joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474d50
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x34
test edx, edx
push esi
mov esi, dword [esp + 0x44]
push edi
mov word [esi], 0
jge 0x474d68
xor edx, edx
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 8]
push eax
push 0
push 0x104b
push ecx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x474de9
mov edx, dword [esp + 0x28]
test edx, edx
je 0x474de9
mov ecx, 0x41
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x474dd2
push 0x103
push edx
push esi
call fcn.004d6c3f
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x34
ret
push 0xc
push esi
push edx
call fcn.004c93e0
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x474e00
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x34
test edx, edx
jge 0x474e0d
xor edx, edx
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 4]
push eax
push 0
push 0x104b
push ecx
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
pop edi
jne 0x474e57
mov eax, dword [esp + 0x20]
test eax, eax
je 0x474e57
movsx eax, byte [eax + 0x22e]
add esp, 0x34
ret
or eax, 0xffffffff
add esp, 0x34
ret

Function at 0x474e60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub esp, 0x34
test edx, edx
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x4c]
mov word [ebx], 0
push esi
mov word [ebp], 0
mov word [eax], 0
mov word [ecx], 0
jge 0x474e95
xor edx, edx
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x50]
push 0x104b
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
pop edi
jne 0x474f5c
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x474f5c
mov ecx, dword [esi + 0x208]
push 0
push ecx
push 0
push ebx
push 0x5aae60
call fcn.004c9730
mov edx, dword [esi + 0x210]
mov eax, dword [esi + 0x20c]
push ebp
push edx
push eax
call fcn.004c91f0
mov ecx, dword [esi + 0x220]
mov edx, dword [esi + 0x21c]
mov eax, dword [esp + 0x74]
push ecx
push edx
push str._d_x__d_pixels
push eax
call fcn.004d5ee1
mov eax, dword [esi + 0x214]
add esp, 0x30
test eax, eax
je 0x474f50
mov eax, dword [esi + 0x218]
test eax, eax
je 0x474f50
mov ecx, dword [esp + 0x58]
mov edx, eax
mov eax, dword [esi + 0x214]
push ecx
push edx
push eax
call fcn.004c91f0
add esp, 0xc
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
Function at 0x474f70
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x444
lea eax, [esp + 0x34]
push ebx
push ebp
push esi
push edi
push 1
push eax
push ecx
call fcn.004c93e0
mov ebx, dword [esp + 0x464]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
xor esi, esi
push esi
push esi
push 0x1004
push ebx
call ebp
test eax, eax
jle 0x47504c
lea edx, [esp + 0x10]
xor eax, eax
push edx
mov ecx, 0xd
lea edi, [esp + 0x14]
push eax
push 0x104b
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], esi
call ebp
cmp eax, 1
jne 0x475037
mov eax, dword [esp + 0x30]
test eax, eax
mov edi, eax
je 0x475037
mov ecx, dword [esp + 0x45c]
push ecx
push eax
call fcn.004d7652
add esp, 8
test eax, eax
je 0x47505a
lea edx, [esp + 0x44]
push edx
call fcn.004d6713
add esp, 4
test eax, eax
jne 0x475037
lea eax, [esp + 0x24c]
push 0xc
push eax
push edi
call fcn.004c93e0
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x258]
push ecx
push edx
call fcn.004d7652
add esp, 0x14
test eax, eax
je 0x47505a
push 0
push 0
push 0x1004
push ebx
inc esi
call ebp
cmp esi, eax
jl 0x474faf
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x444
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x444
ret

Function at 0x475070
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x240
push ebx
push ebp
mov ebp, dword [esp + 0x24c]
push edi
push eax
push ebp
call fcn.00474f70
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x47513e
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 4
push ecx
push eax
push 0x104b
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x47513e
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0xc], eax
je 0x47513e
push esi
mov esi, dword [esp + 0x25c]
push 0x103
push esi
push eax
call fcn.004d6c3f
lea edx, [esp + 0x54]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x20]
push 0xc
push edx
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x2c], 0x1005
mov dword [esp + 0x30], ebx
call fcn.004c93e0
mov ecx, dword [esp + 0x28]
add esp, 0x18
lea edx, [esp + 0x14]
lea eax, [esp + 0x48]
push edx
push 0
push 0x104c
push ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x44], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x240
ret
Function at 0x475150
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
test esi, esi
push edi
jl 0x4751d7
mov ebx, dword [esp + 0x48]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push ebx
call ebp
cmp esi, eax
jge 0x4751d7
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov edi, 4
push eax
push 0
push 0x104b
push ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
call ebp
cmp eax, 1
jne 0x4751d7
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4751d7
push eax
call fcn.004d59c1
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
push ecx
push 0
push 0x104c
push ebx
mov dword [esp + 0x40], 0
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret

Function at 0x4751e0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x23c
push ebx
mov ebx, dword [esp + 0x24c]
push ebp
push esi
push edi
push eax
mov word [ebx], 0
call fcn.004d6713
add esp, 4
cmp eax, 1
jbe 0x475302
mov ebp, dword [esp + 0x250]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x254]
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x104b
push ebp
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x475302
mov esi, dword [esp + 0x30]
test esi, esi
je 0x475302
lea edx, [esp + 0x44]
push eax
push edx
push edi
push ebp
call fcn.00474d50
movsx ecx, word [esi + 0x22c]
mov eax, dword [esi + 0x224]
add esp, 0x10
mov edx, dword [esi + 0x220]
push 0
push 0
push 0
push 0x40590000
push 0
push eax
mov eax, dword [esi + 0x21c]
push ecx
push edx
push eax
push 0
push 0xfffffc19
push 0
push 0
push 0x1004
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
movsx edx, byte [esi + 0x22e]
mov ecx, dword [esp + 0x28c]
inc edi
push eax
push edi
push ecx
mov ecx, dword [esp + 0x294]
lea eax, [esp + 0x7c]
push edx
push eax
push ecx
push ebx
call fcn.004b7220
push ebx
call fcn.004d6713
add esp, 0x4c
cmp word [ebx + eax*2 - 2], 0xa
jne 0x4752f2
push ebx
call fcn.004d6713
add esp, 4
mov word [ebx + eax*2 - 2], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x23c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x23c
ret

Function at 0x475350
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push edi
mov edx, dword [esp + 0x3c]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
push 0
push 0x104b
push edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
pop edi
jne 0x4753a0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4753a0
mov cl, byte [esp + 0x40]
mov byte [eax + 0x22f], cl
mov eax, 1
add esp, 0x34
ret
Function at 0x4753b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push edi
mov edx, dword [esp + 0x3c]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
push 0
push 0x104b
push edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
pop edi
jne 0x475401
mov eax, dword [esp + 0x20]
test eax, eax
je 0x475401
movsx eax, byte [eax + 0x22f]
add esp, 0x34
ret
xor eax, eax
add esp, 0x34
ret

Function at 0x475410
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x240
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
mov ebp, dword [esp + 0x250]
push esi
mov esi, dword [esp + 0x250]
cmp ebp, 0xffffffff
jne 0x475441
push 0
push 0
push 0x1004
push esi
call ebx
mov ebp, eax
dec ebp
push 0
push 0
push 0x1004
push esi
call ebx
cmp ebp, eax
jl 0x475460
push 0
push 0
push 0x1004
push esi
call ebx
mov ebp, eax
dec ebp
cmp ebp, dword [esp + 0x258]
je 0x4755ac
push edi
push 0
push 0
push 0x1004
push esi
call ebx
mov edx, eax
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov word [esp + 0x48], ax
push ecx
push 0
lea eax, [esp + 0x50]
push 0x104d
push esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x104
call ebx
mov edi, dword [esp + 0x25c]
lea edx, [esp + 0x14]
push edx
push 0
push 0x104b
push esi
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], edi
call ebx
test eax, eax
je 0x4754fa
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x104c
push esi
mov dword [esp + 0x28], eax
call ebx
cmp ebp, edi
jge 0x47553b
dec edi
cmp edi, ebp
jl 0x475572
test edi, edi
jl 0x475572
lea edx, [esp + 0x14]
mov dword [esp + 0x18], edi
push edx
push 0
push 0x104b
push esi
call ebx
test eax, eax
je 0x475534
lea ecx, [esp + 0x14]
lea eax, [edi + 1]
push ecx
push 0
push 0x104c
push esi
mov dword [esp + 0x28], eax
call ebx
dec edi
cmp edi, ebp
jge 0x475503
jmp 0x475572
inc edi
cmp edi, ebp
jg 0x475572
lea edx, [esp + 0x14]
mov dword [esp + 0x18], edi
push edx
push 0
push 0x104b
push esi
call ebx
test eax, eax
je 0x47556d
lea ecx, [esp + 0x14]
lea eax, [edi - 1]
push ecx
push 0
push 0x104c
push esi
mov dword [esp + 0x28], eax
call ebx
inc edi
cmp edi, ebp
jle 0x475540
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0
push 0x104b
push esi
mov dword [esp + 0x28], edi
call ebx
test eax, eax
je 0x4755a0
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebp
push eax
push 0
push 0x104c
push esi
call ebx
push 0
push edi
push 0x1008
push esi
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x240
ret
Function at 0x475760
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x104b
push edx
mov word [ebx], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4757e9
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4757e9
mov ecx, dword [eax + 0x214]
lea esi, [eax + 0x214]
test ecx, ecx
jne 0x4757e9
mov ecx, dword [eax + 0x218]
test ecx, ecx
jne 0x4757e9
push 0
push eax
call fcn.004755c0
add esp, 8
cmp eax, 1
jne 0x4757e9
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
push eax
push ecx
call fcn.004c91f0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x34
ret

Function at 0x4757f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
xor esi, esi
push edi
push esi
push esi
xor edi, edi
push 0x1004
push ebx
mov dword [esp + 0x20], edi
call ebp
test eax, eax
jle 0x4758ba
cmp dword [esp + 0x54], 1
jne 0x475832
push 2
push esi
push 0x102c
push ebx
call ebp
cmp eax, 2
jne 0x475899
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
push eax
push 0
push 0x104b
push ebx
mov dword [esp + 0x28], esi
call ebp
test eax, eax
je 0x475899
mov eax, dword [esp + 0x34]
test eax, eax
je 0x475899
cmp dword [esp + 0x54], 1
je 0x475881
mov ecx, dword [eax + 0x214]
test ecx, ecx
jne 0x475899
mov ecx, dword [eax + 0x218]
test ecx, ecx
jne 0x475899
mov ecx, dword [esp + 0x50]
push ecx
push eax
call fcn.004755c0
mov ecx, dword [esp + 0x18]
add esp, 8
add ecx, eax
mov dword [esp + 0x10], ecx
push 0
push 0
push 0x1004
push ebx
inc esi
call ebp
cmp esi, eax
jl 0x47581b
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret

Function at 0x4758d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x284
push esi
push edi
mov edx, dword [esp + 0x290]
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x294]
lea ecx, [esp + 8]
push ecx
push 0
push 0x104b
push edx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x475971
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, eax
je 0x475971
mov edi, dword [esp + 0x298]
push eax
push edi
call fcn.004d7652
add esp, 8
test eax, eax
jne 0x475971
lea eax, [esp + 0x3c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x475971
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x50]
sub ecx, eax
mov eax, dword [esp + 0x54]
mov dword [esi + 0x208], ecx
mov dword [esi + 0x20c], edx
mov dword [esi + 0x210], eax
pop edi
mov eax, 1
pop esi
add esp, 0x284
ret
Function at 0x475980
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push esi
push 0x230
push 1
call fcn.004d61b4
mov esi, eax
add esp, 8
test esi, esi
jne 0x47599e
pop esi
add esp, 0x34
ret
mov ecx, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x48]
lea eax, [edi + 0x2c]
push eax
push ecx
push str._s_s
push 0x103
push esi
call fcn.004d8460
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
sub edx, eax
push esi
mov dword [esi + 0x208], edx
mov eax, dword [edi + 0x14]
mov edx, dword [esp + 0x5c]
mov dword [esi + 0x20c], eax
mov ecx, dword [edi + 0x18]
xor eax, eax
mov dword [esi + 0x210], ecx
mov ecx, 0xd
lea edi, [esp + 0x20]
mov byte [esi + 0x22e], 0xff
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 0
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 0x1007
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], 0xffffffff
call fcn.004d6713
mov ecx, dword [esp + 0x58]
add esp, 0x18
inc eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], eax
lea eax, [esp + 8]
push eax
push 0
push 0x104d
push ecx
mov dword [esp + 0x38], esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov eax, 1
pop esi
add esp, 0x34
ret

Function at 0x475a60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x475ae2
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
xor esi, esi
push esi
push esi
push 0x1004
push ebx
call ebp
test eax, eax
jle 0x475ad4
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
push 0
push 0x104b
push ebx
mov dword [esp + 0x24], esi
call ebp
test eax, eax
je 0x475ac2
mov eax, dword [esp + 0x30]
test eax, eax
je 0x475ac2
push eax
call fcn.004d59c1
add esp, 4
push 0
push 0
push 0x1004
push ebx
inc esi
call ebp
cmp esi, eax
jl 0x475a85
pop edi
push 0
push 0
push 0x1009
push ebx
call ebp
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x475bd0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0xe84
mov eax, dword [esp + 0xe90]
mov ecx, dword [esp + 0xe8c]
push eax
push ecx
lea edx, [esp + 0x874]
push str._s_s
push edx
call fcn.004d5ee1
add esp, 0x10
lea eax, [esp + 4]
lea ecx, [esp + 0x86c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x475d0e
mov edx, dword [esp + 0xe98]
push ebx
push ebp
push esi
push edx
call fcn.004d722b
mov ebx, dword [esp + 0xeb0]
mov esi, dword [esp + 0xea4]
mov ebp, dword [esp + 0xe98]
add esp, 4
mov al, byte [esp + 0x10]
test al, 0x10
jne 0x475ce8
test al, 2
je 0x475c62
mov eax, dword [esp + 0xea8]
test eax, eax
je 0x475ce8
lea eax, [esp + 0x3c]
push 0x207
lea ecx, [esp + 0x46c]
push eax
push ecx
call fcn.004d6c3f
lea edx, [esp + 0x26c]
push 0x104
lea eax, [esp + 0x478]
push edx
push eax
mov word [esp + 0x88e], 0
call fcn.004c7980
lea ecx, [esp + 0x278]
push ecx
call fcn.004d722b
mov eax, dword [esp + 0xec0]
lea edx, [esp + 0x27c]
push edx
push eax
call fcn.00475af0
add esp, 0x24
test eax, eax
je 0x475ce8
mov edx, dword [esi]
inc edx
test ebx, ebx
mov dword [esi], edx
mov eax, edx
jne 0x475ce8
mov ecx, dword [esp + 0xe98]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push ebp
call fcn.00475980
add esp, 0x10
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x475c43
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebp
pop ebx
add esp, 0xe84
ret

Function at 0x475d20
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push esi
call fcn.00499380
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 8
push 0x5b9260
push 0
push str.UseAssociatedOnly
push str.Extensions
call ebx
push 0x5b9260
push edi
cmp eax, 1
push esi
jne 0x475d71
push 0x5aae60
push str.AllExtensions
push str.Extensions
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x475d8b
push esi
push str.CustomExtensions
push str.Extensions
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call fcn.004d722b
add esp, 4
push 0x5b9260
push 1
push str.ShowHiddenFiles
push str.Viewing
call ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
ret
Function at 0x475f50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0xa94
push ebx
push ebp
push esi
mov esi, dword [esp + 0xaa8]
push edi
push esi
call fcn.004c9990
mov eax, dword [0x59f780]
add esp, 4
test ah, 0x10
push 0
je 0x475fee
push 0x1000
lea eax, [esp + 0x26c]
push 0x104
push eax
call fcn.00453850
lea ecx, [esp + 0x274]
push 0x3b
push ecx
call fcn.004d75ed
mov ebx, dword [esp + 0xac8]
mov ebp, dword [esp + 0xad0]
mov edi, dword [esp + 0xad4]
add esp, 0x18
test eax, eax
je 0x475fd6
mov eax, dword [esp + 0xaa8]
push edi
lea edx, [esp + 0x268]
push ebp
push edx
push ebx
push esi
push eax
call fcn.00475db0
add esp, 0x18
jmp 0x47601f
mov edx, dword [esp + 0xaa8]
push 0
push edi
push ebp
lea ecx, [esp + 0x270]
push ebx
push ecx
push esi
push edx
jmp 0x476017
mov edi, dword [esp + 0xac0]
mov ebp, dword [esp + 0xabc]
mov ebx, dword [esp + 0xab4]
mov eax, dword [esp + 0xab8]
mov ecx, dword [esp + 0xaac]
push edi
push ebp
push ebx
push eax
push esi
push ecx
call fcn.00475bd0
add esp, 0x1c
push esi
lea edx, [esp + 0x470]
push 0x59f064
push edx
call fcn.004d5ee1
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x4760ee
test byte [esp + 0x14], 0x10
je 0x4760cb
cmp word [esp + 0x40], 0x2e
jne 0x476090
lea edx, [esp + 0x40]
push edx
call fcn.004d6713
add esp, 4
cmp eax, 1
je 0x4760cb
lea eax, [esp + 0x40]
push eax
call fcn.004d6713
add esp, 4
cmp eax, 2
jne 0x476090
cmp word [esp + 0x42], 0x2e
je 0x4760cb
lea ecx, [esp + 0x40]
lea edx, [esp + 0x694]
push ecx
push esi
push str._s_s_
push edx
call fcn.004d5ee1
mov eax, dword [esp + 0xac4]
mov edx, dword [esp + 0xab8]
push edi
push ebp
push eax
lea ecx, [esp + 0x6b0]
push ebx
push ecx
push edx
call fcn.00475f50
add esp, 0x28
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x476055
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa94
ret
Function at 0x476220
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x14]
push esi
xor esi, esi
push edi
push esi
push 0x74
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
test al, 8
je 0x47623b
mov esi, 1
mov eax, dword [esp + 0x18]
mov edi, 0x1e
cmp eax, 0x74
jg 0x4762e5
je 0x4762c4
add eax, 0xffffffee
cmp eax, 0x3b
ja case.0x476263.24
xor ecx, ecx
mov cl, byte [eax + 0x47644c]
jmp dword [ecx*4 + 0x476430]
neg esi
sbb esi, esi
and esi, 0x32
add esi, 9
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 4
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 5
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 6
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 7
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 8
jmp 0x476345
mov eax, dword [0x59f744]
cmp eax, edi
je 0x47634b
test esi, esi
je 0x4762db
add eax, 0x32
mov dword [0x59f744], eax
jmp 0x47634b
sub eax, 0x32
mov dword [0x59f744], eax
jmp 0x47634b
cmp eax, 0x486
jg 0x47631e
je 0x476312
cmp eax, 0xa3
je 0x476306
cmp eax, 0x484
jne case.0x476263.24
neg esi
sbb esi, esi
and esi, 0x32
inc esi
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 0xa
jmp 0x476345
neg esi
sbb esi, esi
and esi, 0x32
add esi, 3
jmp 0x476345
sub eax, 0x48a
je 0x47633b
sub eax, 2
je 0x476333
neg esi
sbb esi, esi
and esi, 0x32
jmp 0x476345
mov dword [0x59f744], edi
jmp 0x47634b
neg esi
sbb esi, esi
and esi, 0x32
add esi, 2
mov dword [0x59f744], esi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x59f744]
mov esi, dword [esp + 0xc]
cmp eax, edi
je 0x4763f4
mov edi, dword [esp + 0x20]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
push ebp
push edi
mov ebp, eax
call ebx
test eax, eax
je 0x4763a3
push 0x5b9260
push 1
push str.FullSort
push 0x59a1bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x4763a3
add ebp, 0x64
mov eax, dword [0x59f744]
cmp eax, 4
je 0x4763b2
cmp eax, 0x36
jne 0x4763c6
push 0
push edi
call ebx
neg eax
sbb eax, eax
inc eax
push eax
push esi
call fcn.004757f0
add esp, 0xc
push fcn.00474430
push ebp
push 0x1030
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [0x59f744]
xor edx, edx
cmp ebx, 0x32
setg dl
push edx
push 0xffffffffffffffff
push esi
call fcn.004bc690
add esp, 0xc
pop ebp
pop ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00474f70
mov ecx, dword [esp + 0x18]
add esp, 8
push 0x7f00
push 0
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [esp + 0x1c]
push 1
push edx
call fcn.0048cce0
add esp, 8
pop edi
pop esi
ret