joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441be0
Capabilities:
Enumerate files on windows
Get graphical window text

Disassembly:
sub esp, 0x4f8
mov eax, dword [esp + 0x500]
push ebp
push esi
lea ecx, [esp + 0x2b8]
push eax
push ecx
xor ebp, ebp
call fcn.004d631b
lea edx, [esp + 0x2c0]
push edx
call fcn.004c9990
lea eax, [esp + 0x2c4]
push 0x59a894
push eax
call fcn.004d62f1
add esp, 0x14
lea ecx, [esp + 0x68]
lea edx, [esp + 0x2b8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
je 0x441d3d
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov bl, 0x10
test byte [esp + 0x70], bl
je 0x441c85
lea eax, [esp + 0x9c]
push 0x59a890
push eax
call fcn.004d78c5
add esp, 8
test eax, eax
je 0x441c85
lea ecx, [esp + 0x9c]
push 0x59a888
push ecx
call fcn.004d78c5
add esp, 8
test eax, eax
jne 0x441ca5
lea edx, [esp + 0x70]
push edx
push esi
call edi
test eax, eax
jne 0x441c4d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x4f8
ret
mov ecx, dword [0x5b5550]
mov esi, dword [esp + 0x50c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
push eax
push 0
mov ebp, 1
push 0x113f
push ecx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0x40
call ebx
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x514]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [0x5b5550]
push 0
push 0x1132
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0xffff0002
mov dword [esp + 0x54], 0x63
mov dword [esp + 0x64], 0x5aae60
mov dword [esp + 0x68], ebp
mov dword [esp + 0x44], ebp
call ebx
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x4f8
ret
Function at 0x441d50
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x778
push esi
mov esi, dword [esp + 0x784]
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0xa2
lea edi, [esp + 0x3c]
test esi, esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffff0002
mov dword [esp + 0x10], 0x67
rep stosd dword es:[edi], eax
jne 0x441db1
mov eax, dword [esp + 0x784]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00499400
add esp, 8
test eax, eax
jne 0x441dea
pop edi
pop esi
add esp, 0x778
ret
push esi
call fcn.004d6713
add esp, 4
cmp eax, 0x143
jbe 0x441dc8
mov eax, 0x143
jmp 0x441dd1
push esi
call fcn.004d6713
add esp, 4
push eax
lea edx, [esp + 0x40]
push esi
push edx
call fcn.004d6c3f
lea eax, [esp + 0x48]
push eax
call fcn.004c9990
add esp, 0x10
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0x2c4]
push 0x200
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2c8]
push 0x2b4
push ecx
lea edx, [esp + 0x48]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jl 0x441f29
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x578]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2d0]
push eax
call fcn.004d6713
add esp, 4
cmp eax, 0x103
jbe 0x441e4e
mov eax, 0x103
jmp 0x441e5e
lea ecx, [esp + 0x2d0]
push ecx
call fcn.004d6713
add esp, 4
push eax
lea edx, [esp + 0x2d4]
lea eax, [esp + 0x57c]
push edx
push eax
call fcn.004d6c3f
push 2
push 0x105
call fcn.004d61b4
mov esi, eax
add esp, 0x14
test esi, esi
je 0x441f29
lea ecx, [esp + 0x3c]
push ecx
call fcn.004d6713
add esp, 4
cmp eax, 0x104
jbe 0x441ea8
mov eax, 0x104
jmp 0x441eb5
lea edx, [esp + 0x3c]
push edx
call fcn.004d6713
add esp, 4
push eax
lea eax, [esp + 0x40]
push eax
push esi
call fcn.004d6c3f
lea ecx, [esp + 0x584]
lea edx, [esp + 0x48]
push ecx
push 0x59a89c
push edx
call fcn.004d5ee1
lea ecx, [esp + 0x54]
lea eax, [esp + 0x54]
push ecx
mov dword [esp + 0x3c], eax
call fcn.004d6713
add esp, 0x1c
lea edx, [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [0x5b5550]
push edx
push 0
push 0x1132
push eax
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 5
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push esi
push eax
call fcn.00441be0
add esp, 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x778
ret
Function at 0x442630
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x478
mov ecx, dword [0x5b5550]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
mov edi, dword [esp + 0x488]
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 8
mov esi, dword [edi + 0x3c]
push eax
push 0
push 0x113e
push ecx
mov dword [esp + 0x60], esi
call ebx
test eax, eax
je 0x44268f
mov edx, dword [esp + 0x54]
and edx, 0x20
cmp dl, 0x20
jne 0x44268f
cmp dword [edi + 0xc], 2
jne 0x44268f
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x478
ret
push 0
lea eax, [esp + 0x78]
push 0x208
push eax
push esi
call fcn.00442210
mov eax, dword [edi + 0xc]
add esp, 0x10
cmp eax, 2
jne 0x442720
push esi
call fcn.00441f90
lea ecx, [esp + 0x78]
push ecx
push esi
call fcn.00442370
push str.NoStrCmpLogical
call fcn.004418b0
add esp, 0x10
test eax, eax
je 0x4426eb
mov edx, dword [0x5b5550]
push esi
push 0
push 0x1113
push edx
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x478
ret
mov ecx, dword [0x5b5550]
lea eax, [esp + 0xc]
push eax
push 0
push 0x1115
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x442e30
mov dword [esp + 0x24], 9
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x478
ret
cmp eax, 1
jne 0x4427b4
push esi
call fcn.00441f90
mov edx, dword [0x5b5550]
add esp, 4
push esi
push 3
push 0x110a
push edx
call ebx
test eax, eax
jne 0x4427a4
mov ecx, 0xd
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x5b5550]
mov eax, 4
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push 0
push 0x1132
push ecx
mov dword [esp + 0x2c], 0xffff0002
mov dword [esp + 0x30], 0x63
mov dword [esp + 0x44], 1
mov dword [esp + 0x40], 0x5aae60
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x478
ret
lea edx, [esp + 0x74]
push 4
push edx
push esi
call fcn.00441be0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x478
ret
Function at 0x446b80
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5b3cd4]
test eax, eax
jne 0x446b03
mov dword [0x5b3cd4], 1
ret
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3ccc]
test eax, eax
jne 0x446d0c
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetNtVersionNumbers
push 0x59abd0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x446d0c
lea ecx, [esp + 0xc]
push 0x5b3cd8
lea edx, [esp + 0x18]
push ecx
push edx
call eax
mov eax, dword [0x5b3cd8]
push 0x800
and eax, 0xfffffff
push 0
push str.uxtheme.dll
mov dword [0x5b3cd8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x446d0c
cmp dword [esp + 0x14], 0xa
jb 0x446c7c
push 0x31
push esi
call edi
push 0x68
push esi
mov dword [0x5b3ca4], eax
call edi
push 0x6a
push esi
mov dword [0x5b3c98], eax
call edi
push 0x84
push esi
mov dword [0x5b3ca0], eax
call edi
push 0x85
push esi
mov dword [0x5b3c88], eax
call edi
push 0x87
push esi
mov dword [0x5b3c8c], eax
call edi
cmp dword [0x5b3cd8], 0x47ba
jae 0x446c56
mov dword [0x5b3c90], eax
jmp 0x446c5b
mov dword [0x5b3cac], eax
push 0x89
push esi
call edi
push str.SetWindowCompositionAttribute
push str.user32.dll
mov dword [0x5b3c9c], eax
call ebx
push eax
call edi
mov dword [0x5b3c84], eax
push esi
call fcn.00446b10
mov eax, dword [0x5b3ca4]
add esp, 4
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3c98]
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3c88]
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3c8c]
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3c90]
test eax, eax
jne 0x446cbb
mov eax, dword [0x5b3cac]
test eax, eax
je 0x446d0c
mov eax, dword [0x5b3c9c]
test eax, eax
je 0x446d0c
mov esi, 1
push esi
mov dword [0x5b3ccc], esi
call fcn.00446ac0
add esp, 4
call dword [0x5b3c98]
call dword [0x5b3c88]
test eax, eax
je 0x446cf7
call fcn.00446a80
test al, al
mov dword [0x5b3cd0], esi
je 0x446d01
mov dword [0x5b3cd0], 0
pop edi
pop esi
pop ebx
add esp, 4
jmp 0x446af0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x447550
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x248
lea eax, [esp]
push 0x43
push 4
push str._d._d
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x10]
lea edx, [esp + 0x50]
push ecx
push str.https:__www.irfanview.com_checkversion.php_ver_s
push edx
call fcn.004d5ee1
mov ecx, dword [esp + 0x268]
add esp, 0x1c
lea eax, [esp + 0x40]
push 5
push 0x5aae60
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x248
ret
Function at 0x4478e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x29c
mov eax, dword [esp + 0x2a4]
mov dword [esp], 0
mov word [eax], 0
mov eax, dword [esp + 0x2a8]
test eax, eax
je 0x44790a
mov word [eax], 0
push ebx
push ebp
push esi
push edi
mov ecx, 0xa2
xor eax, eax
lea edi, [esp + 0x24]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x24]
push edx
call fcn.004d6713
add esp, 4
cmp word [esp + eax*2 + 0x22], 0x5c
je 0x447952
lea eax, [esp + 0x24]
push 0x598458
push eax
call fcn.004d62f1
add esp, 8
lea ecx, [esp + 0x24]
push str.version.dll
push ecx
call fcn.004d62f1
add esp, 8
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x447a6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeW
push ebx
call esi
push str.GetFileVersionInfoW
push ebx
mov edi, eax
call esi
push str.VerQueryValueW
push ebx
mov ebp, eax
call esi
test edi, edi
mov dword [esp + 0x14], eax
je 0x447a66
test ebp, ebp
je 0x447a66
test eax, eax
je 0x447a66
mov ecx, dword [esp + 0x2b0]
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], 0
call edi
mov esi, eax
test esi, esi
ja 0x4479e8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x29c
ret
push 2
push esi
call fcn.004d61b4
mov edi, eax
add esp, 8
test edi, edi
je 0x447a66
mov edx, dword [esp + 0x2b0]
push edi
push esi
push 0
push edx
call ebp
test eax, eax
je 0x447a5d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x598458
push edi
call dword [esp + 0x24]
test eax, eax
je 0x447a5d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x447a5d
xor edx, edx
xor ecx, ecx
mov dx, word [eax + 0xe]
mov cx, word [eax + 0x10]
push edx
xor edx, edx
mov dx, word [eax + 0x12]
mov eax, dword [esp + 0x2b8]
push ecx
push edx
push str._d._d._d
push eax
call fcn.004d5ee1
add esp, 0x14
mov dword [esp + 0x10], 1
push edi
call fcn.004d59c1
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret

Function at 0x448ca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
sub esp, 0x208
and ecx, 0xffff
push ebp
push esi
push edi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x448d1e
mov edx, dword [0x5b550c]
push edi
push edx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x448d1e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x448d0a
mov ecx, dword [0x5b550c]
lea eax, [esp + 0x10]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call fcn.0040a580
add esp, 0xc
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x208
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x208
ret
Function at 0x4499f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x7cc
mov ecx, 0x170
xor eax, eax
push esi
push edi
lea edi, [esp + 0x214]
push 0x5b9260
rep stosd dword es:[edi], eax
lea eax, [esp + 0x218]
push 0x2e0
push eax
push 0x5aae60
push str.AdvEffectsValue
push str.Batch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
cmp word [esp + 0x214], si
jne 0x449a51
mov ecx, dword [esp + 0x7d8]
pop edi
mov dword [ecx + 0x124], esi
pop esi
add esp, 0x7cc
ret
mov edx, dword [esp + 0x7d8]
cmp dword [edx + 0x12c], esi
jne 0x449b07
lea eax, [esp + 0x214]
push 0x7c
push eax
call fcn.004c9a70
add esp, 8
test eax, eax
jle 0x449b07
mov edi, dword [esp + 0x7e0]
push ebx
mov ebx, dword [esp + 0x7e0]
push 0x20
lea ecx, [esp + 0x1c]
push 0x7c
push ecx
lea edx, [esp + 0x224]
push esi
push edx
call fcn.004c9ab0
lea eax, [esp + 0x2c]
push eax
call fcn.004d6713
add esp, 0x18
test eax, eax
jbe 0x449aef
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push str._d_d__d
push ecx
call fcn.004d6c09
mov ecx, dword [esp + 0x20]
add esp, 0x14
lea eax, [ecx - 0xa9]
cmp eax, edi
jge 0x449aef
cmp ecx, 0xc8
jle 0x449aef
mov dword [ebx + eax*4], ecx
lea edx, [esp + 0x218]
push 0x7c
push edx
inc esi
call fcn.004c9a70
add esp, 8
cmp esi, eax
jl 0x449a8d
pop ebx
pop edi
pop esi
add esp, 0x7cc
ret
Function at 0x44af10
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x5000
call fcn.004d6340
push ebx
push ebp
push esi
mov esi, dword [esp + 0x5010]
push edi
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push 0x2800
push eax
push 0x5aae60
push str.AdvOptionsOrder
push str.Batch
call ebp
mov ebx, dword [esp + 0x5018]
lea ecx, [esp + 0x10]
push ebx
push ecx
push str.AdvOptionsOrder
push str.Batch
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
lea edx, [esp + 0x14]
push 0x2800
push edx
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x1c]
push 0x5aae60
push str.AdvEffectsValue
push str.Batch
rep stosd dword es:[edi], eax
call ebp
lea eax, [esp + 0x10]
push ebx
push eax
push str.AdvEffectsValue
push str.Batch
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x14]
push 0x2800
push ecx
push str.BatchText
call ebp
lea edx, [esp + 0x10]
push ebx
push edx
push str.BatchText
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push 0x2800
push eax
push str.BatchCanvas
call ebp
lea ecx, [esp + 0x10]
push ebx
push ecx
push str.BatchCanvas
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
push esi
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
push 0x2800
push edx
push str.BatchReplaceColor
call ebp
lea eax, [esp + 0x10]
push ebx
push eax
push str.BatchReplaceColor
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x2800
push ecx
push str.BatchWatermark
call ebp
lea edx, [esp + 0x10]
push ebx
push edx
push str.BatchWatermark
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x10]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push 0x2800
push eax
push str.BatchFrame
call ebp
lea ecx, [esp + 0x10]
push ebx
push ecx
push str.BatchFrame
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5000
ret
Function at 0x44c0b0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2570
call fcn.004d6340
push ebx
push esi
push edi
lea eax, [esp + 0x57c]
push 1
push eax
call fcn.00457f00
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 8
xor esi, esi
push 0x5b9260
push 1
push str.OpenIndex
push str.Batch
mov word [esp + 0x384], si
call edi
push 0x5b9260
push esi
push str.SaveBatchDir
push str.Others
mov ebx, eax
call edi
test eax, eax
je 0x44c12d
push 0x5b9260
lea ecx, [esp + 0x168]
push 0x104
push ecx
push 0x598470
push str.OpenDir
push str.Batch
jmp 0x44c176
push 0x5b9040
call fcn.004d6713
add esp, 4
test eax, eax
jbe 0x44c155
lea edx, [esp + 0x164]
push 0x5b9040
push edx
call fcn.004d631b
add esp, 8
jmp 0x44c17c
push 0x5b9260
lea eax, [esp + 0x168]
push 0x104
push eax
push 0x598470
push str.OpenDir
push 0x59ba00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x16
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x57c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x5b5528]
mov eax, dword [0x5b5574]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x374]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x64]
push 0x80
mov dword [esp + 0x1c], edx
push ecx
lea edx, [esp + 0x16c]
push 0x501
push eax
mov dword [esp + 0x1c], 0x58
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x5b6eb4]
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x60
lea edx, [esp + 0x68]
push 0x64
push eax
mov dword [esp + 0x48], edx
mov word [esp + 0x50], si
mov word [esp + 0x52], si
mov dword [esp + 0x54], esi
mov dword [esp + 0x5c], 0x44b0c0
mov dword [esp + 0x60], 0x3f1
mov dword [esp + 0x4c], 0x88026c
call edi
push 0x64
push eax
push 0x2d8
call edi
push esi
mov edi, eax
call fcn.004c49d0
add esp, 4
cmp eax, 0x320
jg 0x44c25c
cmp dword [0x5b6eb4], 0x60
jg 0x44c26c
push esi
call fcn.004c49d0
add edi, 0xfffffff6
add esp, 4
cmp edi, eax
jle 0x44c274
mov dword [esp + 0x60], 1
lea ecx, [esp + 0xc]
mov dword [0x5ba374], 0xffffffff
push ecx
call dword [0x5aae20]
test eax, eax
jne 0x44c295
cmp dword [0x5ba374], esi
jle 0x44c2c6
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x64]
push edx
push 0x5985ac
push eax
call fcn.004d5ee1
add esp, 0xc
lea ecx, [esp + 0x64]
push 0x5b9260
push ecx
push str.OpenIndex
push str.Batch
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebx
add esp, 0x2570
ret
Function at 0x44c2d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x200
lea eax, [esp]
push esi
mov esi, dword [esp + 0x208]
push 0x80
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x59ba48
lea ecx, [esp + 8]
push 0x80
push ecx
call fcn.004c9b60
push 0x40
lea edx, [esp + 0x194]
push 0x2f
push edx
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004c9ab0
push 0x40
lea ecx, [esp + 0x128]
push 0x2f
push ecx
lea edx, [esp + 0x30]
push 1
push edx
call fcn.004c9ab0
lea eax, [esp + 0x1b8]
lea ecx, [esp + 0x138]
push eax
push ecx
lea edx, [esp + 0x40]
push str._s__s
push edx
call fcn.004d5ee1
add esp, 0x44
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
add esp, 0x200
ret

Function at 0x44c620
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x7cc
mov ecx, 0x170
xor eax, eax
push ebx
push ebp
mov ebx, dword [esp + 0x7dc]
push esi
mov ebp, dword [esp + 0x7e4]
push edi
lea edi, [esp + 0x21c]
push 0x5b9260
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push 0x2e0
push eax
push 0x5aae60
push str.AdvEffectsValue
mov dword [ebx], 0
push str.Batch
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x21c], 0
je 0x44c722
lea ecx, [esp + 0x21c]
push 0x7c
push ecx
xor esi, esi
call fcn.004c9a70
add esp, 8
test eax, eax
jle 0x44c722
mov edi, dword [esp + 0x7e0]
push 0x20
lea edx, [esp + 0x20]
push 0x7c
push edx
lea eax, [esp + 0x228]
push esi
push eax
call fcn.004c9ab0
lea ecx, [esp + 0x30]
push ecx
call fcn.004d6713
add esp, 0x18
test eax, eax
jbe 0x44c70b
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x28]
push str._d_d__d
push edx
call fcn.004d6c09
mov ecx, dword [esp + 0x28]
add esp, 0x14
lea eax, [ecx - 0xc8]
cmp eax, 1
jl 0x44c70b
cmp eax, 0x2d
jg 0x44c70b
cmp ecx, edi
je 0x44c72f
lea eax, [esp + 0x21c]
push 0x7c
push eax
inc esi
call fcn.004c9a70
add esp, 8
cmp esi, eax
jl 0x44c6aa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7cc
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [ebx], ecx
pop edi
mov dword [ebp], edx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x7cc
ret

Function at 0x44cad0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x228
push esi
push 0x5b9260
push 1
push str.ShowPNGAlpha
push str.Others
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [esp + 0x234]
push str.BatchWatermark
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
push 1
call fcn.004cae80
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x270]
lea edx, [esp + 0x64]
push esi
push edx
push eax
push ecx
call fcn.0041c490
add esp, 0x50
pop esi
add esp, 0x228
ret
Function at 0x44dbb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
push 0x5b9260
push 0x104
push eax
push 0x5aae60
push str.RenameSearch
push str.Batch
call esi
push 0x5b9260
lea ecx, [esp + 0xc]
push 0x104
push ecx
push 0x5aae60
push str.RenameReplace
push str.Batch
call esi
mov edi, dword [esp + 0x41c]
lea edx, [esp + 8]
lea eax, [esp + 0x210]
push edx
push eax
push edi
call fcn.004509a0
add esp, 0xc
lea ecx, [esp + 0x210]
push 0x5b9260
push 0x104
push ecx
push 0x5aae60
push str.RenameSearch2
push str.Batch
call esi
push 0x5b9260
lea edx, [esp + 0xc]
push 0x104
push edx
push 0x5aae60
push str.RenameReplace2
push str.Batch
call esi
lea eax, [esp + 8]
lea ecx, [esp + 0x210]
push eax
push ecx
push edi
call fcn.004509a0
add esp, 0xc
lea edx, [esp + 0x210]
push 0x5b9260
push 0x104
push edx
push 0x5aae60
push str.RenameSearch3
push str.Batch
call esi
push 0x5b9260
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x5aae60
push str.RenameReplace3
push str.Batch
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x210]
push ecx
push edx
push edi
call fcn.004509a0
add esp, 0xc
pop edi
pop esi
add esp, 0x410
ret
Function at 0x44df40
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push 0x59bb98
push esi
mov dword [edi], 0
mov dword [ebx], 0
call fcn.004d7652
add esp, 8
test eax, eax
je 0x44e041
push str..tif
push esi
call fcn.004d7652
add esp, 8
test eax, eax
je 0x44e041
push 0x59bb90
push esi
call fcn.004d7652
add esp, 8
test eax, eax
je 0x44dfaf
push str..pdf
push esi
call fcn.004d7652
add esp, 8
test eax, eax
jne 0x44e077
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 1
push str.Save_UseNewDLL
push 0x598da0
call esi
test eax, eax
mov dword [edi], eax
je 0x44e000
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
jne 0x44dff7
push 0x5b9260
push 1
push str.SaveAllPages
push 0x598da0
call esi
test eax, eax
jne 0x44dff7
mov dword [ebx], eax
jmp 0x44e032
mov eax, 1
mov dword [ebx], eax
jmp 0x44e032
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xf4]
test eax, eax
jne 0x44e025
push 0x5b9260
push 1
push str.ImpdfIVSaveAll
push str.ImPDF
call esi
test eax, eax
je 0x44e02a
mov eax, 1
mov dword [ebx], eax
mov dword [edi], 0
cmp dword [ebx], 0
jne 0x44e077
mov dword [edi], 0
pop edi
pop esi
pop ebx
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0xf4]
test eax, eax
jne 0x44e070
push 0x5b9260
push 1
push str.SaveAllPages
push str.TIFF
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x44e070
pop edi
mov dword [ebx], eax
pop esi
pop ebx
ret
mov eax, 1
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret