joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4919d0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 0x119c]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4919ea
push 0
push eax
call edi
jmp 0x4919fe
mov eax, dword [esi + 0x1198]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x1198], 6
cmp dword [esi + 0x4f4], 0
lea ebx, [esi + 0x334]
je 0x491a28
cmp byte [ebx + 0x113], 0
je 0x491a28
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
cmp dword [esi + 0x7a0], 0
lea ebx, [esi + 0x5e0]
je 0x491a52
cmp byte [ebx + 0x113], 0
je 0x491a52
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
mov ebx, dword [esi + 0x1240]
sub ebx, dword [esi + 0x124c]
cmp byte [esi + 0x123c], 0
je 0x491a82
mov edx, dword [esi + 0x1244]
push 1
push ebx
push edx
lea ecx, [esi + 0x60c]
call fcn.0051c2b0
sub ebx, dword [esi + 0x124c]
mov eax, dword [esi + 0x1244]
push 1
push ebx
push eax
lea ecx, [esi + 0x360]
call fcn.0051c2b0
mov eax, dword [esi + 0x88c]
test eax, eax
je 0x491aa8
mov byte [eax + 0xd71], 0
lea ebx, [esi + 0x10f0]
call fcn.0044a420
mov eax, dword [esi + 0x10e4]
test eax, eax
je 0x491ac6
push 5
push eax
call edi
pop edi
pop ebx
pop ecx
ret
mov ecx, dword [esi + 0x10e0]
mov edx, dword [ecx + 4]
pop edi
mov dword [esi + edx + 0x10e0], 6
pop ebx
pop ecx
ret
Function at 0x496d20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, 0x554c48
call fcn.00470260
mov eax, dword [ebp + 0x10]
push eax
mov eax, edi
call fcn.00496ec0
push str.FaxPanelFncBtn_BtnBase
lea eax, [edi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x496d60
mov eax, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x496d8e
cmp eax, ebx
je 0x496d8e
cmp word [eax], bx
je 0x496d8e
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x496d7d
mov ecx, 0x54ee24
push ecx
push ebx
push str.Height
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
push str.FaxPanelFncBtn_BtnWnd
lea eax, [edi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x496da7
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x496dd5
cmp eax, ebx
je 0x496dd5
cmp word [eax], bx
je 0x496dd5
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x496dc4
mov ecx, 0x54ee24
push ecx
push ebx
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x496de1
mov ecx, 0x54ee24
cmp dword [esi + 8], ebx
jle 0x496e0c
test ecx, ecx
je 0x496e0c
cmp word [ecx], bx
je 0x496e0c
mov eax, dword [esi + 4]
test eax, eax
jne 0x496dfb
mov eax, 0x54ee24
push eax
push 0
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x496e18
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 8], edi
jle 0x496e45
test ecx, ecx
je 0x496e45
cmp word [ecx], di
je 0x496e45
mov eax, dword [esi + 4]
test eax, eax
jne 0x496e34
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x496e51
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 8], eax
jle 0x496e7c
test ecx, ecx
je 0x496e7c
cmp word [ecx], ax
je 0x496e7c
mov eax, dword [esi + 4]
test eax, eax
jne 0x496e6d
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
xor ecx, ecx
cmp byte [esi + 0x13d8], cl
push edx
mov edx, dword [ebp + 0xc]
setne cl
push eax
push edi
dec ecx
and ecx, eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x13d4], ecx
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push edx
lea edx, [esi + 0xb38]
mov ecx, ebx
call fcn.00489980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x496ec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
push str.FaxPanelFncBtn_BtnText
lea eax, [esi + 0x4c]
call fcn.005080c0
mov eax, dword [esi + 0x4c]
xor ebx, ebx
cmp eax, ebx
jne 0x496ee6
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 0x44], ebx
jle 0x496f18
cmp eax, ebx
je 0x496f18
cmp word [eax], bx
je 0x496f18
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
jne 0x496f03
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x496f1e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x496f2a
mov ecx, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 0x44], ebx
jle 0x496f54
cmp ecx, ebx
je 0x496f54
cmp word [ecx], bx
je 0x496f54
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x496f47
mov eax, 0x54ee24
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
jne 0x496f60
mov ecx, 0x54ee24
cmp dword [esi + 0x44], ebx
jle 0x496f87
test ecx, ecx
je 0x496f87
cmp word [ecx], bx
je 0x496f87
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x496f7a
mov eax, 0x54ee24
push eax
push 0
push str.Width
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x496f93
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 0x44], edi
jle 0x496fc0
test ecx, ecx
je 0x496fc0
cmp word [ecx], di
je 0x496fc0
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x496faf
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x496fcc
mov ecx, 0x54ee24
xor eax, eax
cmp dword [esi + 0x44], eax
jle 0x496ff7
test ecx, ecx
je 0x496ff7
cmp word [ecx], ax
je 0x496ff7
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x496fe8
mov eax, 0x54ee24
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
add esi, 0xb38
call fcn.00489b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4980a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x3c]
push esi
mov ecx, str.BrCcHome.sdd
call fcn.00470260
cmp byte [ebp + 0x14], 0
lea eax, [edi + 0x4c]
je 0x4980ca
push str.PcFaxTxScanPage_Mini_ScanSizeListBox
jmp 0x4980cf
push str.PcFaxTxScanPage_ScanSizeListBox
call fcn.005080c0
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
jne 0x4980e2
mov eax, 0x54ee24
mov dword [ebp - 8], ebx
cmp dword [esi + 8], ebx
jle 0x498114
cmp eax, ebx
je 0x498114
cmp word [eax], bx
je 0x498114
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x4980ff
mov ecx, 0x54ee24
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
push ebx
push str.PosiX
push eax
call edi
mov dword [ebp - 8], eax
jmp 0x49811a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x498126
mov ecx, 0x54ee24
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jle 0x498150
cmp ecx, ebx
je 0x498150
cmp word [ecx], bx
je 0x498150
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x498143
mov eax, 0x54ee24
push eax
push ebx
push str.PosiY
push ecx
call edi
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x49815c
mov ecx, 0x54ee24
mov dword [ebp + 0x14], ebx
cmp dword [esi + 8], ebx
jle 0x498186
cmp ecx, ebx
je 0x498186
cmp word [ecx], bx
je 0x498186
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x498179
mov eax, 0x54ee24
push eax
push ebx
push str.Width
push ecx
call edi
mov dword [ebp + 0x14], eax
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
jne 0x498192
mov ecx, 0x54ee24
cmp dword [esi + 8], ebx
jle 0x4981b9
test ecx, ecx
je 0x4981b9
cmp word [ecx], bx
je 0x4981b9
mov eax, dword [esi + 4]
test eax, eax
jne 0x4981ac
mov eax, 0x54ee24
push eax
push 0
push str.Height
push ecx
call edi
mov ebx, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x4981c5
mov ecx, 0x54ee24
xor edi, edi
cmp dword [esi + 8], edi
jle 0x4981f2
test ecx, ecx
je 0x4981f2
cmp word [ecx], di
je 0x4981f2
mov eax, dword [esi + 4]
test eax, eax
jne 0x4981e1
mov eax, 0x54ee24
push eax
push 0
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push 0x2af8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5776a0
call fcn.00471380
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x498211
mov eax, 0x54ee24
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push 1
push edi
push ebx
push ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [edx + 0x13d4]
add edx, 0x5a8
push ecx
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
push 0x1646
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push edx
mov edx, 0x10200003
call fcn.0042c570
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x498258
push eax
call fcn.0051eadb
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49cf90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8c2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 4], 0x558884
mov dword [ebx + 0x2c], 0x55888c
mov dword [ebx + 0x8210], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x38], al
mov dword [ebp - 4], eax
mov dword [ebx], vtable.CPhotoEditPage.0
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
lea edi, [ebx + 0x74]
call fcn.0049e8f0
lea esi, [ebx + 0x1a84]
call fcn.0050e1d0
lea esi, [ebx + 0x3750]
call fcn.0049b630
lea edi, [ebx + 0x3ffc]
call fcn.0050ca50
lea eax, [ebx + 0x4908]
push eax
mov byte [ebp - 4], 6
call fcn.004a0db0
xor eax, eax
mov dword [ebx + 0x81d8], eax
mov dword [ebx + 0x81ec], eax
mov dword [ebx + 0x81e8], eax
mov dword [ebx + 0x3ff8], eax
mov byte [ebx + 0x8209], al
mov word [ebx + 0x820a], ax
mov byte [ebx + 0x820c], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49d8b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
lea ebx, [esi + 0x74]
call fcn.0049ef50
lea ebx, [esi + 0x4038]
call fcn.00509db0
lea edi, [esi + 0x4908]
call fcn.004a14b0
push 0
call fcn.00514370
mov eax, dword [esi + 0x30]
pop edi
pop ebx
test eax, eax
je 0x49d8ea
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x2c], 6
ret
Function at 0x49f5d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e3
jne 0x49f656
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x1170]
cmp eax, ebx
je 0x49f5fa
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49f60e
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x116c], 6
cmp dword [esi + 0x4e0], ebx
je 0x49f637
cmp byte [esi + 0x433], bl
je 0x49f637
mov ecx, dword [esi + 0x330]
mov word [esi + 0x433], bx
push ecx
lea ebx, [esi + 0x320]
call fcn.0043c520
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, edx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c2b0
pop ebx
ret
cmp eax, 0x17e2
jne 0x49f66f
mov ecx, dword [esi + 0xc]
push 0
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x49f687
push 0
push eax
call edi
jmp 0x49f69b
mov edx, dword [esi + 0x8a4]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x8a4], 6
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x49f6ac
push 0
push eax
call edi
jmp 0x49f6c0
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x49f6e7
cmp byte [ebx + 0x113], 0
je 0x49f6e7
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
mov eax, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push eax
push ecx
lea ecx, [esi + 0x34c]
call fcn.0051c2b0
cmp dword [esi + 0x78c], 0
lea ebx, [esi + 0x5cc]
je 0x49f72c
cmp byte [ebx + 0x113], 0
je 0x49f72c
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
mov edx, dword [esi + 0x19d4]
sub edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c2b0
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x49f769
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
mov ecx, dword [esi + 0x116c]
mov edx, dword [ecx + 4]
pop edi
mov dword [esi + edx + 0x116c], 6
mov dword [esi + 0x19e0], 0x17e3
pop ebx
ret
Function at 0x49f790
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x19e0]
push ebx
cmp eax, 0x17e4
jne 0x49f801
xor ebx, ebx
mov dword [esi + 0x19e0], ebx
mov eax, dword [esi + 0x15c8]
cmp eax, ebx
je 0x49f7ba
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49f7ce
mov eax, dword [esi + 0x15c4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x15c4], 6
cmp dword [esi + 0x78c], ebx
je 0x49f92f
cmp byte [esi + 0x6df], bl
je 0x49f92f
mov ecx, dword [esi + 0x5dc]
mov word [esi + 0x6df], bx
push ecx
lea ebx, [esi + 0x5cc]
call fcn.0043c520
pop ebx
ret
cmp eax, 0x17e2
jne 0x49f81a
mov edx, dword [esi + 0xc]
push 0
push eax
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x8a8]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x49f832
push 0
push eax
call edi
jmp 0x49f846
mov eax, dword [esi + 0x8a4]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x8a4], 6
mov eax, dword [esi + 0x1170]
test eax, eax
je 0x49f857
push 0
push eax
call edi
jmp 0x49f86b
mov edx, dword [esi + 0x116c]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x116c], 6
cmp dword [esi + 0x234], 0
lea ebx, [esi + 0x74]
je 0x49f892
cmp byte [ebx + 0x113], 0
je 0x49f892
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
cmp dword [esi + 0x4e0], 0
lea ebx, [esi + 0x320]
je 0x49f8bc
cmp byte [ebx + 0x113], 0
je 0x49f8bc
mov eax, dword [ebx + 0x10]
push eax
mov word [ebx + 0x113], 0
call fcn.0043c520
mov ebx, dword [esi + 0x19dc]
mov ecx, dword [esi + 0x19d8]
push 1
push ebx
push ecx
lea ecx, [esi + 0x34c]
call fcn.0051c2b0
mov edx, dword [esi + 0x19dc]
mov eax, dword [esi + 0x19d8]
push 1
add edx, ebx
push edx
push eax
lea ecx, [esi + 0x5f8]
call fcn.0051c2b0
mov eax, dword [esi + 0x15c8]
test eax, eax
je 0x49f910
push 5
push eax
call edi
pop edi
mov dword [esi + 0x19e0], 0x17e4
pop ebx
ret
mov ecx, dword [esi + 0x15c4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x15c4], 6
mov dword [esi + 0x19e0], 0x17e4
pop edi
pop ebx
ret
Function at 0x4a0db0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5351a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x558ac0
mov dword [edi + 0x2c], 0x558ac8
mov dword [edi + 0x38cc], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoEditViewWnd.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x6c], 0x55e61c
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov byte [edi + 0x78], bl
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x80], bl
push 1
lea ecx, [edi + 0x84]
call fcn.0043b2e0
push 1
lea ecx, [edi + 0x330]
call fcn.0043b2e0
push 1
lea ecx, [edi + 0x5dc]
call fcn.00508f00
push 1
lea ecx, [edi + 0x66c]
call fcn.00508f00
lea eax, [edi + 0x6fc]
push eax
mov byte [ebp - 4], 6
call fcn.00465650
lea esi, [edi + 0x750]
call fcn.00467e30
lea esi, [edi + 0x17ac]
call fcn.00467e30
lea esi, [edi + 0x2808]
call fcn.00467e30
mov dword [edi + 0x3864], ebx
mov dword [edi + 0x3868], ebx
mov dword [edi + 0x386c], ebx
mov dword [edi + 0x3870], ebx
mov dword [edi + 0x3874], ebx
mov dword [edi + 0x3878], ebx
mov dword [edi + 0x387c], ebx
mov dword [edi + 0x3880], ebx
mov dword [edi + 0x3888], ebx
mov dword [edi + 0x388c], ebx
mov dword [edi + 0x3890], ebx
mov dword [edi + 0x3894], ebx
mov dword [edi + 0x3898], ebx
mov dword [edi + 0x389c], ebx
mov dword [edi + 0x38a0], ebx
mov dword [edi + 0x38a4], ebx
mov dword [edi + 0x38a8], ebx
mov dword [edi + 0x38ac], ebx
mov dword [edi + 0x38b0], ebx
mov dword [edi + 0x38b4], ebx
mov dword [edi + 0x38b8], ebx
mov dword [edi + 0x38bc], ebx
mov dword [edi + 0x38c0], ebx
mov dword [edi + 0x38c4], ebx
mov dword [edi + 0x38c8], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub ecx, dword [edi + 0x38bc]
push ebx
mov ebx, dword [edi + 0x38b8]
push esi
mov esi, dword [edi + 0x388c]
mov eax, esi
neg eax
add eax, eax
sub eax, dword [edi + 0x38c0]
push 1
add eax, dword [ebp + 0x10]
sub ecx, ebx
cdq
push ecx
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x300000
push eax
lea esi, [edi + 0x17ac]
mov eax, 0x2372
call fcn.004688f0
mov esi, eax
test esi, esi
je 0x4a33e6
mov eax, dword [edi + 0x17dc]
test eax, eax
je 0x4a33d0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [edi + 0x17d8]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x17d8], 6
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4a33f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, dword [esi + 0x38b4]
mov edx, dword [esi + 0x3888]
push edi
mov edi, dword [esi + 0x38b0]
push 0
sub eax, edi
push eax
lea ebx, [edx + edx]
sub ecx, ebx
push ecx
push edi
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x10]
push eax
add esi, 0x2808
mov eax, 0x2371
call fcn.004688f0
mov ebx, eax
test ebx, ebx
je 0x4a34c4
mov edi, esi
mov byte [esi + 0xeac], 1
call fcn.0046f500
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
push ebx
push edi
mov ecx, esi
call fcn.0046f6a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
push edi
mov edx, esi
call fcn.0046f8d0
mov ecx, dword [ebp - 4]
push ecx
push ebx
push edi
mov eax, esi
call fcn.0046fb10
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push ebx
push edi
mov ecx, esi
call fcn.0046fd80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2838]
test eax, eax
je 0x4a34ae
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x2834]
mov edx, dword [eax + 4]
mov dword [ecx + edx + 0x2834], 6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a37b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53affd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x558c00
mov dword [edi + 0x2c], 0x558c08
mov dword [edi + 0x2fb4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CPhotoFileListPane.0
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
lea esi, [edi + 0x5c]
call fcn.004aa870
lea esi, [edi + 0x1328]
call fcn.004a4f00
lea eax, [edi + 0x2128]
push eax
mov byte [ebp - 4], 3
call fcn.0045c920
mov dword [edi + 0x2f20], ebx
mov dword [edi + 0x2f24], ebx
mov dword [edi + 0x2f28], ebx
mov ecx, vtable.CMemMap.0
mov dword [edi + 0x2f1c], ecx
mov dword [edi + 0x2f30], ebx
mov dword [edi + 0x2f34], ebx
mov eax, vtable.CSemaphore.0
mov dword [edi + 0x2f2c], eax
mov dword [edi + 0x2f38], ebx
mov dword [edi + 0x2f3c], ebx
mov dword [edi + 0x2f40], ebx
mov dword [edi + 0x2f44], ebx
mov byte [edi + 0x2f48], bl
mov dword [edi + 0x2f4c], ebx
mov dword [edi + 0x2f54], ebx
mov dword [edi + 0x2f58], ebx
mov dword [edi + 0x2f5c], ebx
mov dword [edi + 0x2f50], ecx
mov dword [edi + 0x2f64], ebx
mov dword [edi + 0x2f60], eax
mov dword [edi + 0x2f68], ebx
mov dword [edi + 0x2f6c], ebx
mov dword [edi + 0x2f70], ebx
mov dword [edi + 0x2f74], ebx
mov dword [edi + 0x2f78], ebx
mov byte [edi + 0x2f7c], bl
mov dword [edi + 0x2f80], ebx
mov dword [edi + 0x2f84], ebx
mov dword [edi + 0x2f88], ebx
mov dword [edi + 0x2f90], ebx
mov dword [edi + 0x2f8c], ebx
mov dword [edi + 0x2f94], ebx
mov dword [edi + 0x2f98], ebx
mov dword [edi + 0x2f9c], ebx
mov dword [edi + 0x2fa4], ebx
mov dword [edi + 0x2fa8], 1
mov dword [edi + 0x2fac], ebx
mov dword [edi + 0x2fa0], ebx
mov byte [edi + 0x2e98], bl
mov dword [edi + 0x2fb0], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4