joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee1c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4ee1d5
push 9
push eax
call edi
jmp 0x4ee1e3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0x834]
test eax, eax
je 0x4ee1f4
push 0
push eax
call edi
jmp 0x4ee208
mov edx, dword [esi + 0x830]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x830], 6
mov eax, dword [esi + 0x588]
test eax, eax
je 0x4ee219
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0x584]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x584], 6
pop edi
ret

Function at 0x4ee4e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea esi, [edi + 0x1fc]
jne 0x4ee543
mov eax, dword [esi + 0x38c]
test eax, eax
je 0x4ee508
push 0
push eax
call ebx
jmp 0x4ee51c
mov eax, dword [esi + 0x388]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x388], 6
mov eax, dword [esi + 0x638]
test eax, eax
je 0x4ee52d
push 5
push eax
call ebx
jmp 0x4ee593
mov edx, dword [esi + 0x634]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x634], 6
jmp 0x4ee593
mov eax, dword [esi + 0x638]
test eax, eax
je 0x4ee554
push 0
push eax
call ebx
jmp 0x4ee568
mov ecx, dword [esi + 0x634]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x634], 6
mov eax, dword [esi + 0x38c]
test eax, eax
je 0x4ee579
push 5
push eax
call ebx
jmp 0x4ee58d
mov eax, dword [esi + 0x388]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x388], 6
cmp dword [ebp + 0xc], 0
jne 0x4ee5ad
mov ebx, dword [ebp + 8]
lea eax, [edi + 0xb8]
call fcn.0051c680
mov ebx, dword [ebp + 0x10]
mov eax, ebx
call fcn.00516650
jmp 0x4ee5b0
mov ebx, dword [ebp + 0x10]
mov dx, word [edi + 0xd94]
sub dx, word [edi + 0xd78]
mov cx, word [edi + 0xd7c]
add dx, word [ebp + 0x14]
add cx, cx
movzx eax, dx
sub bx, cx
mov ecx, dword [edi + 0xdcc]
movzx edx, bx
shl eax, 0x10
or eax, edx
push eax
mov eax, dword [ebp + 0xc]
push eax
push 5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4f06c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x4f06d6
cmp eax, 2
jne 0x4f08a6
mov eax, dword [esi + 0x30]
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
test eax, eax
je 0x4f0728
test ebx, ebx
jle 0x4f071a
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4f071a
push 0xe
push ecx
push ebx
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x4f0734
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4f0734
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov dword [edi + eax], 0x57
jmp 0x4f0734
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov dword [edi + edx], 6
mov eax, dword [esi + 0x674]
mov ecx, dword [esi + 0x340c]
test eax, eax
je 0x4f0792
test ebx, ebx
jle 0x4f077c
test ecx, ecx
jle 0x4f077c
push 0xe
push ecx
push ebx
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x4f07a6
mov eax, dword [esi + 0x670]
mov ebx, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x670], eax
mov ebx, dword [ebp + 8]
jmp 0x4f07a6
mov ecx, dword [esi + 0x670]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x670], 0x57
jmp 0x4f07a6
mov eax, dword [esi + 0x670]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x670], 6
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x3410]
lea edx, [esi + 0x2310]
sub eax, dword [esi + 0x340c]
mov ecx, ebx
call fcn.004c8a60
push str.ScanImgCropWnd_ClientWnd
lea eax, [esi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x4c]
mov ecx, eax
test eax, eax
jne 0x4f07dd
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x4f080a
test ecx, ecx
je 0x4f080a
cmp word [ecx], ax
je 0x4f080a
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4f07ff
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call edi
sub ebx, eax
mov eax, dword [esi + 0x4c]
mov ecx, eax
test eax, eax
jne 0x4f081a
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x4f0841
test ecx, ecx
je 0x4f0841
cmp word [ecx], ax
je 0x4f0841
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x4f0836
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0x3428]
sub edi, eax
mov eax, dword [esi + 0x3424]
push 1
add edx, edi
push edx
push eax
lea ecx, [esi + 0x88]
call fcn.0051c2b0
mov ecx, dword [esi + 0x3418]
mov edx, dword [esi + 0x3414]
push 1
add ecx, edi
push ecx
add edx, ebx
push edx
lea ecx, [esi + 0x118]
call fcn.0051c2b0
mov eax, dword [esi + 0x3420]
mov ecx, dword [esi + 0x341c]
push 1
add eax, edi
add ecx, ebx
push eax
push ecx
lea ecx, [esi + 0x3c4]
call fcn.0051c2b0
call fcn.004f09b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f1ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540c80
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x700000
mov byte [ebp - 0xd], 0
call fcn.00513d70
push 0x20000
call fcn.00513fe0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.004edd50
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4f1c51
mov eax, dword [ebx + 0xd7c]
lea esi, [ebx + 0xd74]
mov ecx, 9
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 0xddc]
sub edi, dword [ebx + 0xd78]
lea ecx, [eax + eax]
mov eax, dword [ebx + 0xdd8]
add edi, dword [ebx + 0xd94]
sub esp, 0xc
sub eax, ecx
lea edx, [ebx + 0x4238]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
mov dword [ebp + 0x10], eax
call fcn.005072e0
sub esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebx + 0x422c]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.005072e0
sub esp, 0xc
lea edx, [ebx + 0x4220]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
mov byte [ebp - 4], 1
call fcn.005072e0
lea esi, [ebx + 0xdec]
mov dword [ebp - 4], 0xffffffff
call fcn.004f02e0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push ecx
push edx
mov edx, dword [ebp - 0x28]
push esi
mov eax, edi
call fcn.004effc0
mov esi, eax
test esi, esi
je 0x4f1c4c
push edi
mov dword [ebx + 0xdcc], esi
call fcn.005135b0
push esi
call fcn.005136c0
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4f1c28
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx + 0x2c], 6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00515cb0
call fcn.00513e40
call fcn.005140b0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f9e00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540c48
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edx, ebx
mov byte [ebp - 0xd], 0
call fcn.004fac10
mov edx, dword [ebp + 0x10]
mov edi, eax
call fcn.004fac10
mov esi, eax
test edi, edi
je 0x4f9f3b
test esi, esi
je 0x4f9f3b
cmp dword [edi + 4], 0
jne 0x4f9e6e
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004f9fe0
cmp dword [edi + 4], 0
je 0x4f9f3b
cmp dword [esi + 4], 0
jne 0x4f9f3b
mov edi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x34]
push eax
mov esi, ebx
call fcn.004fba30
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0x10]
push ecx
call fcn.004fba30
push esi
push edi
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 1
call fcn.004fb880
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4f9eba
mov eax, 0x54ee24
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00449cf0
test al, al
je 0x4f9ef0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x4f9ed4
mov ecx, 0x54ee24
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4f9ee0
mov eax, 0x54ee24
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov bl, 1
test eax, eax
jne 0x4f9ef3
mov bl, byte [ebp - 0xd]
mov ecx, dword [ebp + 8]
push esi
push edi
push ecx
call fcn.004f9cf0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00445e70
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00445e70
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00445e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f9f60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, edi
mov esi, eax
xor bl, bl
call fcn.004fac10
mov esi, eax
test esi, esi
je 0x4f9fcb
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4f9fcb
push edi
call fcn.004fb750
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
push ecx
mov esi, edi
call fcn.004fba30
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4f9fae
mov eax, 0x54ee24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4f9fbb
mov bl, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4f9fcb
push eax
call fcn.0051eadb
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push esi
test ebx, ebx
jne 0x50413e
mov ebx, dword [ebp + 0xc]
push edi
mov ecx, 0x554c48
call fcn.00470260
push 0x55d7e4
lea eax, [edi + 0x10]
call fcn.005080c0
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x504162
mov esi, 0x54ee24
xor edx, edx
cmp dword [edi + 8], edx
jle 0x50418f
test esi, esi
je 0x50418f
cmp word [esi], dx
je 0x50418f
mov eax, dword [edi + 4]
test eax, eax
jne 0x50417e
mov eax, 0x54ee24
push eax
push 0
push str.Height
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
sub eax, edx
sub eax, dword [ebp + 0x14]
push ebx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
sar esi, 1
add esi, dword [ebp + 0x14]
sub ecx, esi
push esi
mov dword [edi + 0x260], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
push edi
call fcn.005047d0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edx
push eax
push edi
call fcn.00504a50
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push ecx
push edx
push edi
call fcn.00504ce0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
push edi
call fcn.00504f70
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x504260
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x50]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x504369
cmp eax, ebx
je 0x5042a6
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5042b4
jmp 0x5042d4
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x4c], 6
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x5042c6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5042d4
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x4c], 6
push 0x753b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x504303
mov eax, 0x54ee24
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x504327
mov eax, 0x54ee24
lea ecx, [edi + 0x20]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x50433f
push esi
call fcn.0051eadb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x504396
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x504388
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x4c]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x4c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5043b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0xe0]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x5044ce
cmp eax, ebx
je 0x5043f9
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x50440d
jmp 0x504436
mov eax, dword [edi + 0xdc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0xdc], 6
mov eax, dword [edi + 0xe0]
cmp eax, ebx
je 0x504422
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x504436
mov ecx, dword [edi + 0xdc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0xdc], 6
push 0x754b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x504465
mov eax, 0x54ee24
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x504489
mov eax, 0x54ee24
lea ecx, [edi + 0xb0]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x5044a4
push esi
call fcn.0051eadb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x504501
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x5044ed
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0xdc]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xdc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504520
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x170]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jle 0x50463e
cmp eax, ebx
je 0x504569
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x50457d
jmp 0x5045a6
mov eax, dword [edi + 0x16c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x16c], 6
mov eax, dword [edi + 0x170]
cmp eax, ebx
je 0x504592
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5045a6
mov ecx, dword [edi + 0x16c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x16c], 6
push 0x753d
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x5776a0
call fcn.00471380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x5045d5
mov eax, 0x54ee24
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push 0x55a324
push ecx
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x5045f9
mov eax, 0x54ee24
lea ecx, [edi + 0x140]
call fcn.005091f0
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x504614
push esi
call fcn.0051eadb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x504671
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x50465d
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi + 0x16c]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x16c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x504690
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539f88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [edi + 0x200]
jle 0x504788
test eax, eax
je 0x5046d7
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5046eb
jmp 0x504714
mov eax, dword [edi + 0x1fc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x1fc], 6
mov eax, dword [edi + 0x200]
test eax, eax
je 0x504700
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x504714
mov ecx, dword [edi + 0x1fc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x1fc], 6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
lea ecx, [ebp - 0x18]
push str._d__d
push ecx
mov dword [ebp - 4], 0
call fcn.005074a0
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
test esi, esi
jne 0x504757
mov eax, 0x54ee24
lea ecx, [edi + 0x1d0]
call fcn.005091f0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x5047bb
push esi
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x5047a7
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [edi + 0x1fc]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x1fc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x506030
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a054
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x70], eax
lea ecx, [eax + 0x23]
lea esi, [ebp - 0x28]
lea ebx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00508530
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00508010
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x5060c1
push eax
call fcn.0051eadb
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
call esi
push 0x54ede0
lea edi, [ebp - 0x1c]
call fcn.00507dd0
push str.ControlCenter4
call esi
push str.ControlCenter4
call fcn.00507dd0
xor ecx, ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x506139
cmp word [edi], bx
je 0x506139
push edi
lea eax, [ebp - 0x44]
call fcn.005080c0
push 0x5c
lea esi, [ebp - 0x44]
call fcn.00507e80
mov esi, str.BrCcDefSet.dat
lea eax, [ebp - 0x44]
call fcn.00508170
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
jle 0x50615f
cmp ecx, ebx
jne 0x506149
mov ecx, 0x54ee24
push ecx
push 0x1388
push str.DevStatInterval
push str.TimeParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x48]
push edx
mov dword [ecx + 0x43c], eax
mov byte [ebp - 4], 1
call fcn.004701c0
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], bl
call fcn.00508490
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x506195
push edi
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x506440
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a010
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esi + 0x4c]
cmp edi, 2
jne 0x506478
push str.AdvDevStatus_Text
jmp 0x50647d
push str.HomeDevStatus_Text
call fcn.005080c0
push 0x2af8
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x5776a0
call fcn.00471380
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x5064ab
mov dword [ebp - 0x24], 0x54ee24
mov eax, dword [esi + 0x4c]
mov ecx, eax
cmp eax, ebx
jne 0x5064b9
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], ebx
jle 0x5064e3
cmp ecx, ebx
je 0x5064e3
cmp word [ecx], bx
je 0x5064e3
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x5064d5
mov eax, 0x54ee24
push eax
push ebx
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov byte [ebp - 0x40], bl
mov ecx, 1
cmp edi, 2
jne 0x5064fa
mov byte [ebp - 0x48], cl
mov edi, 0xffffff
jmp 0x506500
mov edi, dword [ebp - 0x44]
mov byte [ebp - 0x48], bl
push ebx
push ebx
mov ebx, dword [ebp + 8]
mov byte [esi + 0x248], cl
mov dword [esi + 0x11c], ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
lea edx, [esi + 0xfc]
push edx
mov dword [esi + 0x120], 0x40024
call fcn.00473690
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esi + 0x130], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esi + 0x13c], edx
mov dword [esi + 0x140], eax
push 0x7534
lea edx, [ebp - 0x18]
mov dword [esi + 0x144], ecx
push edx
mov ecx, 0x5776a0
call fcn.00471380
mov cl, 1
mov byte [ebp - 4], cl
mov eax, dword [ebp - 0x18]
xor ebx, ebx
cmp eax, ebx
jne 0x506585
mov eax, 0x54ee24
push eax
lea eax, [esi + 0x124]
mov byte [esi + 0x248], cl
call fcn.005080c0
mov eax, dword [esi + 0x3d0]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x5065c2
push eax
call fcn.0051eadb
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x5065d9
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4