joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410040
Capabilities:
Get common file path
Hide graphical window

Disassembly:
sub esp, 0x68
lea eax, [esp]
push ebx
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
cmp eax, ebx
je 0x41005c
cmp eax, 0x64
jle 0x410068
mov cx, word [0x46f7a4]
mov word [esp + 4], cx
push esi
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xb]
mov cl, byte [esp + ecx + 0xb]
cmp cl, 0x5c
je 0x41008a
cmp cl, 0x2f
jne 0x41008c
mov byte [eax], bl
lea edx, [esp + 0xc]
push edx
push str._s_contour
push 0x745cf4
call fcn.00460709
push 0x745cf4
call fcn.004606dd
mov ecx, 0x12
mov esi, 0xa66fa0
mov edi, 0x745d88
mov eax, dword [esp + 0x88]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x870dd4]
mov edx, dword [0x870dd8]
mov dword [0x745e70], eax
mov eax, 0x16
add ecx, 0xffffffea
add edx, 0xffffffea
movsw word es:[edi], word [esi]
push 2
mov dword [0x46f770], 0
mov dword [0x46f774], 0xbff00000
mov word [0xa66fd4], bx
mov word [0xa66fd6], bx
mov word [0xa66fd8], bx
mov word [0xa66fda], bx
mov word [0xa66fdc], bx
mov word [0xa66fde], bx
mov dword [0x870eb0], ebx
mov dword [0xba062a], eax
mov dword [0xba062e], ecx
mov dword [0xba0632], eax
mov dword [0xba0636], edx
call fcn.00415950
mov eax, dword [0xa77a40]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
add esp, 0x14
push 1
push 0x9c4f
push eax
call esi
mov ecx, dword [0xa77a40]
push 1
push 0x9c58
push ecx
call esi
mov edx, dword [0xa77a40]
push 1
push 0x9c5c
push edx
call esi
mov eax, dword [0xa77a40]
push 1
push 0x9c5d
push eax
call esi
mov ecx, dword [0x870e3c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ecx
call esi
mov eax, dword [0x870e68]
push 5
push eax
mov dword [0x870e3c], eax
call esi
mov edx, dword [0x870e40]
push ebx
push edx
call esi
mov eax, dword [0x870e4c]
push 5
push eax
call esi
mov edx, dword [0x870e3c]
mov ecx, dword [0x870e4c]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push edx
mov dword [0x870e40], ecx
call esi
push eax
mov dword [0x870e78], eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x870e3c]
push ebx
push eax
call fcn.00440dc0
mov eax, dword [0x745e70]
mov ecx, dword [0x870eac]
add esp, 8
cmp eax, 2
mov dword [0x745d74], ecx
jne 0x410258
call fcn.004135f0
mov edx, dword [0x46f76c]
mov eax, dword [0x870e3c]
add edx, 0x5cb
push edx
push 0x5ce
push 0x5cb
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
call fcn.004415d0
mov ecx, dword [0x870e3c]
push ebx
push 0x417
push ecx
call esi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
mov edx, dword [0x870e40]
push ebx
push edx
call esi
mov eax, dword [0x870eac]
pop edi
cmp eax, ebx
pop esi
je 0x41026d
mov dword [0x870eac], ebx
push 1
jmp 0x41026e
push ebx
push ebx
push 1
call fcn.00446e00
mov eax, dword [0x870e40]
add esp, 0xc
push 1
push eax
call fcn.00445aa0
add esp, 8
pop ebx
add esp, 0x68
ret
Function at 0x420070
Capabilities:
Get common file path

Disassembly:
sub esp, 0x68
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
cmp eax, ebx
je 0x42008e
cmp eax, 0x64
jle 0x42009a
mov cx, word [0x46f7a4]
mov word [esp + 0xc], cx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xb]
mov cl, byte [esp + ecx + 0xb]
cmp cl, 0x5c
je 0x4200ba
cmp cl, 0x2f
jne 0x4200bc
mov byte [eax], bl
lea edx, [esp + 0xc]
push edx
push str._s_dicom
push 0x7633b0
call fcn.00460709
lea eax, [esp + 0x18]
push eax
push str._s_dicom_print
push 0x75f028
call fcn.00460709
push 0x7633b0
call fcn.004606dd
push 0x75f028
call fcn.004606dd
add esp, 0x20
push 0x100
push 0x7631a4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x420133
mov ecx, dword [str.dicom.hosts]
mov edx, dword [0x47009c]
mov eax, dword [0x4700a0]
mov dword [0x7631a4], ecx
mov dword [0x7631a8], edx
mov dword [0x7631ac], eax
jmp 0x420160
mov edi, 0x470088
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x7631a4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebx
call fcn.00461336
push eax
call fcn.0046130e
push 1
call fcn.004292f0
push 5
call fcn.004292f0
push 2
call fcn.004292f0
push 3
call fcn.004292f0
push 4
call fcn.004292f0
mov edx, dword [0xa7bcc0]
add esp, 0x1c
cmp edx, ebx
mov byte [0x75fb07], 2
mov byte [0x75fb06], bl
mov dword [0x75faa0], 1
je 0x42026f
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 7
jb 0x42026f
xor esi, esi
cmp dword [0x474b3c], 1
jle 0x4201f4
movsx eax, byte [edx + esi]
push 4
push eax
call fcn.0046086c
mov edx, dword [0xa7bcc0]
add esp, 8
jmp 0x420203
movsx ecx, byte [edx + esi]
mov eax, dword [str.________________________________H]
mov al, byte [eax + ecx*2]
and eax, 4
cmp eax, ebx
je 0x42026f
inc esi
cmp esi, 7
jl 0x4201d4
cmp dword [0x75faa0], ebx
je 0x420275
movsx eax, byte [edx + 5]
push 5
push edx
lea ecx, [eax + eax*4]
movsx eax, byte [edx + 6]
lea esi, [eax + ecx*2 - 0x210]
lea ecx, [esp + 0x14]
push ecx
call fcn.00461210
mov edx, dword [0xa7bcc0]
add esp, 0xc
xor ecx, ecx
xor eax, eax
movsx edi, byte [edx + eax]
inc eax
cmp eax, 5
lea ecx, [ecx + edi - 0x30]
jl 0x420241
cmp ecx, esi
jne 0x42026f
push 0x75faa0
lea edx, [esp + 0x10]
push 0x470084
push edx
call fcn.00460ce0
add esp, 0xc
cmp eax, 1
je 0x420275
mov dword [0x75faa0], ebx
call fcn.00426c10
push ebx
call fcn.00426900
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x68
ret
Function at 0x429810
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push str.PrinterSettings
push eax
call fcn.00460709
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push 0x763430
push 0x763778
push str.SERVERNODE
push ecx
call esi
push str.3DVIEW.INI
lea edx, [esp + 0x18]
push 0x40
push edx
push 0x470ebc
lea eax, [esp + 0x14]
push str.PORTNR
push eax
call esi
push 0x763470
lea ecx, [esp + 0x18]
push 0x470084
push ecx
call fcn.00460ce0
add esp, 0xc
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x10
push 0x763472
push str.ANY_SCP
push str.CALLEDNAME
push edx
call esi
push str.3DVIEW.INI
push 0x10
push 0x763482
push str.ANY_SCU
lea eax, [esp + 0x14]
push str.CALLINGNAME
push eax
call esi
push str.3DVIEW.INI
lea ecx, [esp + 0x18]
push 0x40
push ecx
push 0x470e88
lea edx, [esp + 0x14]
push str.IMGPERPAGE
push edx
call esi
push 0x763492
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
mov al, byte [0x763492]
add esp, 0xc
cmp al, 1
je 0x42990b
cmp al, 2
je 0x42990b
cmp al, 3
je 0x42990b
cmp al, 4
je 0x42990b
cmp al, 8
je 0x42990b
mov byte [0x763492], 4
push str.3DVIEW.INI
lea ecx, [esp + 0x18]
push 0x40
push ecx
push 0x470e1c
lea edx, [esp + 0x14]
push str.FILMSIZE
push edx
call esi
push 0x763493
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.MEDIUM
push edx
call esi
push 0x763494
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.PRIORITY
push edx
call esi
push 0x763495
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.DESTINATION
push edx
call esi
push 0x763496
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.BORDERDENS
push edx
call esi
push 0x763497
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.EMPTYDENS
lea edx, [esp + 0x18]
push edx
call esi
push 0x763498
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.PREFERGRAY
push edx
call esi
push 0x763499
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push str.3DVIEW.INI
push 0x40
push ecx
push 0x470e1c
push str.TRIMVAL
push edx
call esi
push 0x76349a
lea eax, [esp + 0x18]
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
mov eax, 1
pop esi
add esp, 0x50
ret
Function at 0x42bfd0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [0x763774]
sub esp, 0x12c
test eax, eax
push esi
je 0x42c013
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42bff8
pop esi
add esp, 0x12c
ret
cmp dword [esp + 4], 0x103
jne 0x42c0fd
mov eax, 1
pop esi
add esp, 0x12c
ret
push 0x7633b0
lea edx, [esp + 0xb4]
push str._s_look.ver
push edx
call fcn.00460709
lea eax, [esp + 0xbc]
push 0
push eax
call fcn.0046075b
add esp, 0x14
cmp eax, 0xffffffff
je 0x42c0fd
lea ecx, [esp + 0xb0]
push 0x46f874
push ecx
call fcn.00460b0b
mov esi, eax
add esp, 8
test esi, esi
je 0x42c0fd
push esi
lea edx, [esp + 0x64]
push 0x50
push edx
call fcn.00460d14
push esi
lea eax, [esp + 0x70]
push 0x50
push eax
call fcn.00460d14
push esi
lea ecx, [esp + 0x7c]
push 0x50
push ecx
call fcn.00460d14
push esi
call fcn.004609ad
lea edx, [esp + 0x30]
lea eax, [esp + 0x88]
push edx
push 0x470084
push eax
call fcn.00460ce0
add esp, 0x34
cmp eax, 1
jne 0x42c0fd
mov ecx, dword [esp + 8]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42c0fd
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42c0f6
cmp dword [esp + 4], 0x103
jne 0x42c0f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x12c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
push 0x75f028
mov dword [esp + 0x18], eax
push 0x7633b0
mov dword [esp + 0x20], eax
push str.dicomctl__d__s__p__s__e
push 0x762d14
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 0x81
mov word [esp + 0x60], 2
call fcn.00460709
push 0xa67320
call fcn.00460b1e
add esp, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0
push 8
push 0
push 0
push 0
push 0x762d14
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x42c18d
mov dword [0x763774], eax
pop esi
add esp, 0x12c
ret
mov eax, dword [esp + 0xc]
mov dword [0x763774], eax
call fcn.00449130
mov eax, 1
pop esi
add esp, 0x12c
ret
Function at 0x42fa40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x70
lea eax, [esp]
push edi
push eax
push 1
push 0
push str.SOFTWAREKretztechnik_AG3D_VIEW4.0
push 0x80000002
or edi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42fa6c
or eax, 0xffffffff
pop edi
add esp, 0x70
ret
push ebx
lea ecx, [esp + 0xc]
push esi
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Language
push ecx
mov dword [esp + 0x28], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42fbf3
mov esi, str.English
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42fad0
test cl, cl
je 0x42facc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42fad0
add eax, 2
add esi, 2
test cl, cl
jne 0x42faa8
xor eax, eax
jmp 0x42fad5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fae3
push 0x409
jmp 0x42fbeb
mov esi, str.German
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42fb14
test cl, cl
je 0x42fb10
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42fb14
add eax, 2
add esi, 2
test cl, cl
jne 0x42faec
xor eax, eax
jmp 0x42fb19
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fb27
push 0x407
jmp 0x42fbeb
mov esi, str.French
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42fb58
test cl, cl
je 0x42fb54
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42fb58
add eax, 2
add esi, 2
test cl, cl
jne 0x42fb30
xor eax, eax
jmp 0x42fb5d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fb6b
push 0x40c
jmp 0x42fbeb
mov esi, str.Spanish
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42fb9c
test cl, cl
je 0x42fb98
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42fb9c
add eax, 2
add esi, 2
test cl, cl
jne 0x42fb74
xor eax, eax
jmp 0x42fba1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fbac
push 0x40a
jmp 0x42fbeb
mov esi, str.Italian
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42fbdd
test cl, cl
je 0x42fbd9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42fbdd
add eax, 2
add esi, 2
test cl, cl
jne 0x42fbb5
xor eax, eax
jmp 0x42fbe2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fbf3
push 0x410
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop ebx
pop edi
add esp, 0x70
ret
Function at 0x434b20
Capabilities:
Get common file path

Disassembly:
push 0x86e864
push 0x41
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x434b36
cmp eax, 0x41
jle 0x434b42
mov ax, word [0x46f7a4]
mov word [0x86e864], ax
push ebx
push ebp
push esi
push edi
mov edi, str._tmp.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x86e864
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00434c40
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0x86e864
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x86e864
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll__lcreat]
mov edi, eax
cmp edi, 0xffffffff
jne 0x434bbc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp ebx, 0x800
mov esi, 0x800
ja 0x434bd3
mov esi, ebx
push esi
push 0x870498
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, esi
jne 0x434bfb
push esi
push 0x870498
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, esi
jne 0x434bfb
sub ebx, esi
je 0x434c16
jmp 0x434bc4
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push 0x86e864
call fcn.00461b10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
cmp eax, 0xffffffff
jne 0x434c36
push 0x86e864
call fcn.00461b10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0x86e864
pop ebx
ret
Function at 0x43db30
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [0x473e68]
mov eax, 3
cmp ecx, eax
push esi
jne 0x43dba5
cmp byte [0xa77afa], al
jne 0x43db72
call fcn.00415900
test al, al
je 0x43db72
mov esi, dword [esp + 8]
push 5
push 0x3ea
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x86e820]
push eax
jmp 0x43db92
mov esi, dword [esp + 8]
push 0
push 0x3ea
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x86e860]
push ecx
push 0
push 0xf7
push 0x3ea
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop esi
ret
Function at 0x446f40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebp
call fcn.00449110
mov eax, dword [0x870e24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ebp, ebp
mov dword [0x86db80], eax
cmp eax, ebp
jne 0x446f71
mov word [0xa77ade], bp
call fcn.00449130
pop ebp
add esp, 0xc
ret
movsx eax, word [0xa77ae0]
cdq
push ebx
push esi
mov esi, eax
push edi
xor esi, edx
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
sub esi, edx
mov edx, dword [0x870e40]
inc esi
mov ecx, esi
mov dword [esp + 0x18], esi
and ecx, 0xffff
shl ecx, 0x10
push ecx
push ebp
push 0x401
push 0x442
push edx
call edi
mov eax, dword [0x870e40]
push ebp
push 1
push 0x404
push 0x442
push eax
call edi
mov ecx, dword [0x870e40]
push ebp
push ebp
push 0x402
push 0x442
push ecx
call edi
mov edx, dword [0x870e40]
push 5
push 0x442
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x86e9e8]
mov cx, word [0xa77ae0]
cmp eax, 0x4b
movsx edx, cx
jne 0x447016
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul dword [0x46c758]
jmp 0x447023
imul edx, eax
neg edx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
mov dl, byte [0xa77af6]
cmp cx, bp
fstp dword [0xa77b28]
mov byte [0xa77b24], dl
jge 0x44704f
cmp eax, 0x4b
jne 0x447047
fld qword [0x46c730]
jmp 0x447064
fild dword [0x86e9e8]
jmp 0x447064
cmp eax, 0x4b
jne 0x44705c
fld qword [0x46c750]
jmp 0x447064
fild dword [0x86e9e8]
fchs
fmul qword [0x46c4c8]
xor ebx, ebx
cmp esi, ebp
fstp qword [esp + 0x10]
jle 0x447116
jmp 0x447080
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea eax, [ebx + 1]
mov word [0xa77ade], ax
call fcn.00445460
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.00445fd0
mov ecx, dword [0x870e40]
add esp, 0x10
push 0
push 0
push 0x405
push 0x442
push ecx
call edi
call fcn.0043b3f0
mov edx, dword [0xa77b48]
push 1
push 0
push edx
call fcn.00434ff0
mov eax, dword [0x86db80]
mov ecx, 0x4000
mov esi, 0xbe3d40
add esp, 0xc
lea edi, [eax + ebp]
mov eax, dword [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x86db80]
inc ebx
mov ecx, 0x4000
mov esi, 0xbd3d20
lea edi, [edx + ebp + 0x10000]
add ebp, 0x20000
cmp ebx, eax
rep movsd dword es:[edi], dword [esi]
jl 0x44707a
mov eax, dword [0x870e40]
push 0
push 0x442
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x870e24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x86db80], 0
call fcn.00449130
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x44b7c0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x870de8]
sub esp, 0x24
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
jne 0x44b7db
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x24
ret
mov ecx, dword [eax]
push 0x104
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, ebp
jne 0x44b7f6
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x24
ret
mov edi, dword [esp + 0x34]
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x44b821
mov eax, dword [0x870de8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x24
ret
mov edx, dword [esp + 0xc]
push ebx
push 0x68
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
call fcn.0044b970
add esp, 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 2
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov ebx, eax
cmp ebx, ebp
je 0x44b896
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x44b88a
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
push edi
push esi
push ebp
call fcn.00461210
mov byte [edi + ebp - 1], 0
add esp, 0xc
mov ebp, 1
mov eax, dword [0x870de8]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [0x870de8]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [0x870de8]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x24
ret

Function at 0x44b9c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x870ed4]
test eax, eax
mov eax, dword [0x870ed8]
je 0x44ba5f
test eax, eax
je 0x44ba74
mov eax, dword [0x870e64]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0x5c8
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [0x870e64]
push 0
push 0x58d
push ecx
call esi
push eax
call edi
mov edx, dword [0x870e64]
push 0
push 0x5c6
push edx
call esi
push eax
call edi
mov eax, dword [0x870e64]
push 0
push 0x5c7
push eax
call esi
push eax
call edi
mov ecx, dword [0x870ed8]
mov edx, dword [0x870e64]
push ecx
push 0
push 0x172
push 0x5c5
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop edi
mov dword [0x870ed4], 0
pop esi
ret
test eax, eax
je 0x44ba74
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x870ed8], 0
mov eax, dword [0x870e64]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x870e64], 0
ret

Function at 0x44bba0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x870eec]
test eax, eax
jne 0x44bbf5
mov eax, dword [esp + 4]
test eax, eax
je 0x44bbe1
mov eax, dword [esp + 8]
mov dword [0x86eb5c], eax
mov eax, dword [0x86dba0]
test eax, eax
jne 0x44bbf5
push 0x86e81c
push 0
push 0
push 0x44bc00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x86e830], eax
ret
mov dword [0x86eb5c], 0
mov dword [0x86dba0], 0
ret
Function at 0x452bf0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x452c7f
mov eax, dword [0x87d858]
test eax, eax
mov eax, dword [esp + 8]
jne 0x452c6b
mov dword [0xa7bcf8], eax
mov eax, dword [0x4747d0]
test eax, eax
je 0x452c2b
push 0
call fcn.004559a0
add esp, 4
mov dword [0x4747d0], 0
push 0
call fcn.00454b90
mov ecx, dword [0xa77b48]
push ecx
call fcn.00452db0
add esp, 8
mov dword [0x87d858], eax
test eax, eax
je 0x452cb8
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x87d858]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x87d85c], 1
ret
push eax
call fcn.00452cc0
add esp, 4
mov dword [0x87d85c], 1
ret
mov eax, dword [0x87d85c]
test eax, eax
je 0x452cb8
mov ecx, dword [0x87d858]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x87d858]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x87d858], 0
mov dword [0x87d85c], 0
ret

Function at 0x4553d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push str.3dview.ini
push 0x20
push eax
push 0x4748ec
push str.UsedColor
push str.Colors
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 4], 0x2a
je 0x455417
lea edx, [esp]
lea eax, [esp + 4]
push edx
push 0x46f7c4
push eax
call fcn.00460ce0
add esp, 0xc
cmp eax, 1
je 0x455421
mov ecx, dword [0x47482c]
mov dword [esp], ecx
mov edx, dword [esp]
push edx
call fcn.00455430
add esp, 0x28
ret

Function at 0x46075b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46077b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004635e1
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x46079c
test byte [esp + 8], 2
je 0x46079c
mov dword [0x87d89c], 0xd
mov dword [0x87d8a0], 5
jmp 0x460777
xor eax, eax
ret