joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496db0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, 0x554c58
call fcn.00470370
mov eax, dword [ebp + 0x10]
push eax
mov eax, edi
call fcn.00496f50
push str.FaxPanelFncBtn_BtnBase
lea eax, [edi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x496df0
mov eax, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x496e1e
cmp eax, ebx
je 0x496e1e
cmp word [eax], bx
je 0x496e1e
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x496e0d
mov ecx, 0x54ee24
push ecx
push ebx
push str.Height
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
push str.FaxPanelFncBtn_BtnWnd
lea eax, [edi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x496e37
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x496e65
cmp eax, ebx
je 0x496e65
cmp word [eax], bx
je 0x496e65
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x496e54
mov ecx, 0x54ee24
push ecx
push ebx
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x496e71
mov ecx, 0x54ee24
cmp dword [esi + 8], ebx
jle 0x496e9c
test ecx, ecx
je 0x496e9c
cmp word [ecx], bx
je 0x496e9c
mov eax, dword [esi + 4]
test eax, eax
jne 0x496e8b
mov eax, 0x54ee24
push eax
push 0
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x496ea8
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 8], edi
jle 0x496ed5
test ecx, ecx
je 0x496ed5
cmp word [ecx], di
je 0x496ed5
mov eax, dword [esi + 4]
test eax, eax
jne 0x496ec4
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x496ee1
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 8], eax
jle 0x496f0c
test ecx, ecx
je 0x496f0c
cmp word [ecx], ax
je 0x496f0c
mov eax, dword [esi + 4]
test eax, eax
jne 0x496efd
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
xor ecx, ecx
cmp byte [esi + 0x13d8], cl
push edx
mov edx, dword [ebp + 0xc]
setne cl
push eax
push edi
dec ecx
and ecx, eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x13d4], ecx
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push edx
lea edx, [esi + 0xb38]
mov ecx, ebx
call fcn.00489a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x496f50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
push str.FaxPanelFncBtn_BtnText
lea eax, [esi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x4c]
xor ebx, ebx
cmp eax, ebx
jne 0x496f76
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 0x44], ebx
jle 0x496fa8
cmp eax, ebx
je 0x496fa8
cmp word [eax], bx
je 0x496fa8
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
jne 0x496f93
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x496fae
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x496fba
mov ecx, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 0x44], ebx
jle 0x496fe4
cmp ecx, ebx
je 0x496fe4
cmp word [ecx], bx
je 0x496fe4
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x496fd7
mov eax, 0x54ee24
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x496ff0
mov ecx, 0x54ee24
cmp dword [esi + 0x44], ebx
jle 0x497017
test ecx, ecx
je 0x497017
cmp word [ecx], bx
je 0x497017
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x49700a
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x497023
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 0x44], edi
jle 0x497050
test ecx, ecx
je 0x497050
cmp word [ecx], di
je 0x497050
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x49703f
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x49705c
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x497087
test ecx, ecx
je 0x497087
cmp word [ecx], ax
je 0x497087
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x497078
mov eax, 0x54ee24
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
add esi, 0xb38
call fcn.00489c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x498130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, str.BrCcHome.sdd
call fcn.00470370
cmp byte [ebp + 0x14], 0
lea eax, [edi + 0x4c]
je 0x49815a
push str.PcFaxTxScanPage_Mini_ScanSizeListBox
jmp 0x49815f
push str.PcFaxTxScanPage_ScanSizeListBox
call fcn.005080c0
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x498172
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x4981a4
cmp eax, ebx
je 0x4981a4
cmp word [eax], bx
je 0x4981a4
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x49818f
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x4981aa
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x4981b6
mov ecx, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x4981e0
cmp ecx, ebx
je 0x4981e0
cmp word [ecx], bx
je 0x4981e0
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x4981d3
mov eax, 0x54ee24
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x4981ec
mov ecx, 0x54ee24
mov dword [ebp + 0x14], ebx
cmp dword [esi + 8], ebx
jle 0x498216
cmp ecx, ebx
je 0x498216
cmp word [ecx], bx
je 0x498216
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x498209
mov eax, 0x54ee24
push eax
push ebx
push str.Width
push ecx
call edi
mov dword [ebp + 0x14], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x498222
mov ecx, 0x54ee24
cmp dword [esi + 8], ebx
jle 0x498249
test ecx, ecx
je 0x498249
cmp word [ecx], bx
je 0x498249
mov eax, dword [esi + 4]
test eax, eax
jne 0x49823c
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x498255
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 8], edi
jle 0x498282
test ecx, ecx
je 0x498282
cmp word [ecx], di
je 0x498282
mov eax, dword [esi + 4]
test eax, eax
jne 0x498271
mov eax, 0x54ee24
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push 0x2af8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5776a0
call fcn.00471480
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4982a1
mov eax, 0x54ee24
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push 1
push edi
push ebx
push ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [edx + 0x13d4]
add edx, 0x5a8
push ecx
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
push 0x1646
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push edx
mov edx, 0x10200003
call fcn.0042c680
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4982e8
push eax
call fcn.0051ebab
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49d020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53db62
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 4], 0x55887c
mov dword [ebx + 0x2c], 0x558884
mov dword [ebx + 0x8210], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x38], al
mov dword [ebp - 4], eax
mov dword [ebx], vtable.CPhotoEditPage.0
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
lea edi, [ebx + 0x74]
call fcn.0049e980
lea esi, [ebx + 0x1a84]
call fcn.0050e290
lea esi, [ebx + 0x3750]
call fcn.0049b6b0
lea edi, [ebx + 0x3ffc]
call fcn.0050cb10
lea eax, [ebx + 0x4908]
push eax
mov byte [ebp - 4], 6
call fcn.004a0e30
xor eax, eax
mov dword [ebx + 0x81d8], eax
mov dword [ebx + 0x81ec], eax
mov dword [ebx + 0x81e8], eax
mov dword [ebx + 0x3ff8], eax
mov byte [ebx + 0x8209], al
mov word [ebx + 0x820a], ax
mov byte [ebx + 0x820c], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49d940
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
lea ebx, [esi + 0x74]
call fcn.0049efe0
lea ebx, [esi + 0x4038]
call fcn.00509db0
lea edi, [esi + 0x4908]
call fcn.004a1530
push 0
call fcn.005144a0
mov eax, dword [esi + 0x30]
pop edi
pop ebx
test eax, eax
je 0x49d97a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x2c], 6
ret
Function at 0x49f660
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e3
jne 0x49f6e6
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x1170]
cmp eax, ebx
je 0x49f68a
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49f69e
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x116c], 6
cmp dword [esi + 0x4e0], ebx
je 0x49f6c7
cmp byte [esi + 0x433], bl
je 0x49f6c7
mov ecx, dword [esi + 0x330]
mov word [esi + 0x433], bx
push ecx
lea ebx, [esi + 0x320]
call fcn.0043c6b0
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, edx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c380
pop ebx
ret
cmp eax, 0x17e2
jne 0x49f6ff
mov ecx, dword [esi + 0xc]
push 0
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x49f717
push 0
push eax
call edi
jmp 0x49f72b
mov edx, dword [esi + 0x8a4]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x8a4], 6
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x49f73c
push 0
push eax
call edi
jmp 0x49f750
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x49f777
cmp byte [ebx + 0x113], 0
je 0x49f777
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c6b0
mov eax, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push eax
push ecx
lea ecx, [esi + 0x34c]
call fcn.0051c380
cmp dword [esi + 0x78c], 0
lea ebx, [esi + 0x5cc]
je 0x49f7bc
cmp byte [ebx + 0x113], 0
je 0x49f7bc
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c6b0
mov edx, dword [esi + 0x19d4]
sub edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c380
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x49f7f9
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
mov ecx, dword [esi + 0x116c]
mov edx, dword [ecx + 4]
pop edi
mov dword [esi + edx + 0x116c], 6
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
Function at 0x49f820
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e4
jne 0x49f891
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x15c8]
cmp eax, ebx
je 0x49f84a
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49f85e
mov eax, dword [esi + 0x15c4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x15c4], 6
cmp dword [esi + 0x78c], ebx
je 0x49f9bf
cmp byte [esi + 0x6df], bl
je 0x49f9bf
mov ecx, dword [esi + 0x5dc]
mov word [esi + 0x6df], bx
push ecx
lea ebx, [esi + 0x5cc]
call fcn.0043c6b0
pop ebx
ret
cmp eax, 0x17e2
jne 0x49f8aa
mov edx, dword [esi + 0xc]
push 0
push eax
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x49f8c2
push 0
push eax
call edi
jmp 0x49f8d6
mov eax, dword [esi + 0x8a4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x8a4], 6
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x49f8e7
push 0
push eax
call edi
jmp 0x49f8fb
mov edx, dword [esi + 0x116c]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x116c], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x49f922
cmp byte [ebx + 0x113], 0
je 0x49f922
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c6b0
cmp dword [esi + 0x4e0], 0
lea ebx, [esi + 0x320]
je 0x49f94c
cmp byte [ebx + 0x113], 0
je 0x49f94c
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c6b0
mov ebx, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push ebx
push ecx
lea ecx, [esi + 0x34c]
call fcn.0051c380
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, ebx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c380
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x49f9a0
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e4
pop ebx
ret
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
mov dword [esi + 0x19e0], 0x17e4
pop edi
pop ebx
ret
Function at 0x4a0e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5351d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x558ab8
mov dword [edi + 0x2c], 0x558ac0
mov dword [edi + 0x38cc], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoEditViewWnd.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x6c], 0x55e624
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov byte [edi + 0x78], bl
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x80], bl
push 1
lea ecx, [edi + 0x84]
call fcn.0043b460
push 1
lea ecx, [edi + 0x330]
call fcn.0043b460
push 1
lea ecx, [edi + 0x5dc]
call fcn.00508f00
push 1
lea ecx, [edi + 0x66c]
call fcn.00508f00
lea eax, [edi + 0x6fc]
push eax
mov byte [ebp - 4], 6
call fcn.00465810
lea esi, [edi + 0x750]
call fcn.00468000
lea esi, [edi + 0x17ac]
call fcn.00468000
lea esi, [edi + 0x2808]
call fcn.00468000
mov dword [edi + 0x3864], ebx
mov dword [edi + 0x3868], ebx
mov dword [edi + 0x386c], ebx
mov dword [edi + 0x3870], ebx
mov dword [edi + 0x3874], ebx
mov dword [edi + 0x3878], ebx
mov dword [edi + 0x387c], ebx
mov dword [edi + 0x3880], ebx
mov dword [edi + 0x3888], ebx
mov dword [edi + 0x388c], ebx
mov dword [edi + 0x3890], ebx
mov dword [edi + 0x3894], ebx
mov dword [edi + 0x3898], ebx
mov dword [edi + 0x389c], ebx
mov dword [edi + 0x38a0], ebx
mov dword [edi + 0x38a4], ebx
mov dword [edi + 0x38a8], ebx
mov dword [edi + 0x38ac], ebx
mov dword [edi + 0x38b0], ebx
mov dword [edi + 0x38b4], ebx
mov dword [edi + 0x38b8], ebx
mov dword [edi + 0x38bc], ebx
mov dword [edi + 0x38c0], ebx
mov dword [edi + 0x38c4], ebx
mov dword [edi + 0x38c8], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a33d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub ecx, dword [edi + 0x38bc]
push ebx
mov ebx, dword [edi + 0x38b8]
push esi
mov esi, dword [edi + 0x388c]
mov eax, esi
neg eax
add eax, eax
sub eax, dword [edi + 0x38c0]
push 1
add eax, dword [ebp + 0x10]
sub ecx, ebx
cdq
push ecx
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x300000
push eax
lea esi, [edi + 0x17ac]
mov eax, 0x2372
call fcn.00468ac0
mov esi, eax
test esi, esi
je 0x4a3456
mov eax, dword [edi + 0x17dc]
test eax, eax
je 0x4a3440
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [edi + 0x17d8]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x17d8], 6
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4a3460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, dword [esi + 0x38b4]
mov edx, dword [esi + 0x3888]
push edi
mov edi, dword [esi + 0x38b0]
push 0
sub eax, edi
push eax
lea ebx, [edx + edx]
sub ecx, ebx
push ecx
push edi
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x10]
push eax
add esi, 0x2808
mov eax, 0x2371
call fcn.00468ac0
mov ebx, eax
test ebx, ebx
je 0x4a3534
mov edi, esi
mov byte [esi + 0xeac], 1
call fcn.0046f6d0
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
push ebx
push edi
mov ecx, esi
call fcn.0046f870
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
push edi
mov edx, esi
call fcn.0046faa0
mov ecx, dword [ebp - 4]
push ecx
push ebx
push edi
mov eax, esi
call fcn.0046fce0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push ebx
push edi
mov ecx, esi
call fcn.0046ff50
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2838]
test eax, eax
je 0x4a351e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x2834]
mov edx, dword [eax + 4]
mov dword [ecx + edx + 0x2834], 6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a3820
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b17d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x558bf8
mov dword [edi + 0x2c], 0x558c00
mov dword [edi + 0x2fb4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoFileListPane.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
lea esi, [edi + 0x5c]
call fcn.004aa870
lea esi, [edi + 0x1328]
call fcn.004a4f70
lea eax, [edi + 0x2128]
push eax
mov byte [ebp - 4], 3
call fcn.0045ca40
mov dword [edi + 0x2f20], ebx
mov dword [edi + 0x2f24], ebx
mov dword [edi + 0x2f28], ebx
mov ecx, vtable.CMemMap.0
mov dword [edi + 0x2f1c], ecx
mov dword [edi + 0x2f30], ebx
mov dword [edi + 0x2f34], ebx
mov eax, vtable.CSemaphore.0
mov dword [edi + 0x2f2c], eax
mov dword [edi + 0x2f38], ebx
mov dword [edi + 0x2f3c], ebx
mov dword [edi + 0x2f40], ebx
mov dword [edi + 0x2f44], ebx
mov byte [edi + 0x2f48], bl
mov dword [edi + 0x2f4c], ebx
mov dword [edi + 0x2f54], ebx
mov dword [edi + 0x2f58], ebx
mov dword [edi + 0x2f5c], ebx
mov dword [edi + 0x2f50], ecx
mov dword [edi + 0x2f64], ebx
mov dword [edi + 0x2f60], eax
mov dword [edi + 0x2f68], ebx
mov dword [edi + 0x2f6c], ebx
mov dword [edi + 0x2f70], ebx
mov dword [edi + 0x2f74], ebx
mov dword [edi + 0x2f78], ebx
mov byte [edi + 0x2f7c], bl
mov dword [edi + 0x2f80], ebx
mov dword [edi + 0x2f84], ebx
mov dword [edi + 0x2f88], ebx
mov dword [edi + 0x2f90], ebx
mov dword [edi + 0x2f8c], ebx
mov dword [edi + 0x2f94], ebx
mov dword [edi + 0x2f98], ebx
mov dword [edi + 0x2f9c], ebx
mov dword [edi + 0x2fa4], ebx
mov dword [edi + 0x2fa8], 1
mov dword [edi + 0x2fac], ebx
mov dword [edi + 0x2fa0], ebx
mov byte [edi + 0x2e98], bl
mov dword [edi + 0x2fb0], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7030
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53da58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x559084
mov dword [edi + 0x2c], 0x55908c
mov dword [edi + 0x3c1c], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoFilerPage.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
lea eax, [edi + 0x74]
call fcn.00503a30
lea esi, [edi + 0x120]
call fcn.004a8240
lea eax, [edi + 0xc38]
push eax
mov byte [ebp - 4], 4
call fcn.004a3820
mov ecx, 0xc
lea eax, [edi + 0x3bf4]
mov byte [eax], bl
inc eax
dec ecx
jne 0x4a70f7
mov dword [edi + 0x3c00], ebx
mov dword [edi + 0x3bf0], ebx
mov byte [edi + 0x3c05], bl
mov dword [edi + 0x3c08], ebx
mov dword [edi + 0x3c0c], ebx
mov dword [edi + 0x3c14], ebx
mov dword [edi + 0x3c18], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4