joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432900
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2b0
lea eax, [esp]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x5b9260
push str.AddText
push eax
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.004ca5f0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x18
push 0x5b9260
push 0
push str.SemiTranspText
push str.AddText
call esi
push 0x5b9260
push 0
push str.Orientation
push str.AddText
mov edi, eax
call esi
push 0x5b9260
push 0
push str.Canvas
push str.AddText
mov ebx, eax
call esi
mov edx, dword [esp + 0x2c8]
lea ecx, [esp + 0x78]
push 0xc
push ecx
push edx
mov esi, eax
xor ebp, ebp
call fcn.004c93e0
mov eax, dword [esp + 0x2e0]
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x1c]
push esi
push ebp
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ebx
push edi
push ecx
push 0x64
sub esp, 0x10
xor eax, eax
mov edx, esp
mov ecx, dword [esp + 0x2fc]
mov dword [edx], ebp
mov dword [edx + 4], eax
mov eax, dword [esp + 0x304]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x308]
mov dword [edx + 0xc], eax
lea eax, [esp + 0xb0]
push eax
push ecx
call fcn.00418430
add esp, 0x40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b0
ret
Function at 0x432ee0
Capabilities:
Read .ini file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x5b5510]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
je 0x433182
mov edi, dword [esp + 0x44]
cmp dword [edi], ebx
je 0x433182
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x30]
push edx
push ecx
lea edx, [esp + 0x24]
lea ecx, [esp + 0x28]
push edx
push ecx
push eax
call fcn.004328b0
lea edx, [esp + 0x48]
lea eax, [esp + 0x4c]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [edi]
lea eax, [esp + 0x34]
push edx
push eax
push ecx
call fcn.004328b0
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x8c]
add esp, 0x30
cmp esi, 2
je 0x432f6a
cmp esi, 4
jne 0x43300b
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
je 0x43300b
test eax, eax
je 0x43300b
fild dword [esp + 0x14]
mov ebx, edx
fstp dword [esp + 0x34]
fild dword [esp + 0x10]
mov dword [esp + 0x10], ebx
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x20]
fild dword [esp + 0x1c]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fmul dword [esp + 0x20]
call fcn.004d6118
push 0x5b9260
push 1
mov esi, eax
push str.UseResample
push str.Resize
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x433004
mov eax, dword [0x5b5604]
mov ecx, dword [0x59f74c]
mov edx, dword [0x59f748]
push 1
push 0
push eax
mov eax, dword [edi]
push ecx
push edx
push esi
push ebx
push eax
call fcn.00421dd0
add esp, 0x20
jmp 0x4330b5
push esi
push ebx
jmp 0x4330aa
cmp esi, 1
je 0x433019
cmp esi, 3
jne 0x4330e5
cmp ebp, dword [esp + 0x14]
je 0x4330e5
test eax, eax
je 0x4330e5
fild dword [esp + 0x14]
mov dword [esp + 0x14], ebp
fstp dword [esp + 0x34]
fild dword [esp + 0x10]
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x20]
fild dword [esp + 0x18]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fdiv dword [esp + 0x20]
call fcn.004d6118
push 0x5b9260
push 1
mov esi, eax
push str.UseResample
push str.Resize
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4330a8
mov eax, dword [0x5b5604]
mov ecx, dword [0x59f74c]
mov edx, dword [0x59f748]
push 1
push 0
push eax
mov eax, dword [edi]
push ecx
push edx
push ebp
push esi
push eax
call fcn.00421dd0
add esp, 0x20
jmp 0x4330b5
push ebp
push esi
mov ecx, dword [edi]
push ecx
call fcn.00422de0
add esp, 0xc
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x20], ebx
je 0x433182
mov eax, dword [edi]
test eax, eax
je 0x4330df
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [edi], 0
mov esi, dword [esp + 0x48]
mov dword [edi], ebx
lea eax, [esp + 0x30]
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x2c]
and al, 0x2c
Function at 0x434240
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x434288
mov eax, dword [0x5b5528]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7b
push 0x4ae
push 0x111
push eax
call esi
mov ecx, dword [0x5b5528]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
jne 0x434288
mov edx, dword [0x5b5528]
push eax
push 0x4a9
push 0x111
push edx
call esi
mov eax, dword [0x5b5570]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
pop esi
je 0x4342a8
mov ecx, dword [0x5b5570]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
Function at 0x435330
Capabilities:
Get common file path

Disassembly:
sub esp, 0x6c0
mov ecx, 5
lea eax, [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, str.DICOM.DLL
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x6dc]
lea ecx, [esp + 0x2c0]
xor ebp, ebp
push eax
push ecx
mov word [edi], bp
call fcn.004904e0
add esp, 8
lea edx, [esp + 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x43539b
push eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004905d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c0
ret
push str.ReadDicom_W
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x4353d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
lea ecx, [esp + 0x28]
push edi
push ecx
call fcn.004905d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c0
ret
lea edx, [esp + 0x38]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x38]
push eax
call fcn.004d6713
add esp, 4
cmp word [esp + eax*2 + 0x36], 0x5c
je 0x435407
lea ecx, [esp + 0x38]
push 0x598458
push ecx
call fcn.004d62f1
add esp, 8
lea edx, [esp + 0x38]
push str.IrfanView.tmp
push edx
call fcn.004d62f1
add esp, 8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1e]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x250]
push str.._2d_2d_2d_3d
push edx
call fcn.004d5ee1
lea eax, [esp + 0x258]
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.004d62f1
mov eax, dword [esp + 0x6f8]
mov ecx, dword [esp + 0x6f4]
lea edx, [esp + 0x58]
push edi
push edx
push 0x6958
push eax
push ecx
call ebx
add esp, 0x34
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x4354e5
lea edx, [esp + 0x2c0]
lea eax, [esp + 0x4c8]
push edx
push eax
lea ecx, [esp + 0x40]
push 0
push ecx
call fcn.004042e0
lea edx, [esp + 0x48]
mov ebp, eax
push edx
call fcn.004d7368
push 0x59933c
push edi
call fcn.004d6acd
add esp, 0x1c
test eax, eax
je 0x4354e5
push 0
push ebp
call fcn.0041e470
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x6c0
ret
Function at 0x4381f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x480
mov ecx, 7
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push ebp
push esi
push edi
mov esi, str.IV_PLAYER.EXE
lea edi, [esp + 0x20]
push str.IrfanView_Multimedia_Player
rep movsd dword es:[edi], dword [esi]
push 0
call ebx
test eax, eax
je 0x43825b
mov ecx, dword [esp + 0x4a4]
mov edx, dword [esp + 0x4a0]
push ecx
mov ecx, dword [esp + 0x4a0]
push edx
mov edx, dword [esp + 0x4a0]
push ecx
mov ecx, dword [esp + 0x4a0]
push edx
push ecx
push eax
call fcn.00438080
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x480
ret
lea edx, [esp + 0x20]
lea eax, [esp + 0x80]
push edx
push eax
call fcn.004904e0
lea ecx, [esp + 0x88]
push ecx
call fcn.004381b0
add esp, 0xc
test eax, eax
jne 0x4382a5
lea edx, [esp + 0x80]
push 1
lea eax, [esp + 0x24]
push edx
push eax
call fcn.004905d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x480
ret
mov esi, dword [esp + 0x494]
mov ebp, dword [esp + 0x4a4]
test esi, esi
je 0x438308
lea ecx, [esp + 0x80]
push 0x59991c
push ecx
call fcn.004d62f1
lea edx, [esp + 0x88]
push esi
push edx
call fcn.004d62f1
add esp, 0x10
test ebp, ebp
je 0x4382f3
lea eax, [esp + 0x80]
push 0x59990c
push eax
call fcn.004d62f1
add esp, 8
lea ecx, [esp + 0x80]
push 0x599908
push ecx
call fcn.004d62f1
add esp, 8
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x38], edx
push edx
lea edx, [esp + 0xa0]
push edx
push 0
mov dword [esp + 0x64], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4383b0
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.IrfanView_Multimedia_Player
push 0
call ebx
test eax, eax
je 0x4383a3
mov edx, dword [esp + 0x4a0]
mov ecx, dword [esp + 0x49c]
push ebp
push edx
mov edx, dword [esp + 0x4a0]
push ecx
push edx
push 0
push eax
call fcn.00438080
add esp, 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x480
ret
mov eax, dword [esp + 0x4a8]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.004905d0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x480
ret
Function at 0x438410
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x98
push esi
mov esi, dword [esp + 0xa4]
push edi
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call fcn.004d6713
add esp, 4
cmp word [esi + eax*2 - 2], 0x5c
je 0x43844a
push 0x598458
push esi
call fcn.004d62f1
add esp, 8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.IrfanViewTemp
push esi
call fcn.004d62f1
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x20]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x38]
push str._2d_2d_2d_3d.tmp
push edx
call fcn.004d5ee1
lea eax, [esp + 0x40]
push eax
push esi
call fcn.004d62f1
mov edi, dword [esp + 0xcc]
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
push 0
push 0
push edi
call fcn.004c5070
add esp, 0x40
push edi
call fcn.004c9910
mov ecx, dword [esp + 0xc]
add esp, 4
cmp ecx, 1
push 0x5b9260
push 1
jne 0x4384e2
push str.ComprBW
jmp 0x4384f3
cmp eax, 1
jne 0x4384ee
push str.ComprGray
jmp 0x4384f3
push str.ComprColor
push 0x598da0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4385a4
cmp eax, 1
je 0x4385a4
cmp dword [esp + 8], 1
jne 0x438541
cmp eax, 2
jne 0x438541
mov edx, dword [esp + 0xac]
push 0x5aae60
push edx
push 1
push 0x4b
push 4
push edi
push esi
call fcn.00415a10
add esp, 0x1c
pop edi
pop esi
add esp, 0x98
ret
sub eax, 2
push 0
je 0x43858f
sub eax, 2
je 0x43857a
dec eax
je 0x438565
push 0x50
push edi
push esi
call fcn.0040b110
add esp, 0x10
pop edi
pop esi
add esp, 0x98
ret
push 0x28
push edi
push esi
call fcn.0040b110
add esp, 0x10
pop edi
pop esi
add esp, 0x98
ret
push 0x41
push edi
push esi
call fcn.0040b110
add esp, 0x10
pop edi
pop esi
add esp, 0x98
ret
push 0x5f
push edi
push esi
call fcn.0040b110
add esp, 0x10
pop edi
pop esi
add esp, 0x98
ret
neg eax
push 0
push 0xffffffffffffffff
sbb eax, eax
push 0xffffffffffffffff
and eax, 6
push 0xffffffffffffffff
push eax
push edi
push esi
call fcn.0040d7c0
add esp, 0x1c
pop edi
pop esi
add esp, 0x98
ret
Function at 0x439b40
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
push 0x5b9260
push str.ContactSheet
push 0
lea eax, [esi + 0x34]
push 0
lea ecx, [esi + 0x654]
push eax
push ecx
call fcn.004ca5f0
add esp, 0x18
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push 0x5b9260
push 0x104
push edx
push str.16777215
push str.BackColor
push str.ContactSheet
call ebx
lea eax, [esp + 0x10]
push eax
call fcn.004d6be0
push 0x5b9260
push str.1024
push 0x599dc4
push str.ContactSheet
mov dword [esi + 0x30], eax
call fcn.004c8880
fstp dword [esi]
push 0x5b9260
add byte [eax - 0x44], ch
popfd
pop ecx
add byte [eax - 0x54], ch
popfd
pop ecx
add byte [eax - 0x10], ch
popfd
pop ecx
add al, ch
cmpsd dword [esi], dword es:[edi]
in al, dx
or byte [eax], al
Function at 0x43aec0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xaa8
mov ecx, 0x208
xor eax, eax
push edi
lea edi, [esp + 0x28c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xab0]
lea eax, [esp + 4]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 4], 0
pop edi
jne 0x43aeff
or eax, 0xffffffff
add esp, 0xaa8
ret
push esi
push 1
lea edx, [esp + 0x88]
push 0x5985ac
push edx
call fcn.004d5ee1
lea eax, [esp + 0x90]
lea ecx, [esp + 0x298]
push eax
push ecx
call fcn.004d62f1
lea edx, [esp + 0x2a0]
push 0x599e98
push edx
call fcn.004d62f1
mov esi, dword [esp + 0xad4]
lea ecx, [esp + 0x2a8]
lea eax, [esi + 0x3c]
push eax
push ecx
call fcn.004d62f1
lea edx, [esp + 0x2b0]
push 0x599e98
push edx
call fcn.004d62f1
lea eax, [esi + 0x244]
lea ecx, [esp + 0x2b8]
push eax
push ecx
call fcn.004d62f1
lea edx, [esp + 0x2c0]
push 0x599e98
push edx
call fcn.004d62f1
lea eax, [esi + 0x44c]
lea ecx, [esp + 0x2c8]
push eax
push ecx
call fcn.004d62f1
add esp, 0x44
lea edx, [esp + 0x28c]
push 0x599e98
push edx
call fcn.004d62f1
lea eax, [esi + 0x654]
lea ecx, [esp + 0x8c]
push eax
push ecx
call fcn.004ca770
lea edx, [esp + 0x94]
lea eax, [esp + 0x29c]
push edx
push eax
call fcn.004d62f1
lea ecx, [esp + 0x2a4]
push 0x599e98
push ecx
call fcn.004d62f1
lea edx, [esi + 0x670]
lea eax, [esp + 0x2ac]
push edx
push eax
call fcn.004d62f1
lea ecx, [esp + 0x2b4]
push 0x599e98
push ecx
call fcn.004d62f1
fld dword [esi]
add esp, 0x28
lea edx, [esp + 0x8c]
fstp qword [esp]
push str._.2f
push edx
call fcn.004d5ee1
lea eax, [esp + 0x94]
lea ecx, [esp + 0x29c]
push eax
push ecx
call fcn.004d62f1
push 0x599e98
lea edx, [esp + 0x2a8]
push edx
call fcn.004d62f1
fld dword [esi + 4]
add esp, 0x18
lea eax, [esp + 0x8c]
fstp qword [esp]
push str._.2f
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x94]
lea edx, [esp + 0x29c]
push ecx
push edx
call fcn.004d62f1
lea eax, [esp + 0x2a4]
push 0x599e98
push eax
call fcn.004d62f1
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi + 0x28]
push eax
mov eax, dword [esi + 0x24]
push ecx
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x1c]
push eax
mov eax, dword [esi + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0xd8]
push str._d_d_d_d_d_d_d_d_d_d_d_d_d
push edx
call fcn.004d5ee1
add esp, 0x5c
lea eax, [esp + 0x84]
lea ecx, [esp + 0x28c]
push eax
push ecx
call fcn.004d62f1
lea edx, [esp + 0x294]
push 0x599e98
push edx
call fcn.004d62f1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x94]
push eax
push str.Profile__s
push ecx
call fcn.004d5ee1
mov esi, dword [esp + 0xad0]
add esp, 0x1c
lea edx, [esp + 0x28c]
lea eax, [esp + 0x84]
push 0x5b9260
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 4]
push ecx
push esi
call fcn.004c9c80
add esp, 8
xor eax, eax
pop esi
add esp, 0xaa8
ret
Function at 0x43b160
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc28
push esi
mov esi, dword [esp + 0xc30]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push esi
mov word [esp + 0x220], 0
call edi
cmp eax, 0xffffffff
je 0x43b3e2
lea eax, [esp + 0x210]
push eax
push 0
push 0
push 0x147
push esi
call edi
push eax
push 0x148
push esi
call edi
cmp word [esp + 0x210], 0
je 0x43b3e2
lea ecx, [esp + 0x210]
lea edx, [esp + 8]
push ecx
push str.Profile__s
push edx
call fcn.004d5ee1
mov edx, dword [esp + 0xc44]
add esp, 0xc
lea eax, [esp + 0x410]
lea ecx, [esp + 8]
push 0x5b9260
push 0x400
push eax
push 0x5aae60
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x410]
push 0x3b
push eax
call fcn.004c9a70
add esp, 8
cmp eax, 9
jne 0x43b3e2
push ebx
push 0x104
lea ecx, [esp + 0x10]
push 0x3b
push ecx
lea edx, [esp + 0x420]
push 0
push edx
call fcn.004c9ab0
mov esi, dword [esp + 0xc54]
push 0x104
push 0x3b
lea ecx, [esp + 0x430]
lea eax, [esi + 0x3c]
push eax
push 1
push ecx
call fcn.004c9ab0
push 0x104
lea edx, [esi + 0x244]
push 0x3b
push edx
lea eax, [esp + 0x448]
push 2
push eax
call fcn.004c9ab0
push 0x104
lea ecx, [esi + 0x44c]
push 0x3b
push ecx
lea edx, [esp + 0x45c]
push 3
push edx
call fcn.004c9ab0
add esp, 0x50
lea eax, [esp + 0xc]
lea ecx, [esp + 0x414]
push 0x104
push 0x3b
push eax
push 4
push ecx
call fcn.004c9ab0
lea edx, [esi + 0x654]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004ca720
push 0x104
lea ecx, [esp + 0x2c]
push 0x3b
push ecx
lea edx, [esp + 0x43c]
push 5
push edx
call fcn.004c9ab0
lea ebx, [esi + 0x670]
mov ecx, 0x10
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
push eax
call fcn.004d6713
add esp, 0x34
cmp eax, 0x1f
jae 0x43b312
lea ecx, [esp + 0xc]
push ecx
call fcn.004d6713
add esp, 4
jmp 0x43b317
mov eax, 0x1f
lea edx, [esp + 0xc]
push eax
push edx
push ebx
call fcn.004d6c3f
push 0x104
lea eax, [esp + 0x1c]
push 0x3b
push eax
lea ecx, [esp + 0x42c]
push 6
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x2c]
push edx
call fcn.004c5910
fstp dword [esi]
push 0x104
lea eax, [esp + 0x34]
push 0x3b
push eax
lea ecx, [esp + 0x444]
push 7
push ecx
call fcn.004c9ab0
lea edx, [esp + 0x44]
push edx
call fcn.004c5910
fstp dword [esi + 4]
push 0x104
lea eax, [esp + 0x4c]
push 0x3b
push eax
lea ecx, [esp + 0x45c]
push 8
push ecx
call fcn.004c9ab0
add esp, 0x50
lea edx, [esi + 0x38]
lea eax, [esi + 0x34]
lea ecx, [esi + 0x30]
push edx
push eax
lea edx, [esi + 0x2c]
push ecx
lea eax, [esi + 0x28]
push edx
lea ecx, [esi + 0x24]
push eax
lea edx, [esi + 0x20]
push ecx
lea eax, [esi + 0x1c]
push edx
lea ecx, [esi + 0x18]
push eax
lea edx, [esi + 0x14]
push ecx
lea eax, [esi + 0x10]
push edx
lea ecx, [esi + 0xc]
push eax
add esi, 8
push ecx
push esi
lea edx, [esp + 0x40]
push str._d_d_d_d_d_d_d_d_d_d_d_d_d
push edx
call fcn.004d6c09
add esp, 0x3c
xor eax, eax
pop ebx
pop edi
pop esi
add esp, 0xc28
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc28
ret
Function at 0x43cc90
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
push 0x5b9260
push 0
push str.HTMLTextAlign
push 0x59a1bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, dword [esp + 0xc]
push str.center
push edi
mov esi, eax
call fcn.004d5ee1
add esp, 8
cmp esi, 1
jne 0x43ccd3
push str.left
push edi
call fcn.004d5ee1
add esp, 8
pop edi
pop esi
ret
cmp esi, 2
jne 0x43cce6
push str.right
push edi
call fcn.004d5ee1
add esp, 8
pop edi
pop esi
ret
Function at 0x4412a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xaa8
push ebx
mov ebx, dword [esp + 0xab0]
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
push 0x18b
push ebx
call edi
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x10], ebp
jle 0x4413c7
mov eax, dword [0x5b54fc]
mov dword [0x5b5628], 1
push eax
mov dword [0x5b5648], esi
call fcn.00475a60
mov eax, dword [0x5b5500]
add esp, 4
cmp eax, esi
je 0x441305
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov dword [0x5b5500], esi
test ebp, ebp
jle 0x44139a
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov eax, dword [esp + 0xacc]
test eax, eax
je 0x44132d
push 0
push esi
push 0x187
push ebx
call edi
test eax, eax
je 0x44138d
lea ecx, [esp + 0x298]
push ecx
push esi
push 0x189
push ebx
call edi
lea edx, [esp + 0x48]
lea eax, [esp + 0x298]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x44138d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x6a8]
push 3
lea edx, [esp + 0x29c]
push ecx
push edx
call fcn.004c93e0
mov edx, dword [0x5b54fc]
lea eax, [esp + 0x6b4]
lea ecx, [esp + 0x54]
push eax
push ecx
push esi
push edx
call fcn.00475980
add esp, 0x1c
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x441313
mov ecx, dword [0x5b5528]
mov eax, dword [esp + 0xac4]
push 0
push ecx
mov dword [0x59f744], eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.0048cce0
add esp, 8
mov word [0x5b9040], 0
mov eax, dword [esp + 0xac0]
test eax, eax
je 0x441488
call fcn.004ba760
mov edx, dword [0x5b5528]
push 0
push 0x42b
push 0x111
push edx
call edi
push 1
push 0
call fcn.0047a580
mov eax, dword [0x5b554c]
add esp, 8
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5b554c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x5b554c]
push 0
push 0x48f
push 0x111
push edx
call edi
push 0
push 1
call fcn.004b80b0
mov esi, dword [esp + 0xad0]
push esi
call fcn.004d6713
add esp, 0xc
test eax, eax
jbe 0x441452
push esi
call fcn.004b8230
add esp, 4
mov eax, dword [0x5b5558]
push 0
push 0xffffffffffffffff
push 0x14e
push eax
call edi
mov edx, dword [0x5b54fc]
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push 0x102b
push edx
mov dword [esp + 0x34], 2
mov dword [esp + 0x30], 0xfffffffd
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xaa8
ret

Function at 0x4418b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
mov dword [esp], 0
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x441918
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44190d
mov dword [esp], 0
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0xc
ret