Overview tab
The initial tab shows all of the functions containing strings or functions that are named. You can view a function by clicking within it and pressing Enter, or right-click on it and select "Show in disassembler". You can name a function by clicking within it and pressing F2, or by selecting the option from the context menu. The function name is displayed anywhere that function address is referenced.
Disassembly tab
The disassembly tab shows a disassembly of the selected function. Possible branches are hyper-linked and indicated with arrows. Strings are marked in red. If you click on a link, the current location will be bookmarked, and the jump target will be displayed. To go back, you can press ESCAPE or BACKSPACE. If you click on a function call, that function will be loaded and displayed. You may press F2 to rename the current function. If you right-click on a branch destination, you will get a list of the addresses that jump to that location, with the option of going to any of those addresses.
String references tab
This tab shows the strings that are referenced in this function. This is the same list that is displayed on the Overview tab. This is useful because you will be jumping around into different functions, and you don't want to search for the current function in the Overview tab. To see where a string is referenced, right-click on the string and select "Show reference to ...". A bookmark will be saved before switching to the disassembly tab. Press ESCAPE or BACKSPACE to come back here.
Caller list tab
This tab shows all of the functions that call this function. Only the first 30 functions on the list are hyper-linked, but any function can be selected and shown via the context menu (by right-clicking on the function). This was done to speed up processing.
Call tree tab
This tab displays a call tree for the current function. From the context menu, you can select the depth of the tree to be generated as well as whether to display system calls. You can also show where in the disassembly that function is called. System calls are hidden by default. In order to hide system calls, you must have file.proc in the same directory as the input file.
Miscellaneous
Each time you click on a link or select a line/function to display, the current location is pushed onto a bookmark stack. You can always come back to the previous location by pressing ESCAPE or BACKSPACE. The most recent 50 bookmarks are saved.
Home/End - The first time you press Home or End, it will scroll to the beginning/end of the line. If you then press it again, it will scroll to the top or bottom of the window.
You create a permanent bookmark by clicking on a line and pressing Ctrl-#, where # is a number (0-9). To return to the bookmark, simply press the number of the bookmark. Bookmarks are saved to file.bookmarks. Press Ctrl-B to display a list of the bookmarks you've set.
Function names are saved to file.names. You can also force names to be saved at any time by pressing Ctrl-S. This could be useful in case you have renamed many functions, so that your changes will be saved in case of a crash...
If the text formatting ever becomes wacky, you can refresh the screen by pressing F5.
Press Ctrl-G to go to a specific address. A dialog box will prompt you for the hex address.