joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488760
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 0x119c]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x48877a
push 0
push eax
call edi
jmp 0x48878e
mov eax, dword [esi + 0x1198]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x1198], 6
cmp dword [esi + 0x4f4], 0
lea ebx, [esi + 0x334]
je 0x4887b8
cmp byte [ebx + 0x113], 0
je 0x4887b8
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
cmp dword [esi + 0x7a0], 0
lea ebx, [esi + 0x5e0]
je 0x4887e2
cmp byte [ebx + 0x113], 0
je 0x4887e2
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
mov ebx, dword [esi + 0x1240]
sub ebx, dword [esi + 0x124c]
cmp byte [esi + 0x123c], 0
je 0x488812
mov edx, dword [esi + 0x1244]
push 1
push ebx
push edx
lea ecx, [esi + 0x60c]
call fcn.00511070
sub ebx, dword [esi + 0x124c]
mov eax, dword [esi + 0x1244]
push 1
push ebx
push eax
lea ecx, [esi + 0x360]
call fcn.00511070
mov eax, dword [esi + 0x88c]
test eax, eax
je 0x488838
mov byte [eax + 0xd71], 0
lea ebx, [esi + 0x10f0]
call fcn.00441d00
mov eax, dword [esi + 0x10e4]
test eax, eax
je 0x488856
push 5
push eax
call edi
pop edi
pop ebx
pop ecx
ret
mov ecx, dword [esi + 0x10e0]
mov edx, dword [ecx + 4]
pop edi
mov dword [esi + edx + 0x10e0], 6
pop ebx
pop ecx
ret
Function at 0x48d870
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, 0x53b7a8
call fcn.00466b30
mov eax, dword [ebp + 0x10]
push eax
mov eax, edi
call fcn.0048da10
push str.FaxPanelFncBtn_BtnBase
lea eax, [edi + 0x4c]
call fcn.004fcf00
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x48d8b0
mov eax, 0x538640
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x48d8de
cmp eax, ebx
je 0x48d8de
cmp word [eax], bx
je 0x48d8de
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x48d8cd
mov ecx, 0x538640
push ecx
push ebx
push str.Height
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
push str.FaxPanelFncBtn_BtnWnd
lea eax, [edi + 0x4c]
call fcn.004fcf00
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x48d8f7
mov eax, 0x538640
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x48d925
cmp eax, ebx
je 0x48d925
cmp word [eax], bx
je 0x48d925
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x48d914
mov ecx, 0x538640
push ecx
push ebx
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x48d931
mov ecx, 0x538640
cmp dword [esi + 8], ebx
jle 0x48d95c
test ecx, ecx
je 0x48d95c
cmp word [ecx], bx
je 0x48d95c
mov eax, dword [esi + 4]
test eax, eax
jne 0x48d94b
mov eax, 0x538640
push eax
push 0
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x48d968
mov ecx, 0x538640
xor edi, edi
cmp dword [esi + 8], edi
jle 0x48d995
test ecx, ecx
je 0x48d995
cmp word [ecx], di
je 0x48d995
mov eax, dword [esi + 4]
test eax, eax
jne 0x48d984
mov eax, 0x538640
push eax
push 0
push str.Width
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x48d9a1
mov ecx, 0x538640
xor eax, eax
cmp dword [esi + 8], eax
jle 0x48d9cc
test ecx, ecx
je 0x48d9cc
cmp word [ecx], ax
je 0x48d9cc
mov eax, dword [esi + 4]
test eax, eax
jne 0x48d9bd
mov eax, 0x538640
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
xor ecx, ecx
cmp byte [esi + 0x13d8], cl
push edx
mov edx, dword [ebp + 0xc]
setne cl
push eax
push edi
dec ecx
and ecx, eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x13d4], ecx
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push edx
lea edx, [esi + 0xb38]
mov ecx, ebx
call fcn.00480980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48da10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
push str.FaxPanelFncBtn_BtnText
lea eax, [esi + 0x4c]
call fcn.004fcf00
mov eax, dword [esi + 0x4c]
xor ebx, ebx
cmp eax, ebx
jne 0x48da36
mov eax, 0x538640
mov dword [ebp - 8], ebx
cmp dword [esi + 0x44], ebx
jle 0x48da68
cmp eax, ebx
je 0x48da68
cmp word [eax], bx
je 0x48da68
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
jne 0x48da53
mov ecx, 0x538640
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x48da6e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x48da7a
mov ecx, 0x538640
mov dword [ebp - 4], ebx
cmp dword [esi + 0x44], ebx
jle 0x48daa4
cmp ecx, ebx
je 0x48daa4
cmp word [ecx], bx
je 0x48daa4
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x48da97
mov eax, 0x538640
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x48dab0
mov ecx, 0x538640
cmp dword [esi + 0x44], ebx
jle 0x48dad7
test ecx, ecx
je 0x48dad7
cmp word [ecx], bx
je 0x48dad7
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x48daca
mov eax, 0x538640
push eax
push 0
push str.Width
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x48dae3
mov ecx, 0x538640
xor edi, edi
cmp dword [esi + 0x44], edi
jle 0x48db10
test ecx, ecx
je 0x48db10
cmp word [ecx], di
je 0x48db10
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x48daff
mov eax, 0x538640
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x48db1c
mov ecx, 0x538640
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x48db47
test ecx, ecx
je 0x48db47
cmp word [ecx], ax
je 0x48db47
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x48db38
mov eax, 0x538640
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
add esi, 0xb38
call fcn.00480b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48ec00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, str.BrCcHome.sdd
call fcn.00466b30
cmp byte [ebp + 0x14], 0
lea eax, [edi + 0x4c]
je 0x48ec2a
push str.PcFaxTxScanPage_Mini_ScanSizeListBox
jmp 0x48ec2f
push str.PcFaxTxScanPage_ScanSizeListBox
call fcn.004fcf00
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x48ec42
mov eax, 0x538640
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x48ec74
cmp eax, ebx
je 0x48ec74
cmp word [eax], bx
je 0x48ec74
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x48ec5f
mov ecx, 0x538640
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x48ec7a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x48ec86
mov ecx, 0x538640
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x48ecb0
cmp ecx, ebx
je 0x48ecb0
cmp word [ecx], bx
je 0x48ecb0
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x48eca3
mov eax, 0x538640
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x48ecbc
mov ecx, 0x538640
mov dword [ebp + 0x14], ebx
cmp dword [esi + 8], ebx
jle 0x48ece6
cmp ecx, ebx
je 0x48ece6
cmp word [ecx], bx
je 0x48ece6
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x48ecd9
mov eax, 0x538640
push eax
push ebx
push str.Width
push ecx
call edi
mov dword [ebp + 0x14], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x48ecf2
mov ecx, 0x538640
cmp dword [esi + 8], ebx
jle 0x48ed19
test ecx, ecx
je 0x48ed19
cmp word [ecx], bx
je 0x48ed19
mov eax, dword [esi + 4]
test eax, eax
jne 0x48ed0c
mov eax, 0x538640
push eax
push 0
push str.Height
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x48ed25
mov ecx, 0x538640
xor edi, edi
cmp dword [esi + 8], edi
jle 0x48ed52
test ecx, ecx
je 0x48ed52
cmp word [ecx], di
je 0x48ed52
mov eax, dword [esi + 4]
test eax, eax
jne 0x48ed41
mov eax, 0x538640
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push 0x2af8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x55a400
call fcn.00467b90
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x48ed71
mov eax, 0x538640
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push 1
push edi
push ebx
push ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [edx + 0x13d4]
add edx, 0x5a8
push ecx
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
push 0x1646
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push edx
mov edx, 0x10200003
call fcn.004253b0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x48edb8
push eax
call fcn.005134a7
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4937d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531372
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 4], 0x53f10c
mov dword [ebx + 0x2c], 0x53f114
mov dword [ebx + 0x80e0], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x38], al
mov dword [ebp - 4], eax
mov dword [ebx], vtable.CPhotoEditPage.0
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
lea edi, [ebx + 0x74]
call fcn.00495130
lea esi, [ebx + 0x1a84]
call fcn.00503130
lea esi, [ebx + 0x3620]
call fcn.00491ef0
lea edi, [ebx + 0x3ecc]
call fcn.005019b0
lea eax, [ebx + 0x47d8]
push eax
mov byte [ebp - 4], 6
call fcn.004975e0
xor eax, eax
mov dword [ebx + 0x80a8], eax
mov dword [ebx + 0x80bc], eax
mov dword [ebx + 0x80b8], eax
mov dword [ebx + 0x3ec8], eax
mov byte [ebx + 0x80d9], al
mov word [ebx + 0x80da], ax
mov byte [ebx + 0x80dc], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4940f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
lea ebx, [esi + 0x74]
call fcn.00495790
lea ebx, [esi + 0x3f08]
call fcn.004fec30
lea edi, [esi + 0x47d8]
call fcn.00497ce0
push 0
call fcn.00508ea0
mov eax, dword [esi + 0x30]
pop edi
pop ebx
test eax, eax
je 0x49412a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x2c], 6
ret
Function at 0x495e10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e3
jne 0x495e96
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x1170]
cmp eax, ebx
je 0x495e3a
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x495e4e
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x116c], 6
cmp dword [esi + 0x4e0], ebx
je 0x495e77
cmp byte [esi + 0x433], bl
je 0x495e77
mov ecx, dword [esi + 0x330]
mov word [esi + 0x433], bx
push ecx
lea ebx, [esi + 0x320]
call fcn.00434320
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, edx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.00511070
pop ebx
ret
cmp eax, 0x17e2
jne 0x495eaf
mov ecx, dword [esi + 0xc]
push 0
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x495ec7
push 0
push eax
call edi
jmp 0x495edb
mov edx, dword [esi + 0x8a4]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x8a4], 6
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x495eec
push 0
push eax
call edi
jmp 0x495f00
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x495f27
cmp byte [ebx + 0x113], 0
je 0x495f27
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
mov eax, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push eax
push ecx
lea ecx, [esi + 0x34c]
call fcn.00511070
cmp dword [esi + 0x78c], 0
lea ebx, [esi + 0x5cc]
je 0x495f6c
cmp byte [ebx + 0x113], 0
je 0x495f6c
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
mov edx, dword [esi + 0x19d4]
sub edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.00511070
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x495fa9
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
mov ecx, dword [esi + 0x116c]
mov edx, dword [ecx + 4]
pop edi
mov dword [esi + edx + 0x116c], 6
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
Function at 0x495fd0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e4
jne 0x496041
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x15c8]
cmp eax, ebx
je 0x495ffa
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49600e
mov eax, dword [esi + 0x15c4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x15c4], 6
cmp dword [esi + 0x78c], ebx
je 0x49616f
cmp byte [esi + 0x6df], bl
je 0x49616f
mov ecx, dword [esi + 0x5dc]
mov word [esi + 0x6df], bx
push ecx
lea ebx, [esi + 0x5cc]
call fcn.00434320
pop ebx
ret
cmp eax, 0x17e2
jne 0x49605a
mov edx, dword [esi + 0xc]
push 0
push eax
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x496072
push 0
push eax
call edi
jmp 0x496086
mov eax, dword [esi + 0x8a4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x8a4], 6
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x496097
push 0
push eax
call edi
jmp 0x4960ab
mov edx, dword [esi + 0x116c]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x116c], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x4960d2
cmp byte [ebx + 0x113], 0
je 0x4960d2
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
cmp dword [esi + 0x4e0], 0
lea ebx, [esi + 0x320]
je 0x4960fc
cmp byte [ebx + 0x113], 0
je 0x4960fc
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.00434320
mov ebx, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push ebx
push ecx
lea ecx, [esi + 0x34c]
call fcn.00511070
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, ebx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.00511070
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x496150
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e4
pop ebx
ret
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
mov dword [esi + 0x19e0], 0x17e4
pop edi
pop ebx
ret
Function at 0x4975e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5293c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x53f348
mov dword [edi + 0x2c], 0x53f350
mov dword [edi + 0x38cc], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoEditViewWnd.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x6c], 0x544264
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov byte [edi + 0x78], bl
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x80], bl
push 1
lea ecx, [edi + 0x84]
call fcn.004330e0
push 1
lea ecx, [edi + 0x330]
call fcn.004330e0
push 1
lea ecx, [edi + 0x5dc]
call fcn.004fdd40
push 1
lea ecx, [edi + 0x66c]
call fcn.004fdd40
lea eax, [edi + 0x6fc]
push eax
mov byte [ebp - 4], 6
call fcn.0045c360
lea esi, [edi + 0x750]
call fcn.0045eb40
lea esi, [edi + 0x17ac]
call fcn.0045eb40
lea esi, [edi + 0x2808]
call fcn.0045eb40
mov dword [edi + 0x3864], ebx
mov dword [edi + 0x3868], ebx
mov dword [edi + 0x386c], ebx
mov dword [edi + 0x3870], ebx
mov dword [edi + 0x3874], ebx
mov dword [edi + 0x3878], ebx
mov dword [edi + 0x387c], ebx
mov dword [edi + 0x3880], ebx
mov dword [edi + 0x3888], ebx
mov dword [edi + 0x388c], ebx
mov dword [edi + 0x3890], ebx
mov dword [edi + 0x3894], ebx
mov dword [edi + 0x3898], ebx
mov dword [edi + 0x389c], ebx
mov dword [edi + 0x38a0], ebx
mov dword [edi + 0x38a4], ebx
mov dword [edi + 0x38a8], ebx
mov dword [edi + 0x38ac], ebx
mov dword [edi + 0x38b0], ebx
mov dword [edi + 0x38b4], ebx
mov dword [edi + 0x38b8], ebx
mov dword [edi + 0x38bc], ebx
mov dword [edi + 0x38c0], ebx
mov dword [edi + 0x38c4], ebx
mov dword [edi + 0x38c8], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x499b80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub ecx, dword [edi + 0x38bc]
push ebx
mov ebx, dword [edi + 0x38b8]
push esi
mov esi, dword [edi + 0x388c]
mov eax, esi
neg eax
add eax, eax
sub eax, dword [edi + 0x38c0]
push 1
add eax, dword [ebp + 0x10]
sub ecx, ebx
cdq
push ecx
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x300000
push eax
lea esi, [edi + 0x17ac]
mov eax, 0x2372
call fcn.0045f600
mov esi, eax
test esi, esi
je 0x499c06
mov eax, dword [edi + 0x17dc]
test eax, eax
je 0x499bf0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [edi + 0x17d8]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x17d8], 6
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x499c10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, dword [esi + 0x38b4]
mov edx, dword [esi + 0x3888]
push edi
mov edi, dword [esi + 0x38b0]
push 0
sub eax, edi
push eax
lea ebx, [edx + edx]
sub ecx, ebx
push ecx
push edi
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x10]
push eax
add esi, 0x2808
mov eax, 0x2371
call fcn.0045f600
mov ebx, eax
test ebx, ebx
je 0x499ce4
mov edi, esi
mov byte [esi + 0xeac], 1
call fcn.00465e90
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
push ebx
push edi
mov ecx, esi
call fcn.00466030
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
push edi
mov edx, esi
call fcn.00466260
mov ecx, dword [ebp - 4]
push ecx
push ebx
push edi
mov eax, esi
call fcn.004664a0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push ebx
push edi
mov ecx, esi
call fcn.00466710
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2838]
test eax, eax
je 0x499cce
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x2834]
mov edx, dword [eax + 4]
mov dword [ecx + edx + 0x2834], 6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x499fe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f0ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x53f488
mov dword [edi + 0x2c], 0x53f490
mov dword [edi + 0x2fb4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoFileListPane.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
lea esi, [edi + 0x5c]
call fcn.004a1110
lea esi, [edi + 0x1328]
call fcn.0049b730
lea eax, [edi + 0x2128]
push eax
mov byte [ebp - 4], 3
call fcn.004536b0
mov dword [edi + 0x2f20], ebx
mov dword [edi + 0x2f24], ebx
mov dword [edi + 0x2f28], ebx
mov ecx, vtable.CMemMap.0
mov dword [edi + 0x2f1c], ecx
mov dword [edi + 0x2f30], ebx
mov dword [edi + 0x2f34], ebx
mov eax, vtable.CSemaphore.0
mov dword [edi + 0x2f2c], eax
mov dword [edi + 0x2f38], ebx
mov dword [edi + 0x2f3c], ebx
mov dword [edi + 0x2f40], ebx
mov dword [edi + 0x2f44], ebx
mov byte [edi + 0x2f48], bl
mov dword [edi + 0x2f4c], ebx
mov dword [edi + 0x2f54], ebx
mov dword [edi + 0x2f58], ebx
mov dword [edi + 0x2f5c], ebx
mov dword [edi + 0x2f50], ecx
mov dword [edi + 0x2f64], ebx
mov dword [edi + 0x2f60], eax
mov dword [edi + 0x2f68], ebx
mov dword [edi + 0x2f6c], ebx
mov dword [edi + 0x2f70], ebx
mov dword [edi + 0x2f74], ebx
mov dword [edi + 0x2f78], ebx
mov byte [edi + 0x2f7c], bl
mov dword [edi + 0x2f80], ebx
mov dword [edi + 0x2f84], ebx
mov dword [edi + 0x2f88], ebx
mov dword [edi + 0x2f90], ebx
mov dword [edi + 0x2f8c], ebx
mov dword [edi + 0x2f94], ebx
mov dword [edi + 0x2f98], ebx
mov dword [edi + 0x2f9c], ebx
mov dword [edi + 0x2fa4], ebx
mov dword [edi + 0x2fa8], 1
mov dword [edi + 0x2fac], ebx
mov dword [edi + 0x2fa0], ebx
mov byte [edi + 0x2e98], bl
mov dword [edi + 0x2fb0], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4