joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xbee008], 0x8088405
inc edx
mov dword [ebx + 0xbee008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d330
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d361
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d349
add dl, dl
jne 0x41d36c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d3bd
xor eax, eax
add dl, dl
jne 0x41d379
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d45a
add dl, dl
jne 0x41d388
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d393
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d39e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3a9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d3b3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d358
mov eax, 1
add dl, dl
jne 0x41d3cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3d6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3c2
sub eax, ebx
mov ebx, 1
jne 0x41d409
mov ecx, 1
add dl, dl
jne 0x41d3ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3e6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d420
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d42b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d417
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d47b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d358
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0xbd1a8e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f5ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
jmp 0x41f60e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f680
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f669
test esi, esi
jbe 0x41f680
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f65b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f680
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f638
jmp 0x41f680
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f680
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xbd1a95
ret
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0xbd2e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0xbf077c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0xbf077c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0xbef568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xbd2e0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401e1d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
call fcn.0043d480
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x67
push dword [ebp + 8]
call fcn.00401fba
push dword [ebp + 0x14]
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x6a
push dword [ebp + 8]
call fcn.00401fba
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push esi
push eax
push 0x6b
push dword [ebp + 8]
call fcn.00401fba
add esp, 0x48
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
jne 0x401fb2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
mov edi, eax
push ebx
push 3
push edi
call esi
mov dword [ebp + 8], eax
inc eax
push eax
call fcn.0043d464
pop ecx
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push eax
push 3
push edi
call esi
cmp dword [ebp + 0x10], ebx
je 0x401fa9
push dword [ebp + 0x10]
call fcn.0043d3e0
test eax, eax
pop ecx
je 0x401fa9
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0040201d
push dword [ebp + 0x10]
mov byte [ebp + 0xb], al
call fcn.0043ce32
add esp, 0x18
cmp byte [ebp + 0xb], bl
jne 0x401fb2
push ebx
and edi, 0x3ff
push ebx
push 3
push edi
mov dword [ebp - 4], edi
call esi
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0043d464
pop ecx
mov dword [ebp + 0x10], eax
push edi
push eax
push 3
push dword [ebp - 4]
call esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x401f7a
push esi
call fcn.0043d3e0
test eax, eax
pop ecx
je 0x401f7a
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.0040201d
add esp, 0x14
mov byte [ebp + 0xb], al
push esi
call fcn.0043ce32
cmp byte [ebp + 0xb], bl
pop ecx
jne 0x401fb2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push 0x458370
call fcn.0040201d
add esp, 0x14
jmp 0x401fb2
push dword [ebp + 0x10]
call fcn.0043ce32
pop ecx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40201d
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x4478bc
call fcn.0043d3b4
sub esp, 0x428
push ebx
push esi
push edi
xor ebx, ebx
push 3
lea eax, [ebp - 0x10]
push ebx
push eax
mov byte [ebp - 0xd], bl
call fcn.0043d480
mov esi, 0x100
lea eax, [ebp - 0x234]
push esi
push ebx
push eax
call fcn.0043d480
push esi
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0043d480
push esi
lea eax, [ebp - 0x334]
push ebx
push eax
call fcn.0043d480
lea eax, [ebp - 0x334]
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0043d4d8
add esp, 0x44
lea eax, [ebp - 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [ebp + 0x17]
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call fcn.0040249b
mov al, byte [ebp + 0x17]
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x30], al
call fcn.0040249b
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.0043d3e0
test eax, eax
pop ecx
mov esi, 0x458374
jbe 0x402103
lea eax, [ebp - 0x234]
push eax
call fcn.0043d3e0
test eax, eax
pop ecx
jbe 0x402103
push edi
call fcn.0043d3e0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.0040288f
jmp 0x402142
lea eax, [ebp - 0x134]
push eax
call fcn.0043d3e0
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040288f
push esi
call fcn.0043d3e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00402838
push edi
call fcn.0043d3e0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.00402838
lea eax, [ebp - 0x134]
push eax
call fcn.0043d3e0
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040288f
push esi
call fcn.0043d3e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.00402838
push dword [ebp + 0x14]
call fcn.0043d3e0
pop ecx
push eax
lea ecx, [ebp - 0x20]
push dword [ebp + 0x14]
call fcn.00402838
push dword [ebp + 8]
call fcn.0043d3e0
pop ecx
push eax
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call fcn.00402838
push dword [ebp + 0x18]
call fcn.0043d3e0
pop ecx
push eax
lea ecx, [ebp - 0x20]
push dword [ebp + 0x18]
call fcn.00402838
mov eax, dword [ebp - 0x1c]
mov edi, 0x44b544
cmp eax, ebx
jne 0x4021bd
mov eax, edi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x402203
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
jne 0x4021eb
mov eax, edi
cmp dword [ebp - 0x1c], ebx
je 0x4021f3
mov edi, dword [ebp - 0x1c]
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne byte [ebp - 0xd]
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0040249b
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.0040249b
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406b9a
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0040687e
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x693
movzx ebx, al
mov eax, dword [esi + 0x30]
mov dword [esp + 0x18], ebx
push eax
call edi
xor ecx, ecx
test ebx, ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
sete cl
mov ebp, ecx
push ebp
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x692
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x6ad
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x66b
push eax
call edi
cmp dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
je 0x406c16
mov ecx, esi
call fcn.0040680b
test al, al
je 0x406c16
push 1
pop eax
jmp 0x406c18
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
push dword [esp + 0x14]
call ebx
mov ecx, esi
call fcn.0040680b
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test al, al
jne 0x406c76
xor eax, eax
cmp dword [esp + 0x14], eax
je 0x406c76
push eax
push eax
push 0xf0
push dword [esp + 0x1c]
call ebp
cmp eax, 1
jne 0x406c76
push 0
push 0
push 0xf1
push dword [esp + 0x1c]
call ebp
mov eax, dword [esi + 0x30]
push 0x697
push eax
call edi
push 0
push 1
push 0xf1
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x697
push eax
call edi
xor ecx, ecx
cmp dword [esp + 0x14], ecx
setne cl
push ecx
push eax
mov dword [esp + 0x18], ecx
call ebx
mov eax, dword [esi + 0x30]
push 0x698
push eax
call edi
push dword [esp + 0x10]
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x699
push eax
call edi
push dword [esp + 0x10]
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x688
push eax
call edi
push dword [esp + 0x10]
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x6cf
push eax
call edi
push dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x682
push eax
call edi
push dword [esp + 0x10]
push eax
call ebx
mov eax, dword [esi + 0x30]
push 0x689
push eax
call edi
movzx ecx, word [esi + 0xb4]
movzx edx, word [esi + 0xb8]
shl ecx, 0x10
or ecx, edx
mov ebx, 0x406
push ecx
push 1
push ebx
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x68d
push eax
call edi
movzx ecx, word [esi + 0xc4]
movzx edx, word [esi + 0xc8]
shl ecx, 0x10
or ecx, edx
push ecx
push 1
push ebx
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x68e
push eax
call edi
movzx ecx, word [esi + 0xbc]
movzx edx, word [esi + 0xc0]
shl ecx, 0x10
or ecx, edx
push ecx
push 1
push ebx
push eax
call ebp
mov ecx, esi
call fcn.00406b23
mov ecx, esi
call fcn.004075b5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x40dbfb
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 8
pop ecx
mov esi, str.CSuperPageMgr::ClearSuperPageMgr
lea edi, [esp + 0x10]
mov eax, dword [ebx + 0x98]
rep movsd dword es:[edi], dword [esi]
xor ebp, ebp
cmp eax, ebp
movsb byte es:[edi], byte [esi]
je 0x40dc3d
push ebp
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0x98]
mov eax, dword [ecx]
call dword [eax + 0xb4]
mov dword [ebx + 0x98], ebp
mov esi, dword [ebx + 0x8c]
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
cmp esi, dword [ebx + 0x90]
je 0x40dc76
push dword [esi + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x38], ebp
je 0x40dc6b
mov eax, dword [esi]
cmp eax, ebp
je 0x40dc6b
push dword [eax + 0x30]
call edi
add esi, 0x18
cmp esi, dword [ebx + 0x90]
jne 0x40dc51
push dword [ebx + 0x90]
lea ecx, [ebx + 0x88]
push dword [ecx + 4]
call fcn.0040f3e4
push ebp
push ebp
push 0x184
push dword [ebx + 0x9c]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebx + 0xac]
call edi
cmp dword [ebx + 0x194], ebp
je 0x40dcd3
push dword [ebx + 0xe8]
call edi
push dword [ebx + 0x140]
call edi
lea ecx, [ebx + 0xe4]
call fcn.0042ed8e
lea ecx, [ebx + 0x13c]
call fcn.0042ed8e
lea esi, [ebx + 0x1a4]
push 0xffffffffffffffff
mov dword [ebx + 0x194], ebp
push dword [esi]
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
jne 0x40dcfa
push str.CSuperPageMgr::ClearSuperPageMgr___ERROR___ImageList_RemoveAll___Failed._n
call edi
mov esi, dword [esi]
cmp esi, ebp
je 0x40dd12
push esi
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test eax, eax
jne 0x40dd12
push str.CSuperPageMgr::ClearSuperPageMgr___ERROR___ImageList_Destroy___Failed._n
call edi
mov ecx, ebx
call fcn.00433c31
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x4104ea
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0040ff7b
cmp byte [esi + 0x97], 0
mov ebx, eax
je 0x4105da
test ebx, ebx
je 0x4105da
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push 1
push ebx
call dword [eax + 0x48]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
test eax, eax
jl 0x410574
mov eax, dword [esi + 0x30]
push 0x7ac
push eax
call edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
push ecx
push 1
push ebx
call dword [eax + 0x58]
xor eax, eax
cmp dword [esp + 0x14], eax
setg al
push eax
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x30]
push 0x7ab
push eax
call edi
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp edx, dword [esp + 0x1c]
setl cl
push ecx
push eax
call ebp
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
call dword [eax + 0x48]
test eax, eax
jl 0x4105cd
mov eax, dword [esi + 0x30]
push 0x7ae
push eax
call edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
push ecx
push 0
push ebx
call dword [eax + 0x58]
xor eax, eax
cmp dword [esp + 0x18], eax
setg al
push eax
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x30]
push 0x7af
push eax
call edi
mov edx, dword [esp + 0x18]
xor ecx, ecx
cmp edx, dword [esp + 0x20]
setl cl
push ecx
push eax
call ebp
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ebx, 0x7ad
jmp 0x410646
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7ac
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x7ab
push eax
call edi
xor ebx, ebx
push ebx
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x7af
push eax
call edi
push ebx
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x7ae
push eax
call edi
push ebx
push eax
call ebp
mov eax, dword [esi + 0x30]
mov ebx, 0x7ad
push ebx
push eax
call edi
push 0
push eax
call ebp
mov eax, dword [esi + 0x30]
push 0x7e9
push eax
call edi
push 0
push eax
call ebp
mov eax, dword [esi + 0x30]
push ebx
push eax
call edi
push 0
push eax
call ebp
mov esi, dword [esi + 0x30]
push ebx
push esi
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x417655
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x1037
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x1d4]
call fcn.0043829b
pop esi
ret

Function at 0x41774e
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x6a8
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0041763f
mov ecx, esi
call fcn.0041764a
mov ecx, esi
call fcn.00417655
mov ecx, esi
call fcn.004176db
pop esi
ret

Function at 0x417787
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x6a0
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00417629
mov ecx, esi
call fcn.00417634
pop esi
ret

Function at 0x418ea5
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x80]
call fcn.0043829b
cmp byte [esi + 0x1c1], 0
jne 0x418ed4
mov esi, dword [esi + 0x30]
push 0x1038
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x418ed6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xd0]
call fcn.0043829b
cmp byte [esi + 0x1c0], 0
jne 0x418f05
mov esi, dword [esi + 0x30]
push 0x1038
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x418f07
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x120]
call fcn.0043829b
cmp byte [esi + 0x1c3], 0
jne 0x418f36
mov esi, dword [esi + 0x30]
push 0x1037
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x418f38
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x170]
call fcn.0043829b
cmp byte [esi + 0x1c2], 0
jne 0x418f67
mov esi, dword [esi + 0x30]
push 0x1037
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x419cfc
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x80]
call fcn.0043829b
cmp byte [esi + 0x1c3], 0
jne 0x419d2b
mov esi, dword [esi + 0x30]
push 0x1039
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x419d2d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xd0]
call fcn.0043829b
cmp byte [esi + 0x1c2], 0
jne 0x419d5c
mov esi, dword [esi + 0x30]
push 0x1037
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret