joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0280
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [0x6a20f6]
push esi
push edi
lea eax, [esp + 0x260]
push eax
push 0x104
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x158]
push ecx
push 0x580cbb
push sym.convertifd.exe_i_ifd
push 0x581734
call sym.convertifd.exe_GetAndProcessFileDirectory
lea eax, [esp + 0x168]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c02e3
sub eax, edx
je 0x4c02fe
lea edx, [esp + 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x13c
push 0
mov ecx, 0x4f
mov esi, sym.convertifd.exe_i_icf
lea edi, [esp + 0x20]
push sym.convertifd.exe_i_icf
rep movsd dword es:[edi], dword [esi]
call fcn.00511e90
call sym.convertifd.exe_CfPartialInit
mov eax, dword [0x6a20ee]
mov dword [0x6a20f6], ebx
imul ebx, ebx, 0x5f
lea ecx, [ebx + eax]
mov esi, 1
push ecx
mov dword [0x6a2158], esi
call sym.convertifd.exe_CfScan
push eax
push str._tCfScan_Return_Code:__d_n
call fcn.004bff90
mov dword [sym.convertifd.exe_IsDesignProg], esi
call sym.convertifd.exe_CfSave
mov eax, dword [0x6a20ee]
mov edx, dword [esp + 0x28]
add ebx, eax
mov ecx, 0x4f
lea esi, [esp + 0x30]
mov edi, sym.convertifd.exe_i_icf
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [0x6a20f6], edx
call sym.convertifd.exe_CfScan
push eax
push str._tCfScan_Return_Code:__d_n
call fcn.004bff90
add esp, 0x24
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00511a80
mov esp, ebp
pop ebp
ret

Function at 0x4c2b10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov eax, ebx
push esi
xor ebp, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c2b20
sub eax, edx
add eax, 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4c2bd9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebx
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4c2b50
sub ecx, edi
add ecx, 1
push ecx
push ebx
push eax
call sym.convertifd.exe_MoveFarToFar
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [sym.convertifd.exe_i_window]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
je 0x4c2bd9
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4c2b99
movzx eax, word [0x6a13b8]
jmp 0x4c2bac
cmp eax, 2
movzx eax, word [0x6a13c8]
je 0x4c2bac
movzx eax, word [0x6a145c]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x18], ebp
mov esi, 1
je 0x4c2bd3
push ebx
push 0xfffff051
call sym.convertifd.exe_IpCMessage
add esp, 8
mov eax, esi
pop esi
pop ebp
pop ebx
ret
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x4c3170
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x114
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
mov esi, dword [esp + 0x11c]
push esi
push 0
mov dword [0x6a2684], 0x24ce
mov dword [0x6073bc], 0
call sym.convertifd.exe_JfCopyFile
add esp, 8
test eax, eax
mov dword [0x6a2684], 0xffffffff
je 0x4c3335
cmp eax, 1
jne 0x4c324e
cmp dword [0x6a26a0], 0
je 0x4c3225
call sym.convertifd.exe_PasteText
test eax, eax
jne 0x4c331a
push 1
call sym.convertifd.exe_SwitchToPickMode
add esp, 4
cmp dword [0x6a2a1c], 0
mov dword [0x6a26d4], 0
je 0x4c331a
push 0x26d8
call sym.convertifd.exe_SetModeless
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00511a80
add esp, 0x114
ret
push esi
push 0xfffff052
call sym.convertifd.exe_IpCMessage
add esp, 8
mov eax, 1
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00511a80
add esp, 0x114
ret
call sym.convertifd.exe_TerminateCommand
push 0
call sym.convertifd.exe_InitUndo
call sym.convertifd.exe_ClearPickList
push 1
call sym.convertifd.exe_SwitchToPickMode
add esp, 8
call sym.convertifd.exe_PasteIFD
call sym.convertifd.exe_CountSubformsDefinedInForm
cmp dword [0x6073bc], 4
mov dword [0x6a2bac], eax
jne 0x4c331a
push 0xa
lea eax, [esp + 8]
push eax
push 0x581b14
push str.Control
push str.ExtFif
call sym.convertifd.exe_GetJetFormIniStr
lea ecx, [esp + 4]
push ecx
call fcn.00511d40
add esp, 4
cmp eax, 4
jge 0x4c331a
mov edx, dword [sym.convertifd.exe_i_window]
push edi
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
movzx eax, word [0x6a13c8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test edi, edi
je 0x4c3319
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [eax]
xor esi, esi
test cl, cl
je 0x4c3300
lea edx, [esp + 0x14]
sub edx, eax
nop
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
add eax, 1
add esi, 1
test cl, cl
jne 0x4c32f0
push edi
mov byte [esp + esi + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x14]
push ecx
call fcn.00511b40
add esp, 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00511a80
add esp, 0x114
ret
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
mov dword [sym.convertifd.exe_i_control], 0x26d8
xor eax, eax
call fcn.00511a80
add esp, 0x114
ret
Function at 0x4c6e10
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push ebx
push 1
lea eax, [esp + 0xf]
push 1
push eax
xor esi, esi
call fcn.00515cb6
add esp, 0x10
cmp eax, 1
je 0x4c6e30
xor eax, eax
pop esi
pop ecx
ret
mov al, byte [esp + 7]
cmp al, 0xff
je 0x4c6e65
cmp al, 0xa
je 0x4c6e69
push ebx
push 1
lea ecx, [esp + 0xf]
push 1
mov byte [esi + edi], al
push ecx
add esi, 1
call fcn.00515cb6
add esp, 0x10
cmp eax, 1
jne 0x4c6e61
cmp esi, 0x3ff
jl 0x4c6e30
mov al, byte [esp + 7]
cmp al, 0xa
jne 0x4c6e70
mov byte [esi + edi], 0xa
add esi, 1
mov byte [esi + edi], 0
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4c7020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x118
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
call fcn.004c6da0
add esp, 4
test eax, eax
jne 0x4c7070
pop edi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00511a80
add esp, 0x118
ret
push ebx
push ebp
push 0x7f02
push 0
call sym.convertifd.exe_JfLoadCursor
add esp, 8
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [esp + 0x10]
push ebx
push 1
push 0x14
push str.DOCVAR_IMPORT_FILE_n
call fcn.0051646d
mov ecx, dword [edi + 0xc]
push 0
push ecx
call sym.convertifd.exe_UtGtGetAddr
mov edx, dword [edi + 0x10]
mov esi, eax
push 0
push edx
mov dword [esp + 0x34], esi
call sym.convertifd.exe_UtGtGetAddr
add esp, 0x20
cmp dword [edi + 0x14], 0
mov ebp, eax
mov dword [esp + 0x10], 0
jle 0x4c71eb
mov edi, edi
mov edi, esi
call fcn.004c62f0
test eax, eax
jne 0x4c71d3
push ebx
push 1
push 9
push str.DOCNAME_n
call fcn.0051646d
mov eax, esi
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c70f6
push ebx
sub eax, edx
push 1
push eax
push esi
call fcn.0051646d
add esp, 0x10
cmp eax, 1
jne 0x4c722e
push ebx
push eax
push eax
push 0x581760
call fcn.0051646d
push ebx
push 1
push 0xa
push str.DOCVALUE_n
call fcn.0051646d
mov eax, ebp
add esp, 0x20
xor esi, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c7140
sub eax, edx
test eax, eax
jle 0x4c7187
nop
cmp byte [esi + ebp], 0xd
lea eax, [esi + ebp]
je 0x4c7170
push ebx
push 1
push 1
push eax
call fcn.0051646d
add esp, 0x10
cmp eax, 1
jne 0x4c722e
mov eax, ebp
add esi, 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c7178
sub eax, edx
cmp esi, eax
jl 0x4c7150
push ebx
push 1
push 1
push 0x581760
call fcn.0051646d
mov esi, dword [esp + 0x24]
mov eax, esi
add esp, 0x10
add dword [esp + 0x18], 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c71a7
sub eax, edx
lea eax, [esi + eax + 1]
mov dword [esp + 0x14], eax
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c71c0
mov esi, dword [esp + 0x14]
sub eax, edx
lea ebp, [eax + ebp + 1]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
add eax, 1
cmp eax, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
jl 0x4c70d0
push ebx
call fcn.005158c7
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push eax
sub eax, 1
neg eax
sbb eax, eax
add eax, 0xffffdc4f
push eax
call sym.convertifd.exe_IpICMessage
add esp, 0x10
mov eax, 1
mov ecx, dword [esp + 0x124]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x118
ret
push 0xfffffffffffffffa
call sym.convertifd.exe_IpMessage
push ebx
call fcn.005158c7
add esp, 8
xor eax, eax
jmp 0x4c7215
Function at 0x4ccb90
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push ebp
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push 0x14
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
push ecx
call sym.convertifd.exe_UtStripBlanks
lea eax, [esp + 0x14]
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4ccbe0
sub eax, edx
je 0x4ccc58
push 0x71
call sym.convertifd.exe_IpGMessage
push eax
lea edx, [esp + 0x18]
push edx
call fcn.0051e073
add esp, 0xc
test eax, eax
je 0x4ccc58
push esi
lea eax, [esp + 0x14]
push 0x5815f0
push eax
call fcn.00511af7
mov esi, dword [esi]
add esp, 0xc
cmp esi, 1
jl 0x4ccc25
cmp esi, 0x3c
jle 0x4ccc58
mov ecx, dword [esp + 0x30]
push ecx
call sym.convertifd.exe_IpMessage
push 0xffffffffffffffff
push 0
push ebp
push edi
call sym.convertifd.exe_IpSetSel
add esp, 0x14
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00511a80
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00511a80
add esp, 0x1c
ret
Function at 0x4d6c60
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
test edi, edi
jne 0x4d6c7e
mov edi, dword [esp + 0x18]
mov ebx, ecx
mov edx, ebp
call fcn.004d59a0
pop edi
pop ebp
pop ebx
ret
xor ebx, ebx
cmp dword [esp + 0x18], ebx
jle 0x4d6d03
mov eax, dword [0x607fb0]
jmp 0x4d6c90
cmp eax, dword [0x607fb8]
jge 0x4d6ca3
mov cl, byte [eax + esi]
mov byte [ebx + ebp], cl
add eax, 1
jmp 0x4d6cd8
push edi
push 0x200
push 1
push esi
call fcn.00515cb6
add esp, 0x10
test eax, eax
mov dword [0x607fb8], eax
jle 0x4d6cf8
mov edx, dword [esp + 0x10]
push eax
push esi
push esi
push edx
push edi
call sym.convertifd.exe_Utdcrypt
mov al, byte [esi]
mov byte [ebx + ebp], al
add esp, 0x14
mov eax, 1
mov cl, byte [ebx + ebp]
cmp cl, 0xa
mov dword [0x607fb0], eax
je 0x4d6cfb
cmp cl, 0xd
jne 0x4d6ced
sub ebx, 1
add ebx, 1
cmp ebx, dword [esp + 0x18]
jl 0x4d6c90
jmp 0x4d6cfb
sub ebx, 1
cmp ebx, 0xff
jge 0x4d6d06
add ebx, 1
pop edi
mov byte [ebx + ebp], 0
xor eax, eax
test ebx, ebx
pop ebp
setg al
pop ebx
ret
Function at 0x4dd160
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
test byte [0x607ffc], 2
je 0x4dd2c3
cmp dword [0x5ad1f0], 0
jle 0x4dd2c3
mov eax, dword [0x607ff8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0x188b
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [0x607ff8]
push 0
push 0x23e4
push ecx
call esi
push eax
call edi
cmp dword [0x5ad1f0], 2
jl 0x4dd1cd
mov edx, dword [0x607ff8]
push 0
push 0x2681
push edx
call esi
push eax
call edi
cmp dword [0x5ad1f0], 3
jl 0x4dd1e8
mov eax, dword [0x607ff8]
push 0
push 0x23e2
push eax
call esi
push eax
call edi
mov ecx, dword [0x607ff8]
push 0x23e3
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x14]
mov ebx, eax
push edx
push ebx
call edi
mov ecx, dword [0x607ff8]
lea eax, [esp + 0x24]
push eax
push 0x2681
push ecx
call esi
push eax
call edi
mov edx, dword [esp + 0x2c]
mov eax, dword [0x5ad1f0]
add edx, 2
cmp eax, 2
mov dword [esp + 0x14], edx
jl 0x4dd239
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
cmp eax, 3
jl 0x4dd278
mov eax, dword [0x607ff8]
lea edx, [esp + 0x24]
push edx
push 0x23e2
push eax
call esi
push eax
call edi
mov ecx, dword [0x5ad1f0]
cmp ecx, 4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
jl 0x4dd278
mov edx, eax
sub edx, dword [esp + 0x24]
add ecx, 0xfffffffd
imul edx, ecx
add edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [0x607ff8]
push edx
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 4
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4e3a20
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov esi, dword [esp + 0xac]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
mov dword [0x6080b8], 1
jne 0x4e3a71
cmp dword [esp + 8], 5
jb 0x4e3a71
mov dword [0x6080b8], 0
call fcn.004e2400
call fcn.004e2350
test eax, eax
jne 0x4e3a95
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00511a80
add esp, 0xa4
ret
mov ecx, dword [0x6080c4]
push edi
push ecx
call sym.convertifd.exe_SubformListGetSize
add esp, 4
neg eax
sbb eax, eax
neg eax
sub eax, 1
mov dword [sym.convertifd.exe_iSampleDataFieldNames], eax
cmp byte [esi], 0
jne 0x4e3b11
push 0x104
push sym.convertifd.exe_i_ifd
push esi
call fcn.00513780
add esp, 0xc
cmp byte [esi], 0
je 0x4e3b11
push esi
call sym.convertifd.exe_UtStripPath
push esi
call sym.convertifd.exe_UtStripExt
mov edi, esi
add esp, 8
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4e3ae4
mov dx, word [0x581818]
mov word [edi], dx
mov edi, esi
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4e3b00
mov eax, dword [0x584d20]
mov dword [edi], eax
mov ecx, dword [0x6a1278]
mov edx, dword [0x6a13cc]
mov eax, dword [0x6a124c]
push esi
push esi
push ecx
mov ecx, dword [0x5ad210]
push edx
push eax
push ecx
push sym.convertifd.exe_SaveAsDlg
push str.SampleDataFileSave
push 0xfffff276
push 0xfffff29e
call sym.convertifd.exe_JfSaveAs
add esp, 0x28
test eax, eax
jne 0x4e3b6c
call fcn.004e2400
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00511a80
add esp, 0xa4
ret
lea edx, [esp + 0x9c]
push edx
push esi
call sym.convertifd.exe_UtGetExt
movsx eax, byte [esp + 0xa4]
push eax
call fcn.00511e5d
xor ecx, ecx
add esp, 0xc
cmp eax, 0x58
sete cl
mov edi, esi
mov dword [0x6080c0], ecx
call fcn.004e3870
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0xa4
ret
Function at 0x4f0980
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [sym.convertifd.exe_i_window]
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [sym.convertifd.exe_i_window]
push 1
push ecx
mov byte [0x608209], al
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call sym.convertifd.exe_ModelessEnable
push 0
call sym.convertifd.exe_BiEnable
mov edx, dword [sym.convertifd.exe_i_window]
push edx
call sym.convertifd.exe_IpGetMenu
mov edi, eax
push edi
call sym.convertifd.exe_IpGetMenuItemCount
mov esi, eax
add esp, 0x10
sub esi, 2
js 0x4f09e4
mov edi, edi
push 0x401
push esi
push edi
call sym.convertifd.exe_IpEnableMenuItem
add esp, 0xc
sub esi, 1
jns 0x4f09d0
mov eax, dword [sym.convertifd.exe_i_window]
push eax
call sym.convertifd.exe_IpDrawMenuBar
mov eax, dword [0x6a26e4]
mov ecx, dword [0x6a26e0]
mov edx, dword [0x6a26e8]
push 0
mov dword [0x60820c], eax
mov eax, dword [0x6a26ec]
push 0
push 0x6a2d18
mov dword [0x608210], ecx
mov dword [0x60821c], edx
mov dword [0x608218], eax
mov dword [0x6a26e4], eax
mov dword [0x6a26e8], eax
mov dword [0x6a26e0], eax
call sym.convertifd.exe_HideAllGroupedEntities
push 1
push 0x6a2d18
call sym.convertifd.exe_HideAllTableSubGroups
mov esi, dword [esp + 0x24]
push esi
call sym.convertifd.exe_LowerRightDialog
add esp, 0x1c
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret
Function at 0x4fbae0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x12c
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x128], eax
mov edx, dword [esp + 0x130]
push esi
call fcn.004fb9c0
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
jl 0x4fbc95
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 1
push edi
mov dword [esp + 0x14], ebx
cmp ebx, 1
jne 0x4fbb33
mov edi, dword [0x6a1454]
mov eax, dword [str.ToolBar]
jmp 0x4fbb3e
mov edi, dword [0x6a1458]
mov eax, dword [str.ToolBox]
test edi, edi
je 0x4fbc82
push 2
lea ecx, [esp + 0x14]
push ecx
push 0x580cbb
push 0x581c58
push eax
call sym.convertifd.exe_GetJetFormIniStr
movsx edx, byte [esp + 0x10]
push edx
call fcn.00511e5d
add esp, 4
cmp eax, 0x59
jne 0x4fbc82
push 0x104
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00511e90
mov eax, dword [esp + 0x150]
lea edx, [esp + 0x40]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4fbb95
lea ecx, [esp + 0x34]
push ecx
push 0
push 0x41c
push edi
call ebp
lea esi, [esi + esi*2]
movsx edx, word [esi + esi + 0x5ad360]
add esi, esi
add edx, edx
add edx, edx
cmp ebx, 1
mov dword [esp + 0x1c], eax
mov ecx, 0x611dd0
je 0x4fbbd4
mov ecx, 0x611de8
sub ecx, edx
mov edx, dword [esp + 0x140]
push 0
push edx
push 0x419
push edi
mov dword [ecx], eax
call ebp
mov ebx, eax
test ebx, ebx
jl 0x4fbc7a
push 0
push ebx
push 0x416
push edi
call ebp
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
movzx eax, word [esi + 0x5ad362]
test ax, ax
jge 0x4fbc2f
movsx eax, ax
or ecx, 0xffffffff
sub ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x4fbc39
movsx edx, ax
add edx, 0xf
mov dword [esp + 0x20], edx
mov cl, byte [esi + 0x5ad364]
mov eax, dword [esp + 0x140]
mov dl, byte [esi + 0x5ad365]
mov byte [esp + 0x28], cl
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
push 0x415
push edi
mov byte [esp + 0x39], dl
mov dword [esp + 0x40], eax
call ebp
push 0
push 0
push 0x421
push edi
call ebp
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
add ebx, 1
cmp ebx, 2
mov dword [esp + 0x14], ebx
jle 0x4fbb21
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x12c
ret

Function at 0x4fbcb0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [0x6a1454]
test eax, eax
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4fbcdc
push 0
push esi
push 0x419
push eax
call edi
test eax, eax
jl 0x4fbcdc
pop edi
mov eax, 1
pop esi
ret
mov eax, dword [0x6a1458]
test eax, eax
je 0x4fbcf4
push 0
push esi
push 0x419
push eax
call edi
test eax, eax
jge 0x4fbcd4
pop edi
xor eax, eax
pop esi
ret
Function at 0x4fcb80
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 2
lea eax, [esp + 4]
push eax
mov eax, dword [str.ToolBar]
push 0x580cbb
push eax
push eax
call sym.convertifd.exe_GetJetFormIniStr
movsx ecx, byte [esp]
push ecx
call fcn.00511e5d
add esp, 4
cmp eax, 0x59
je 0x4fcbaf
xor eax, eax
pop ecx
ret
mov edx, dword [sym.convertifd.exe_i_window]
push esi
push 0x50000121
mov ecx, 0x3e8
call fcn.004fc0d0
mov edx, dword [str.ToolBar]
mov esi, eax
push 1
push edx
mov ecx, esi
call fcn.004fc500
add esp, 0xc
push 0
push 0
push 0x421
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push sym.convertifd.exe_ToolbarSubclassProc
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x60894c], eax
mov eax, esi
pop esi
pop ecx
ret

Function at 0x4fcc10
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 2
lea eax, [esp + 4]
push eax
mov eax, dword [str.ToolBox]
push 0x580cbb
push eax
push eax
call sym.convertifd.exe_GetJetFormIniStr
movsx ecx, byte [esp]
push ecx
call fcn.00511e5d
add esp, 4
cmp eax, 0x59
je 0x4fcc3f
xor eax, eax
pop ecx
ret
mov ecx, dword [0x6a13e0]
push esi
push edi
push 0x3e9
push 0x56000321
call fcn.004fc200
mov edx, dword [str.ToolBox]
mov esi, eax
push 0
push edx
mov ecx, esi
call fcn.004fc500
mov edi, dword [sym.imp.USER32.dll_GetParent]
add esp, 0x10
push 6
push 1
push 1
push 0
push 0
push 0
push esi
mov dword [0x6a1458], esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 5
push esi
call edi
mov eax, dword [0x6a1458]
push sym.convertifd.exe_ToolbarSubclassProc
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x608934], eax
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x500450
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
xor esi, esi
call fcn.00500280
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
push eax
push ecx
lea edx, [esp + 0xc]
push str.Translate__d_to__d
push edx
call fcn.005135ca
mov eax, dword [0x60a288]
add esp, 0x10
push eax
push 0x80
lea ecx, [esp + 0x8c]
push ecx
push 0x580cbb
push esi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x84], 0
lea eax, [esi + 1]
jne 0x5004c1
mov eax, esi
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x104
ret

Function at 0x5004e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
xor esi, esi
call fcn.00500280
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
push eax
push ecx
lea edx, [esp + 0x8c]
push str.Translate__d_to__d
push edx
call fcn.005135ca
mov eax, dword [0x60a288]
add esp, 0x10
push eax
push 0x80
lea ecx, [esp + 0xc]
push ecx
push 0x580cbb
push str.Tablefile
lea edx, [esp + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 4], 0
je 0x500573
lea eax, [esp + 4]
push eax
call fcn.0052ab0e
add esp, 4
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00511a80
add esp, 0x104
ret
mov ecx, dword [esp + 0x104]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x104
ret

Function at 0x500590
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, 0x20
call fcn.00500280
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
push eax
push ecx
lea edx, [esp + 0x8c]
push str.Translate__d_to__d
push edx
call fcn.005135ca
mov eax, dword [0x60a288]
add esp, 0x10
push eax
push 0x80
lea ecx, [esp + 0xc]
push ecx
push 0x580cbb
push str.DefaultChar
lea edx, [esp + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 4], 0
je 0x500625
lea eax, [esp + 4]
call fcn.004ff6e0
movzx eax, ax
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00511a80
add esp, 0x104
ret
mov ecx, dword [esp + 0x104]
mov ax, si
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x104
ret