joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ca60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x414
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x49ca93
mov ecx, dword [esp + 0x41c]
lea eax, [esp + 0x210]
push 0x103
push eax
push 0x681
push ecx
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x49caba
push 0x5b9260
lea edx, [esp + 0x214]
push 0x103
push edx
push str.FLIFDPX
push str.OtherExtensions
push str.Extensions
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x210]
push eax
call fcn.004c9ba0
lea ecx, [esp + 0x214]
mov dword [esp + 8], ebp
push ecx
call fcn.004d6713
add esp, 8
test eax, eax
jle 0x49cbd4
push ebx
mov ebx, dword [esp + 0x434]
push esi
mov esi, dword [esp + 0x434]
push edi
mov edi, dword [esp + 0x434]
mov edx, dword [esp + 0x10]
mov ax, word [esp + edx*2 + 0x21c]
cmp ax, 0x7c
je 0x49cb18
mov word [esp + ebp*2 + 0x14], ax
inc ebp
jmp 0x49cbac
lea eax, [esp + 0x14]
mov word [esp + ebp*2 + 0x14], 0
push eax
xor ebp, ebp
call fcn.004c8cb0
lea ecx, [esp + 0x18]
push ecx
call fcn.004d6713
add esp, 8
test eax, eax
jbe 0x49cbac
lea edx, [esp + 0x14]
push edx
call fcn.0049c9d0
add esp, 4
test eax, eax
jne 0x49cbac
mov eax, dword [esp + 0x42c]
test eax, eax
je 0x49cb84
mov eax, dword [esp + 0x440]
mov ecx, dword [esp + 0x430]
push ebx
push esi
push edi
push 0x5aae60
push eax
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0049aba0
add esp, 0x20
jmp 0x49cbac
push esi
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.0049a700
add esp, 0xc
test eax, eax
je 0x49cbac
push ebx
push esi
push edi
lea edx, [esp + 0x20]
push 0x5aae60
push edx
call fcn.0049adf0
add esp, 0x14
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
inc edx
push eax
mov dword [esp + 0x14], edx
call fcn.004d6713
mov ecx, dword [esp + 0x14]
add esp, 4
cmp ecx, eax
jl 0x49cafb
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x414
ret

Function at 0x49cc20
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 5
push 0
push str._name_Microsoft.DefaultPrograms__page_pageDefaultProgram
push str.control.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x4a44d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp]
push 0x104
push eax
call fcn.004cb940
mov eax, dword [esp + 0x420]
add esp, 8
test eax, eax
lea ecx, [esp + 0x208]
je 0x4a451c
push 0x5b9260
push 0x104
lea edx, [esp + 8]
push ecx
push edx
push str.TTF_text
push str.Plugins
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4a452a
lea eax, [esp]
push eax
push ecx
call fcn.004d631b
add esp, 8
push 0xffa7
lea edx, [esp + 4]
push 0x104
lea eax, [esp + 0x210]
push edx
push eax
call fcn.004caaa0
mov edx, dword [esp + 0x424]
add esp, 0x10
lea ecx, [esp]
push ecx
push 0x7b4
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 0x410
ret
Function at 0x4a5010
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x140
test eax, eax
je 0x4a502e
push eax
lea eax, [esp + 4]
push eax
call fcn.004d631b
add esp, 8
jmp 0x4a504c
mov edx, dword [esp + 0x154]
mov eax, dword [0x5b5574]
lea ecx, [esp]
push 0x80
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push esi
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 8]
push edi
push ecx
push 0
push 0x180
push 0xc89
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
mov ecx, dword [0x5b5574]
push 0
push edx
and eax, 0xffff
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov esi, dword [esp + 0x154]
push 0
push eax
mov dword [esi*4 + 0x5b6e40], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x158]
mov ecx, dword [esi*4 + 0x5b6e40]
push 5
push 0
push 0
push edx
push eax
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi*4 + 0x5b6e40]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 5
push edx
call ebx
push 0
lea esi, [esi*4 + 0x5b5c2c]
push 0
push 0x87
push eax
mov dword [esi], eax
call edi
test ah, 1
je 0x4a511f
mov eax, dword [esi]
push 2
push eax
call ebx
push 0
push 0
push 0x87
push eax
mov dword [esi], eax
call edi
test ah, 1
jne 0x4a5105
pop edi
pop esi
pop ebx
add esp, 0x140
ret

Function at 0x4a5047
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x140
test eax, eax
je 0x4a502e
push eax
lea eax, [esp + 4]
push eax
call fcn.004d631b
add esp, 8
jmp 0x4a504c
mov edx, dword [esp + 0x154]
mov eax, dword [0x5b5574]
lea ecx, [esp]
push 0x80
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push esi
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 8]
push edi
push ecx
push 0
push 0x180
push 0xc89
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
mov ecx, dword [0x5b5574]
push 0
push edx
and eax, 0xffff
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov esi, dword [esp + 0x154]
push 0
push eax
mov dword [esi*4 + 0x5b6e40], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x158]
mov ecx, dword [esi*4 + 0x5b6e40]
push 5
push 0
push 0
push edx
push eax
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi*4 + 0x5b6e40]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 5
push edx
call ebx
push 0
lea esi, [esi*4 + 0x5b5c2c]
push 0
push 0x87
push eax
mov dword [esi], eax
call edi
test ah, 1
je 0x4a511f
mov eax, dword [esi]
push 2
push eax
call ebx
push 0
push 0
push 0x87
push eax
mov dword [esi], eax
call edi
test ah, 1
jne 0x4a5105
pop edi
pop esi
pop ebx
add esp, 0x140
ret
Function at 0x4a56d0
Capabilities:
Move file

Disassembly:
mov eax, 0x1a8c
call fcn.004d6340
push ebx
push esi
push edi
mov edi, dword [esp + 0x1a9c]
push 0x598030
push edi
mov ebx, 1
call fcn.004d5ece
mov esi, eax
add esp, 8
test esi, esi
je 0x4a5861
push ebp
push esi
push ebx
lea eax, [esp + 0x18]
push 2
push eax
xor ebp, ebp
call fcn.004d58aa
add esp, 0x10
cmp word [esp + 0x10], 0xfeff
je 0x4a5828
push ebp
push ebp
push esi
call fcn.004d5be4
lea ecx, [esp + 0x20]
push 3
push ecx
push edi
call fcn.004c93e0
lea edx, [esp + 0x2c]
push str.i_view32.ini_temp
push edx
call fcn.004d62f1
lea eax, [esp + 0x34]
push 0x598078
push eax
call fcn.004d5ece
mov ebx, eax
add esp, 0x28
test ebx, ebx
je 0x4a5828
push ebx
push 1
lea ecx, [esp + 0x18]
push 2
push ecx
mov dword [esp + 0x20], 0xfeff
call fcn.004d5f50
push ebx
push str.__UNICODE_FILE___edit_with_care_____r_n_r_n
call fcn.004d7bf0
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x2b4]
push esi
lea edx, [esp + 0x2b8]
push 0x800
rep stosd dword es:[edi], eax
push edx
call fcn.004d758b
add esp, 0x24
test eax, eax
je 0x4a5818
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0xa9c]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [esp + 0xaa0]
lea ecx, [esp + 0x2a0]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0xa9c]
push ebx
push edx
call fcn.004d7bf0
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x2a4]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2a8]
push 0x800
push eax
inc ebp
call fcn.004d758b
add esp, 0x14
test eax, eax
jne 0x4a57ae
push ebx
call fcn.004d5e20
mov edi, dword [esp + 0x1aa4]
add esp, 4
push esi
call fcn.004d5e20
add esp, 4
test ebp, ebp
pop ebp
jle 0x4a5852
push 1
lea ecx, [esp + 0x14]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4a5852
pop edi
pop esi
pop ebx
add esp, 0x1a8c
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1a8c
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x1a8c
ret
Function at 0x4a5870
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
push 0x5b9260
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
mov ebx, eax
call fcn.004a4db0
add esp, 4
cmp ebx, 0xffffffff
mov esi, eax
je 0x4a5898
test bl, 1
jne 0x4a589c
test esi, esi
jne 0x4a58ba
mov eax, dword [0x5b5574]
push 3
push 0
push 0x5b9260
push 0
push 0x533
push eax
call fcn.004cc7f0
add esp, 0x18
cmp esi, 1
jne 0x4a58cc
push 0x5b9260
call fcn.004a56d0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 1
push str.ShowExtensionsDlg
push str.Extensions
mov dword [0x5b6e80], 0xf
call esi
test eax, eax
mov eax, dword [esp + 0x50]
jne 0x4a5905
mov edx, dword [0x5b6e80]
dec edx
dec eax
mov dword [0x5b6e80], edx
test eax, eax
jg 0x4a591c
push 0x5b9260
push 0
push str.PropPage
push str.Others
call esi
test eax, eax
mov dword [0x5b6e84], eax
jge 0x4a592f
mov dword [0x5b6e84], 0
mov ecx, dword [esp + 0x4c]
mov edx, dword [0x5b5574]
push 0
push 0x4a5130
push ecx
push 0x588
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
mov eax, dword [0x5b6e84]
push eax
lea ecx, [esp + 0xc]
push 0x5985ac
push ecx
call fcn.004d5ee1
add esp, 0xc
lea edx, [esp + 8]
push 0x5b9260
push edx
push str.PropPage
push str.Others
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, esi
pop esi
pop ebx
add esp, 0x40
ret

Function at 0x4a65c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [esp + 0xa8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 0
push str.CRW_AWB
push str.Plugins
mov word [esi], 0
mov word [esp + 0x18], 0
call edi
push eax
lea eax, [esp + 0x2c]
push str.a_d
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x34]
push ecx
push esi
call fcn.004d62f1
add esp, 0x14
push 0x5b9260
push 1
push str.CRW_CWB
push str.Plugins
call edi
push eax
lea edx, [esp + 0x2c]
push str.w_d
push edx
call fcn.004d5ee1
lea eax, [esp + 0x34]
push eax
push esi
call fcn.004d62f1
add esp, 0x14
lea ecx, [esp + 8]
push 0x5b9260
push 0x10
push ecx
push str.1.00
push str.CRW_Bright
push str.Plugins
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 8]
lea eax, [esp + 0x28]
push edx
push str.b_s
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x34]
push ecx
push esi
call fcn.004d62f1
mov eax, dword [esp + 0xc4]
add esp, 0x14
test eax, eax
jne 0x4a66a8
push 0x5b9260
push 1
push str.CRW_HALF
push str.Plugins
call edi
test eax, eax
je 0x4a66b6
push str.half
push esi
call fcn.004d62f1
add esp, 8
push 0x5b9260
push 0
push str.CRW_Highlight
push str.Plugins
call edi
push eax
lea edx, [esp + 0x2c]
push str.h_d
push edx
call fcn.004d5ee1
lea eax, [esp + 0x34]
push eax
push esi
call fcn.004d62f1
add esp, 0x14
push 0x5b9260
push 0
push str.CRW_NoBright
push str.Plugins
call edi
push eax
lea ecx, [esp + 0x2c]
push str.W_d
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x34]
push edx
push esi
call fcn.004d62f1
add esp, 0x14
pop edi
pop esi
add esp, 0xa0
ret
Function at 0x4a6b00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push edi
push 0x5b9260
push 1
xor esi, esi
push str.UseInternalPlayer
push str.Others
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call ebp
test eax, eax
push esi
je 0x4a6cea
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 1
mov ebx, 0xd570
call fcn.004a6a60
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, esi
je 0x4a6bb5
push 0x5b9260
push 0
push str.VideoHidePlaybar
push str.Others
mov esi, 0x1a
call ebp
test eax, eax
je 0x4a6b7f
mov ebx, 0xd572
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a6b8c
mov esi, 0x3a
mov edx, dword [0x5b5530]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov eax, dword [0x5b5530]
jne 0x4a6ba7
mov eax, dword [0x5b5534]
push 0
push 0
push 0x406
push eax
call edi
jmp 0x4a6be0
mov eax, dword [0x59f720]
test eax, eax
je 0x4a6bc3
mov esi, 2
mov eax, dword [0x5b552c]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [0x5b552c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x24]
or esi, 1
cmp eax, 0x33
jne 0x4a6bef
or esi, 0x40
push 0x5b9260
push 0
push str.VideoLoop
push str.Others
call ebp
test eax, eax
je 0x4a6c09
or esi, 4
mov edx, dword [0x5b5538]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
push 0
je 0x4a6cab
mov eax, dword [0x5b5538]
push 0
push 0x808
push eax
call edi
mov ecx, dword [esp + 0x20]
mov edx, dword [0x5b5538]
push ecx
push 0
push 0x4fc
push edx
call edi
mov eax, dword [0x5b5538]
push 0
push 0
push 0x73d
push eax
call edi
cmp eax, 1
jne 0x4a6ca1
mov ecx, dword [0x5b5538]
push 0xffffffffffffffff
push 0
push 0x807
push ecx
call edi
push 0x5b9260
push 0x64
push str.VideoSize
push str.Others
call ebp
mov edx, dword [0x5b5538]
push eax
push 0
push 0x46c
push edx
call edi
mov eax, dword [0x5b5538]
push 0
push 0
push 0x806
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov edx, dword [0x5b550c]
push esi
push 0x5b9260
push eax
mov eax, dword [esp + 0x28]
push ecx
push ebx
push edx
push eax
call fcn.00434440
add esp, 0x20
mov dword [0x5b5538], eax
test eax, eax
jne 0x4a6c49
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
push esi
call fcn.0047a580
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push 1
push ecx
push edi
call fcn.004a68b0
add esp, 0x14
cmp eax, 1
jne 0x4a6d13
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x10]
push 1
lea eax, [esp + 0x18]
push edx
push eax
push 0
call fcn.004a6a60
add esp, 0x10
mov esi, eax
push 0
push 0
push 0x7ea
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ecx
push 0
push edx
push eax
push esi
push edi
call fcn.004381f0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4a6d60
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push esi
push edi
xor esi, esi
push 1
push esi
call fcn.0047a580
mov ebx, dword [esp + 0x20]
xor edx, edx
lea eax, [esp + 0x14]
cmp ebx, 0x3d
push 1
lea ecx, [esp + 0x24]
push eax
push ecx
sete dl
push edx
call fcn.004a6a60
mov edi, eax
lea eax, [ebx - 0x1f]
add esp, 0x18
cmp eax, 0x48
ja case.0x4a6da5.34
xor ecx, ecx
mov cl, byte [eax + 0x4a6f04]
jmp dword [ecx*4 + 0x4a6ef4]
mov ecx, dword [0x59f720]
mov eax, dword [esp + 0x18]
test ecx, ecx
mov esi, eax
je 0x4a6dc0
or al, 2
mov esi, eax
mov edx, dword [esp + 0x1c]
push edx
call fcn.004a6520
push eax
mov eax, dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.00437b00
mov esi, eax
add esp, 0x14
neg esi
sbb esi, esi
pop edi
inc esi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
cmp ebx, 0x67
jne 0x4a6e3c
push 0x5b9260
push 1
push str.UseMCIforFlash
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4a6e3c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push ebx
push edx
call fcn.004a6b00
mov esi, eax
add esp, 0xc
test esi, esi
je case.0x4a6da5.34
push 0
push 0
push 0x7e7
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push eax
push edi
push ecx
call fcn.004359f0
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je case.0x4a6da5.34
pop edi
pop esi
mov dword [0x5b562c], 1
pop ebx
pop ecx
ret
push 0x5b9260
push 0
push str.UseQTforMOV
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x4a6eb4
mov edx, dword [esp + 0x1c]
push edx
push ebx
push eax
call fcn.004a6b00
mov esi, eax
add esp, 0xc
test esi, esi
je case.0x4a6da5.34
push 0
push 0
push 0x7e7
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ecx
push edx
push edi
push eax
call fcn.00439380
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
mov esi, eax
push 0
push 0
push 0x7ea
push edi
call ebx
test esi, esi
je case.0x4a6da5.34
push 0
push 0
push 0x7e7
push edi
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4aa1f0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push ebx
push 0x50
push str.Save_Quality
push 0x59814c
call esi
mov edi, dword [esp + 0x10]
push ebx
push 0
push str.Save_Progressive
push 0x59814c
mov dword [edi], eax
call esi
push ebx
push 0
push str.NoSampling
push 0x59814c
mov dword [edi + 4], eax
mov dword [edi + 8], 0
call esi
push ebx
push 1
push str.KeepExif
push 0x59814c
mov dword [edi + 0xc], eax
call esi
push ebx
push 1
push str.KeepXmp
push 0x59814c
mov dword [edi + 0x10], eax
call esi
push ebx
push 1
push str.KeepCom
push 0x59814c
mov dword [edi + 0x14], eax
call esi
push ebx
push 1
push str.KeepIptc
push 0x59814c
mov dword [edi + 0x18], eax
call esi
push ebx
push 1
push str.ExifOrient
push 0x59814c
mov dword [edi + 0x1c], eax
call esi
push ebx
push 0
push str.KeepQuality
push 0x59814c
mov dword [edi + 0x20], eax
call esi
push ebx
push 0
push str.SetSize
push 0x59814c
mov dword [edi + 0x24], eax
call esi
push ebx
push 0
push str.ShowPreview
push 0x59814c
mov dword [edi + 0x28], eax
call esi
push 0x5b9260
push 0
push str.EnableSaveGray
push 0x59814c
mov dword [edi + 0x2c], eax
call esi
cmp eax, 1
jne 0x4aa2f7
push ebx
push 0
push str.Save_Grayscale
push 0x59814c
call esi
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4ad0b0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x5b5c28]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x14], esi
test eax, eax
je 0x4ad0ea
cmp edi, 0x7d5
je 0x4ad0ea
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x5b5c28], 0
mov dword [0x5b5c2c], 0
mov eax, dword [0x5b5c34]
test eax, eax
je 0x4ad104
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5b5c34], 0
lea eax, [edi - 1]
cmp eax, 0x14
ja case.0x4ad118.11
xor ecx, ecx
mov cl, byte [eax + 0x4ad344]
jmp dword [ecx*4 + 0x4ad318]
mov edx, dword [esp + 0x10]
push 0
push 0
push 0x5b9260
push str.ECW.DLL
push esi
push edx
jmp 0x4ad2af
test esi, esi
je 0x4ad162
mov ecx, dword [esp + 0x10]
mov edx, dword [0x5b5574]
lea eax, [esp + 0x14]
push eax
push 0x4abc00
push ecx
push 0x4c6
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4ad118.11
mov eax, dword [esp + 0x10]
mov ecx, dword [0x5b5574]
push 0
push 0x4abc00
push eax
push 0x4c6
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
jmp 0x4ad2b7
mov edx, dword [esp + 0x10]
push 0
push 1
push 0x5b9260
push str.JPEG2000.DLL
push esi
push edx
jmp 0x4ad2af
mov eax, dword [esp + 0x10]
push 0
push 1
push 0x5b9260
push str.JPM.DLL
push esi
push eax
jmp 0x4ad2af
push 0x5b9260
push 1
push str.Save_UseNewDLL
push 0x598da0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4ad1e5
push 0
push 1
push 0x5b9260
push str.PDF.DLL
jmp 0x4ad2a9
mov edx, dword [esp + 0x10]
push 1
push 0
push 0x5b9260
push str.IMPDF.DLL
push esi
push edx
jmp 0x4ad2af
test esi, esi
je 0x4ad228
mov ecx, dword [esp + 0x10]
mov edx, dword [0x5b5574]
lea eax, [esp + 0x14]
push eax
push 0x4ac4e0
push ecx
push 0x53c
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4ad118.11
mov eax, dword [esp + 0x10]
mov ecx, dword [0x5b5574]
push 0
push 0x4ac4e0
push eax
push 0x53c
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
jmp 0x4ad2b7
mov edx, dword [esp + 0x10]
push 0
push 1
push 0x5b9260
push str.FORMATS.DLL
push esi
push edx
jmp 0x4ad2af
mov ecx, dword [esp + 0x10]
mov edx, dword [0x5b5574]
lea eax, [esp + 0x14]
push eax
push 0x4acb60
push ecx
push 0x53d
test esi, esi
push edx
je 0x4ad240
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4ad118.11
mov eax, dword [esp + 0x10]
push 0
push 1
push 0x5b9260
push str.WEBP.DLL
push esi
push eax
jmp 0x4ad2af
push 0
push 1
push 0x5b9260
push str.JPEG_XL.DLL
mov ecx, dword [esp + 0x20]
push esi
push ecx
call fcn.004acf40
add esp, 0x18
mov dword [0x5b5c28], eax
mov eax, dword [0x5b5c28]
test eax, eax
je 0x4ad30d
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x87
push eax
mov dword [0x5b5c2c], eax
call edi
test ah, 1
je 0x4ad30d
mov edx, dword [0x5b5c2c]
push 2
push edx
call esi
push 0
push 0
push 0x87
push eax
mov dword [0x5b5c2c], eax
call edi
test ah, 1
jne 0x4ad2ec
pop edi
mov eax, 1
pop esi
ret
Function at 0x4ad810
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push ebx
push ebp
call fcn.004ad890
mov esi, dword [esp + 0x28]
add esp, 0xc
test esi, esi
mov edi, eax
jne 0x4ad848
push 0x5b9260
push esi
push str.ViewMode
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
test esi, esi
jle 0x4ad875
test edi, edi
jle 0x4ad875
cmp esi, edi
je 0x4ad875
push 0
push str.SHELLDLL_DefView
push 0
push ebp
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4ad875
push 0
push esi
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebx
push ebp
call fcn.004ad890
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4ada00
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x8ec
lea ecx, [esp]
push eax
push ecx
call fcn.00499400
add esp, 8
test eax, eax
je 0x4adaa8
lea edx, [esp]
push edi
lea eax, [esp + 0x4e0]
push edx
push eax
call fcn.004d631b
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0x234]
add esp, 8
rep stosd dword es:[edi], eax
push 0x200
lea ecx, [esp + 0x230]
push 0x2b4
push ecx
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
je 0x4ada8b
lea eax, [esp]
lea ecx, [esp + 0x234]
push eax
push ecx
lea edx, [esp + 0x4e4]
push str._s_______s_
push edx
call fcn.004d5ee1
add esp, 0x10
mov ecx, dword [esp + 0x8f0]
lea eax, [esp + 0x4dc]
push eax
push 0
push 0x143
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x8ec
ret
Function at 0x4adab0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x4f0
push ebp
push esi
mov esi, dword [esp + 0x504]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 1
push str.CommonFolders
push esi
call edi
mov ebp, dword [esp + 0x500]
test eax, eax
je 0x4adb0b
push 0x27
push ebp
call fcn.004ada00
push 0x36
push ebp
call fcn.004ada00
push 5
push ebp
call fcn.004ada00
push 0x10
push ebp
call fcn.004ada00
push 6
push ebp
call fcn.004ada00
add esp, 0x28
cmp word [0x5b96e0], 0
je 0x4adb8d
push 0x59e4b4
push esi
call fcn.004d7652
add esp, 8
test eax, eax
jne 0x4adb8d
push 0x5b96e0
call fcn.004381b0
add esp, 4
test eax, eax
je 0x4adb8d
lea eax, [esp + 0x2b4]
push 3
push eax
push 0x5b96e0
call fcn.004c93e0
add esp, 0xc
cmp word [esp + 0x2b4], 0
je 0x4adb8d
lea ecx, [esp + 0x2b4]
lea edx, [esp + 0x8c]
push ecx
push str.___s_
push edx
call fcn.004d5ee1
add esp, 0xc
lea eax, [esp + 0x8c]
push eax
push 0
push 0x143
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5b9260
push 1
push str.UseMRUDs
push str.Others
call edi
test eax, eax
je 0x4adc1c
mov edi, dword [esp + 0x504]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
inc esi
lea ecx, [esp + 0x10]
push esi
push edi
push str._s_d
push ecx
call fcn.004d5ee1
add esp, 0x10
lea edx, [esp + 0x90]
lea eax, [esp + 0x10]
push 0x5b9260
push 0x104
push edx
push 0x5aae60
push eax
push str.MRUD
call ebx
lea ecx, [esp + 0x90]
push ecx
call fcn.004d6713
add esp, 4
test eax, eax
jbe 0x4adc16
lea edx, [esp + 0x90]
push edx
push 0
push 0x143
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x14
jl 0x4adbb4
pop ebx
push 0
push 0
push 0x14e
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
add esp, 0x4f0
ret