joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499110
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x564]
mov dword [ebp + 0x48], 0
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 0
call edx
mov ecx, eax
add ecx, 0x1a73
call section..text
push 0
mov ecx, 0x1a7f
call section..text
mov ecx, dword [0x4e55e0]
add esp, 8
push 0
push str.drv_local_drvtype_assess_option
mov ebx, str.maindrvlocalbtn
call fcn.0044c5b0
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
xor ebx, ebx
push ebx
call edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
push ebx
call edx
push 0xe
mov ecx, ebp
call fcn.0041b810
lea ecx, [esp + 0x30]
call fcn.0048d000
mov dword [esp + 0x58], ebx
mov esi, str.STR_EVALUATE_GETTING
lea edi, [esp + 0x14]
call fcn.0040ba70
mov esi, eax
mov byte [esp + 0x58], 1
mov eax, dword [ebp + 0x40]
lea ecx, [eax + 0x530]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
push eax
mov eax, dword [ebp + 0x48]
push eax
mov ecx, esi
call fcn.0048cdd0
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0048d0b0
add esp, 0x10
mov byte [esp + 0x58], bl
mov ecx, edi
call fcn.0048cfe0
lea ecx, [esp + 0x30]
call fcn.0048cdd0
mov edx, dword [ebp + 0x1c]
push eax
push str.f_4_s
push edx
call dword [sym.imp.DTLUI.dll_public:_void___cdecl_DuiLib::CLabelUI::SetFormatText_wchar_t_const__]
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
add esp, 0xc
push 0x49f68c
call edx
mov ecx, dword [ebp + 0x3c]
push ebx
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CProgressUI::SetValue_int_]
mov ecx, dword [ebp + 0x3c]
push 1
push 0x32
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CProgressUI::BeginTask_int__int_]
mov eax, dword [ebp + 0x40]
push 0x28
call fcn.0043f520
call fcn.004120d0
mov ecx, dword [ebp + 0x3c]
push ecx
push ebx
push 0x465
mov ecx, eax
mov byte [eax + 0x38], 1
mov byte [eax + 0x39], bl
mov byte [eax + 0x3c], bl
mov dword [eax + 0x18], ebp
call fcn.004897f0
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.0048cfe0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00470f4c
add esp, 0x48
ret 4
Function at 0x41ad70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49617a
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x14], eax
call fcn.0048d000
mov dword [esp + 0x128], 0
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + 0x530]
mov eax, ecx
mov edx, dword [eax + 0x564]
lea ecx, [eax + 0x564]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [esi]
push eax
add ecx, 0x530
call edx
mov esi, eax
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0046aa00
mov dword [esp + 0x14], eax
mov byte [esp + 0x128], 1
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x78]
push eax
mov ecx, esi
call edx
mov dword [esp + 0x18], eax
mov byte [esp + 0x128], 2
mov esi, str.STR_EVALUATE_CUR_DOWN
lea edi, [esp + 0x40]
call fcn.0040ba70
mov esi, eax
mov byte [esp + 0x128], 3
mov ecx, dword [esp + 0x14]
call fcn.0048cdd0
mov ecx, dword [esp + 0x18]
push eax
call dword [sym.imp.DTLUI.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
mov ecx, esi
call fcn.0048cdd0
push eax
lea eax, [esp + 0x108]
push eax
call fcn.0048d0b0
add esp, 0x10
mov byte [esp + 0x128], 2
mov ecx, edi
call fcn.0048cfe0
mov byte [esp + 0x128], 1
lea ecx, [esp + 0x78]
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov byte [esp + 0x128], 0
lea ecx, [esp + 0x5c]
call fcn.0048cfe0
lea ecx, [esp + 0xfc]
call fcn.0048cdd0
mov ecx, dword [ebx + 0x1c]
push eax
push str.f_4_s_f
push ecx
call dword [sym.imp.DTLUI.dll_public:_void___cdecl_DuiLib::CLabelUI::SetFormatText_wchar_t_const__]
add esp, 0xc
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x2c], 4
call edx
mov dword [esp + 0x128], 0xffffffff
lea ecx, [esp + 0xfc]
call fcn.0048cfe0
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00470f4c
mov esp, ebp
pop ebp
ret 8
Function at 0x41c470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x498ef3
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x294], ebx
mov ebp, dword [esp + 0x29c]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x18], ebx
call fcn.0040a180
add esp, 4
mov dword [esp + 0x294], 1
mov ecx, eax
call fcn.0048cdd0
xor ecx, ecx
mov word [esp + 0x5c], cx
mov edi, 7
mov ecx, eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
lea esi, [ecx + 2]
jmp 0x41c500
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x41c500
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x5c]
call fcn.00403b50
mov byte [esp + 0x294], 3
lea ecx, [esp + 0x3c]
call fcn.0048cfe0
xor edx, edx
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], dx
push 0x20a
lea eax, [esp + 0x78]
push ebx
push eax
mov dword [esp + 0x20], 1
call fcn.00473d50
add esp, 0xc
call fcn.00403860
mov ecx, dword [eax]
lea edx, [esp + 0x74]
mov esi, str.STR_OPTION_SELECTBACKUP_DIR
lea edi, [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
call fcn.0040ba70
mov byte [esp + 0x294], 4
mov ecx, eax
call fcn.0048cdd0
mov dword [esp + 0x24], eax
mov byte [esp + 0x294], 3
mov ecx, edi
call fcn.0048cfe0
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x6c], ebx
ja 0x41c5a7
call fcn.00470818
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x41c5b6
lea eax, [esp + 0x5c]
movzx eax, word [eax]
push eax
call fcn.0041c680
sub eax, 2
neg eax
sbb eax, eax
lea ecx, [esp + 0x18]
and eax, 0x41c380
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, eax
cmp edi, ebx
je 0x41c622
lea edx, [esp + 0x74]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x41c61b
lea eax, [esp + 0x74]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41c600
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x78]
mov esi, ebp
call fcn.00403b50
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0x294], bl
cmp dword [esp + 0x70], 8
jb 0x41c63d
mov eax, dword [esp + 0x5c]
push eax
call fcn.00471099
add esp, 4
xor ecx, ecx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], cx
mov eax, ebp
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.00470f4c
add esp, 0x284
ret 4
Function at 0x41c680
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x49115b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.0048a2d0
add esp, 4
xor ebx, ebx
mov dword [esp + 0x13c], ebx
cmp dword [esp + 0x28], ebx
ja 0x41c6dc
call fcn.00470818
mov eax, dword [esp + 0x18]
mov edi, 8
cmp dword [esp + 0x2c], edi
jae 0x41c6ef
lea eax, [esp + 0x18]
mov cx, word [eax]
cmp cx, word [esp + 0x144]
jne 0x41c7d8
push 0xfe
lea eax, [esp + 0x36]
xor edx, edx
push ebx
push eax
mov word [esp + 0x3c], dx
call fcn.00473d50
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea esi, [esp + 0x30]
cmp word [esp + 0x30], bx
je 0x41c7ae
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
call edi
movzx eax, word [esi]
mov edx, 0x41
cmp dx, ax
je 0x41c764
mov ecx, 0x42
cmp cx, ax
je 0x41c764
push esi
call ebp
cmp eax, 3
jne 0x41c764
inc ebx
add esi, 8
cmp word [esi], 0
jne 0x41c741
cmp ebx, 1
jle 0x41c7a7
mov dword [esp + 0x13c], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x41c791
mov edx, dword [esp + 0x18]
push edx
call fcn.00471099
add esp, 4
xor eax, eax
mov word [esp + 0x18], ax
mov dword [esp + 0x28], 0
mov eax, 2
jmp 0x41c803
mov edi, 8
xor ebx, ebx
mov dword [esp + 0x13c], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x41c7cc
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00471099
add esp, 4
xor edx, edx
mov word [esp + 0x18], dx
lea eax, [edx + 1]
jmp 0x41c7ff
mov dword [esp + 0x13c], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x41c7f6
mov eax, dword [esp + 0x18]
push eax
call fcn.00471099
add esp, 4
xor ecx, ecx
mov word [esp + 0x18], cx
xor eax, eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 7
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00470f4c
add esp, 0x12c
ret 4
Function at 0x421630
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x49173a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor ebx, ebx
push ebx
mov ecx, 0x1981
mov dword [esp + 0x18], ebx
call section..text
mov eax, dword [edi + 0x40]
add esp, 4
push esi
call fcn.004373a0
mov ecx, dword [eax + 0x584]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc4]
call edx
mov ecx, eax
call dword [sym.imp.DTLUI.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
call fcn.0047160c
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x40]
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 2
call fcn.00443070
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x1c]
call fcn.0046c2a0
mov dword [esp + 0x64], ebx
mov ecx, eax
call fcn.0048cd90
test eax, eax
setg bl
mov dword [esp + 0x64], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0048cfe0
test bl, bl
je 0x421795
lea edx, [esp + 0x40]
push edx
call fcn.0046c2a0
mov esi, 1
mov dword [esp + 0x64], esi
mov ebx, esi
mov ecx, eax
mov dword [esp + 0x14], ebx
call fcn.0048cdd0
push eax
call fcn.0048a660
add esp, 4
test al, al
je 0x421749
lea eax, [esp + 0x24]
push eax
call fcn.0046c2a0
mov dword [esp + 0x64], 2
mov ebx, 3
mov ecx, eax
mov dword [esp + 0x14], ebx
call fcn.0048cdd0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x13], 0
test eax, eax
je 0x42174e
mov byte [esp + 0x13], 1
mov dword [esp + 0x64], esi
test bl, 2
je 0x421767
and ebx, 0xfffffffd
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], ebx
call fcn.0048cfe0
mov dword [esp + 0x64], 0xffffffff
test bl, 1
je 0x421784
and ebx, 0xfffffffe
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], ebx
call fcn.0048cfe0
cmp byte [esp + 0x13], 0
jne 0x421795
push 7
call fcn.0045aab0
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x58
ret
Function at 0x428860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x495a78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call fcn.00403860
mov eax, dword [eax]
push 0
push 0x1388
push 0x3ea
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebx + 0x40]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe4]
push 1
call edx
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
push 0
call edx
mov ecx, dword [ebx + 0x34]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
push 0
call edx
mov ecx, dword [ebx + 0x8c]
push 0
call dword [sym.imp.DTLUI.dll_public:_bool___thiscall_DuiLib::CTabLayoutUI::SelectItem_int_]
mov esi, str.STR_PNP_QUERYDRIVER
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 0
mov ecx, dword [ebx + 0x10]
mov esi, dword [ecx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x10]
mov edx, dword [esi + 0x2c]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
push 0xffffffffffffffff
mov esi, ebx
call fcn.00428d00
mov eax, dword [ebx + 0x28]
push 0x4b5d6c
push 0
mov byte [eax + 0xd5c], 1
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x428952
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x428952
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.00429f50
push 0
push 0
push 0x465
mov ecx, eax
call fcn.004897f0
call fcn.004120d0
push 0
push 0
push 0x46b
mov ecx, eax
call fcn.004897f0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret

Function at 0x42b070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x495a78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 1
mov ecx, ebx
call fcn.0042bb10
mov eax, dword [0x4e5324]
test eax, eax
je 0x42b0c7
call eax
test al, al
je 0x42b0c7
mov ecx, dword [ebx + 0x44]
call fcn.00439440
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov eax, dword [ebx + 0x44]
lea ecx, [eax + 0x530]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov esi, str.STR_PRINTER_SEARCH_FAILED
lea edi, [esp + 0xc]
call fcn.0040ba70
mov esi, eax
mov dword [esp + 0x30], 0
call fcn.00403860
mov edi, dword [eax]
mov ecx, esi
call fcn.0048cdb0
push 0
push 0x10
push 0
push 0
push 0
push eax
push edi
call fcn.004528c0
add esp, 0x1c
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0048cfe0
push 3
mov ecx, ebx
call fcn.0042bb10
mov ecx, dword [ebx + 0x44]
call fcn.00439570
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x42e7c0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
lea esi, [edi + 0x40]
push esi
call fcn.0042ec70
mov ecx, eax
call fcn.0045e5b0
lea ebp, [edi + 0x2c]
mov edi, ebp
mov ebx, 5
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe4]
push 0
call edx
add edi, 4
sub ebx, 1
jne 0x42e7e0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x42e88b
cmp ebx, 0x1a4
jge 0x42e88b
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x42e839
call fcn.0047198a
mov edx, dword [esi + 0xc]
cmp dword [ebx + edx + 0x50], 8
lea eax, [ebx + edx + 0x38]
jb 0x42e84c
mov eax, dword [eax + 4]
jmp 0x42e84f
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e869
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe4]
push 1
call edx
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 4
add ebx, 0x54
cmp edi, eax
jb 0x42e811
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42e890
Capabilities:
Check if file exists

Disassembly:
push ebp
push esi
mov esi, eax
push edi
mov eax, 0x30c30c31
cmp esi, 0xffffffff
je 0x42e957
mov ecx, dword [ebx + 0x50]
sub ecx, dword [ebx + 0x4c]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x42ea4e
mov ecx, dword [ebx + 0x50]
sub ecx, dword [ebx + 0x4c]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jb 0x42e8dd
call fcn.0047198a
mov edx, dword [ebx + 0x4c]
mov edi, esi
imul edi, edi, 0x54
lea eax, [edi + edx + 0x38]
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x42e8f8
mov eax, dword [eax + 4]
jmp 0x42e8fb
add eax, 4
mov ecx, dword [ebx + 0xc]
push eax
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CButtonUI::SetNormalImage_wchar_t_const__]
mov ecx, dword [ebx + 0x50]
sub ecx, dword [ebx + 0x4c]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x42e925
call fcn.0047198a
mov eax, dword [ebx + 0x4c]
add eax, edi
cmp dword [eax + 0x18], ebp
jb 0x42e934
mov eax, dword [eax + 4]
jmp 0x42e937
add eax, 4
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xcc]
call eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd4]
push esi
call eax
pop edi
pop esi
pop ebp
ret
mov ecx, dword [ebx + 0x50]
sub ecx, dword [ebx + 0x4c]
mov edi, dword [0x4e5710]
lea esi, [ebx + 0x40]
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jae 0x42ea44
cmp edi, 5
jge 0x42ea44
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x42e9a3
call fcn.0047198a
mov ecx, dword [esi + 0xc]
imul edi, edi, 0x54
lea eax, [edi + ecx + 0x38]
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x42e9bc
mov eax, dword [eax + 4]
jmp 0x42e9bf
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ea3a
mov edx, dword [0x4e5710]
mov ecx, dword [ebx + edx*4 + 0x2c]
push 1
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CCheckBoxUI::SetCheck_bool_]
mov edi, dword [0x4e5710]
call fcn.0042eac0
add eax, 0x38
cmp dword [eax + 0x18], ebp
jb 0x42e9f4
mov eax, dword [eax + 4]
jmp 0x42e9f7
add eax, 4
mov ecx, dword [ebx + 0xc]
push eax
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CButtonUI::SetNormalImage_wchar_t_const__]
mov edi, dword [0x4e5710]
call fcn.0042eac0
cmp dword [eax + 0x18], ebp
jb 0x42ea16
mov eax, dword [eax + 4]
jmp 0x42ea19
add eax, 4
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xcc]
call eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov eax, dword [0x4e5710]
mov edx, dword [edx + 0xd4]
push eax
call edx
inc dword [0x4e5710]
pop edi
pop esi
pop ebp
ret
mov dword [0x4e5710], 0
pop edi
pop esi
pop ebp
ret
Function at 0x4324e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x497860
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebx + 4]
push eax
call fcn.0041d040
mov ecx, dword [ebx + 8]
push ecx
call fcn.004193c0
mov esi, str.STR_MANUAL_DRIVERUPDATE
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 0
mov edx, dword [ebx + 0x18]
mov esi, dword [edx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x18]
push eax
mov eax, dword [esi + 0x2c]
call eax
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
mov esi, str.STR_MAIN_TAB_ASSESS
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 1
mov ecx, dword [ebx + 0x1c]
mov esi, dword [ecx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esi + 0x2c]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret

Function at 0x432a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x497828
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebx + 4]
push eax
call fcn.00413490
mov ecx, dword [ebx + 8]
push ecx
call fcn.00424700
mov edx, dword [ebx + 0xc]
push edx
call fcn.00425af0
mov esi, str.STR_MAIN_TAB_BACK
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 0
mov ecx, dword [ebx + 0x14]
mov esi, dword [ecx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x14]
mov edx, dword [esi + 0x2c]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
mov esi, str.STR_MAIN_TAB_RESTORE
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 1
mov ecx, dword [ebx + 0x18]
mov esi, dword [ecx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x18]
mov edx, dword [esi + 0x2c]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
mov esi, str.STR_MAIN_TAB_REMOVE
lea edi, [esp + 0xc]
call fcn.0040ba70
mov dword [esp + 0x30], 2
mov ecx, dword [ebx + 0x1c]
mov esi, dword [ecx]
mov ecx, eax
call fcn.0048cdb0
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esi + 0x2c]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov ecx, edi
call fcn.0048cfe0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x433e00
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 4], 0
push edi
je 0x433e5a
mov ecx, dword [esi + 0x58c]
mov edi, dword [sym.imp.DTLUI.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const]
test ecx, ecx
je 0x433e22
call edi
cmp eax, dword [esi + 0x594]
jne 0x433e5a
mov ecx, dword [esi + 0x590]
test ecx, ecx
je 0x433e36
call edi
cmp eax, dword [esi + 0x598]
jne 0x433e5a
mov eax, dword [esi + 0x588]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x433e7a
mov ecx, dword [esi + 0x588]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret 4
mov edx, dword [esi + 0x588]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x433e7a
mov eax, dword [esi + 0x588]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret 4