9e40
mov eax, 0x54ee24
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov bl, 1
test eax, eax
jne 0x4f9e53
mov bl, byte [ebp - 0xd]
mov ecx, dword [ebp + 8]
push esi
push edi
push ecx
call fcn.004f9c50
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00507320
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00507320
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00507320
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f9ec0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, edi
mov esi, eax
xor bl, bl
call fcn.004fab70
mov esi, eax
test esi, esi
je 0x4f9f2b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4f9f2b
push edi
call fcn.004fb720
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
push ecx
mov esi, edi
call fcn.004fba00
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4f9f0e
mov eax, 0x54ee24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4f9f1b
mov bl, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4f9f2b
push eax
call fcn.0051ebab
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push esi
test ebx, ebx
jne 0x50410e
mov ebx, dword [ebp + 0xc]
push edi
mov ecx, 0x554c58
call fcn.00470370
push 0x55d7e4
lea eax, [edi + 0x10]
call fcn.005080c0
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x504132
mov esi, 0x54ee24
xor edx, edx
cmp dword [edi + 8], edx
jle 0x50415f
test esi, esi
je 0x50415f
cmp word [esi], dx
je 0x50415f
mov eax, dword [edi + 4]
test eax, eax
jne 0x50414e
mov eax, 0x54ee24
push eax
push 0
push str.Height
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
sub eax, edx
sub eax, dword [ebp + 0x14]
push ebx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
sar esi, 1
add esi, dword [ebp + 0x14]
sub ecx, esi
push esi
mov dword [edi + 0x260], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
push edi
call fcn.005047a0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edx
push eax
push edi
call fcn.00504a20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push ecx
push edx
push edi
call fcn.00504cb0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
push edi
call fcn.00504f40
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x504230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536920
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x50]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x504339
cmp eax, ebx
je 0x504276
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x504284
jmp 0x5042a4
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x4c], 6
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x504296
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5042a4
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x4c], 6
push 0x753b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471480
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x5042d3
mov eax, 0x54ee24
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x5042f7
mov eax, 0x54ee24
lea ecx, [edi + 0x20]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x50430f
push esi
call fcn.0051ebab
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x504366
push eax
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x504358
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x4c]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x4c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536920
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0xe0]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x50449e
cmp eax, ebx
je 0x5043c9
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5043dd
jmp 0x504406
mov eax, dword [edi + 0xdc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0xdc], 6
mov eax, dword [edi + 0xe0]
cmp eax, ebx
je 0x5043f2
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x504406
mov ecx, dword [edi + 0xdc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0xdc], 6
push 0x754b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471480
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x504435
mov eax, 0x54ee24
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x504459
mov eax, 0x54ee24
lea ecx, [edi + 0xb0]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x504474
push esi
call fcn.0051ebab
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x5044d1
push eax
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x5044bd
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0xdc]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xdc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5044f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536920
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x170]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jle 0x50460e
cmp eax, ebx
je 0x504539
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x50454d
jmp 0x504576
mov eax, dword [edi + 0x16c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x16c], 6
mov eax, dword [edi + 0x170]
cmp eax, ebx
je 0x504562
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x504576
mov ecx, dword [edi + 0x16c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x16c], 6
push 0x753d
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471480
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x5045a5
mov eax, 0x54ee24
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push 0x55a324
push ecx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x5045c9
mov eax, 0x54ee24
lea ecx, [edi + 0x140]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x5045e4
push esi
call fcn.0051ebab
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x504641
push eax
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x50462d
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi + 0x16c]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x16c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504660
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538d58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [edi + 0x200]
jle 0x504758
test eax, eax
je 0x5046a7
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5046bb
jmp 0x5046e4
mov eax, dword [edi + 0x1fc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x1fc], 6
mov eax, dword [edi + 0x200]
test eax, eax
je 0x5046d0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5046e4
mov ecx, dword [edi + 0x1fc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x1fc], 6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
lea ecx, [ebp - 0x18]
push str._d__d
push ecx
mov dword [ebp - 4], 0
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
test esi, esi
jne 0x504727
mov eax, 0x54ee24
lea ecx, [edi + 0x1d0]
call fcn.005091f0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x50478b
push esi
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x504777
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [edi + 0x1fc]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x1fc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x506000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a184
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x70], eax
lea ecx, [eax + 0x23]
lea esi, [ebp - 0x28]
lea ebx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00508530
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00508010
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x506091
push eax
call fcn.0051ebab
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
call esi
push 0x54ede0
lea edi, [ebp - 0x1c]
call fcn.00507dd0
push str.ControlCenter4
call esi
push str.ControlCenter4
call fcn.00507dd0
xor ecx, ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x506109
cmp word [edi], bx
je 0x506109
push edi
lea eax, [ebp - 0x44]
call fcn.005080c0
push 0x5c
lea esi, [ebp - 0x44]
call fcn.00507e80
mov esi, str.BrCcDefSet.dat
lea eax, [ebp - 0x44]
call fcn.00508170
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
jle 0x50612f
cmp ecx, ebx
jne 0x506119
mov ecx, 0x54ee24
push ecx
push 0x1388
push str.DevStatInterval
push str.TimeParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x48]
push edx
mov dword [ecx + 0x43c], eax
mov byte [ebp - 4], 1
call fcn.004702d0
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], bl
call fcn.00508490
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x506165
push edi
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x506410
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a140
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esi + 0x4c]
cmp edi, 2
jne 0x506448
push str.AdvDevStatus_Text
jmp 0x50644d
push str.HomeDevStatus_Text
call fcn.005080c0
push 0x2af8
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x5776a0
call fcn.00471480
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x50647b
mov dword [ebp - 0x24], 0x54ee24
mov eax, dword [esi + 0x4c]
mov ecx, eax
cmp eax, ebx
jne 0x506489
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], ebx
jle 0x5064b3
cmp ecx, ebx
je 0x5064b3
cmp word [ecx], bx
je 0x5064b3
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x5064a5
mov eax, 0x54ee24
push eax
push ebx
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov byte [ebp - 0x40], bl
mov ecx, 1
cmp edi, 2
jne 0x5064ca
mov byte [ebp - 0x48], cl
mov edi, 0xffffff
jmp 0x5064d0
mov edi, dword [ebp - 0x44]
mov byte [ebp - 0x48], bl
push ebx
push ebx
mov ebx, dword [ebp + 8]
mov byte [esi + 0x248], cl
mov dword [esi + 0x11c], ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
lea edx, [esi + 0xfc]
push edx
mov dword [esi + 0x120], 0x40024
call fcn.00473a60
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esi + 0x130], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esi + 0x13c], edx
mov dword [esi + 0x140], eax
push 0x7534
lea edx, [ebp - 0x18]
mov dword [esi + 0x144], ecx
push edx
mov ecx, 0x5776a0
call fcn.00471480
mov cl, 1
mov byte [ebp - 4], cl
mov eax, dword [ebp - 0x18]
xor ebx, ebx
cmp eax, ebx
jne 0x506555
mov eax, 0x54ee24
push eax
lea eax, [esi + 0x124]
mov byte [esi + 0x248], cl
call fcn.005080c0
mov eax, dword [esi + 0x3d0]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x506592
push eax
call fcn.0051ebab
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x5065a9
push eax
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x508530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534a12
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea eax, [ebp - 0x420]
push eax
push edi
push edi
push ecx
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x424], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x5085a4
lea edx, [ebp - 0x420]
push edx
mov eax, esi
call fcn.005080c0
jmp 0x5085cd
cmp eax, 0x80070057
jne 0x5085b3
mov dword [ebx], 0x57
jmp 0x5085cd
cmp eax, 1
je 0x5085c7
cmp eax, 0x80004005
je 0x5085c7
mov dword [ebx], 0x54f
jmp 0x5085cd
mov dword [ebx], 3
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret
Function at 0x50ca50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
mov ecx, 0x18
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ecx
jne 0x50ca62
mov eax, dword [0x577698]
xor esi, esi
test eax, eax
je 0x50ca9b
push 0x80
push esi
push esi
push esi
push 0xc994
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
test esi, esi
jne 0x50caa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x57768c], eax
jmp 0x50caa5
mov dword [0x57768c], 0x57
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ecx], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [0x577698]
test esi, esi
je 0x50cb00
push 2
push 0xc994
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x50cb00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x50cb00
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8