joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a640
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4b5320]
push esi
mov dword [esp + 0x210], eax
push 0
lea eax, [esp + 8]
push eax
push str.UIMediaDiscPlay
mov esi, ecx
mov dword [esp + 0x10], 0
call fcn.0043acd0
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x41a69e
mov ecx, dword [esp + 0x218]
mov dword [ecx], 2
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.0048c3c7
add esp, 0x210
ret 8
push 1
push 5
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41a6c2
lea eax, [esp + 8]
push eax
push 0
call fcn.00436b50
add esp, 8
push edi
lea ecx, [esp + 0xc]
push ecx
mov edx, ecx
push str._sPDVD_MediaDisc.PlayList
push edx
call dword [0x4b5554]
lea eax, [esp + 0x18]
push 0x49b30c
push eax
call fcn.004389f0
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x41a711
push eax
push eax
call fcn.00438e70
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.0048c3c7
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x220]
push ebx
push edi
push ecx
call fcn.0042f410
push edi
mov ebx, eax
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0xc
test ebx, ebx
pop ebx
jne 0x41a757
mov edx, dword [esp + 0x21c]
pop edi
mov dword [edx], 2
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.0048c3c7
add esp, 0x210
ret 8
mov ecx, dword [0x4b55bc]
lea eax, [esp + 0xc]
push eax
call fcn.00440600
push 2
call fcn.0042d4a0
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
add esp, 4
push 5
push eax
call dword [ecx + 0xa8]
mov edx, dword [0x4b55b8]
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x41a796
mov eax, dword [esi]
push 0
push 0x11
push esi
call dword [eax + 0x28]
mov ecx, esi
call fcn.00418f40
test eax, eax
jge 0x41a7ab
mov ecx, dword [esi]
push 0
push 0x11
push esi
call dword [ecx + 0x28]
push 0
call fcn.0042ed60
mov eax, dword [0x4b55bc]
mov ecx, dword [eax + 0x414]
add esp, 4
test ecx, ecx
jne 0x41a7c8
xor eax, eax
jmp 0x41a7d3
mov eax, dword [eax + 0x418]
sub eax, ecx
sar eax, 2
push eax
call fcn.0042df30
mov ecx, dword [0x4b55bc]
add esp, 4
call fcn.004166c0
push eax
call fcn.0042dfb0
mov edx, dword [esp + 0x220]
mov ecx, dword [esp + 0x218]
add esp, 4
pop edi
mov dword [edx], 0
mov eax, 1
pop esi
call fcn.0048c3c7
add esp, 0x210
ret 8
Function at 0x4221c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [0x4b5320]
push esi
push edi
mov dword [esp + 0x46c], eax
xor esi, esi
xor eax, eax
mov word [esp + 0x260], si
mov ecx, 0x81
lea edi, [esp + 0x262]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x5c]
push eax
push esi
call dword [0x4b5430]
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [ebp + 8], 1
mov edi, dword [sym.imp.MSVCR71.dll_wcscat]
jne 0x42222a
push str.OLRSubmissionOLRSubmission.exe
lea edx, [esp + 0x5c]
push edx
jmp 0x422234
push str.OLRSubmissionOLRStateCheck.exe
lea eax, [esp + 0x5c]
push eax
call edi
add esp, 8
push esi
lea ecx, [esp + 0x48]
push ecx
push str.UI_Multiple_Language
call fcn.0043acd0
lea edx, [esp + 0x54]
push 8
push edx
call fcn.00437030
lea eax, [esp + 0x274]
push str._LANG:
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x280]
push edx
call edi
add esp, 0x24
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4222ef
lea eax, [esp + 8]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x260]
push eax
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], 0x40
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str.Open
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x497f10
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call dword [0x4b5498]
mov ecx, dword [esp + 0x46c]
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428bd0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x49292b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x678
mov eax, dword [0x4b5320]
mov dword [esp + 0x674], eax
mov eax, dword [esp + 0x688]
test eax, eax
je 0x428c8e
mov ecx, dword [0x4b71c0]
push 0x104
lea eax, [esp + 0x470]
push eax
push ecx
call dword [0x4b5430]
push str._autostart
lea edx, [esp + 0x470]
push edx
lea eax, [esp + 0x26c]
push str.__s___s
push eax
call dword [0x4b5554]
add esp, 0x10
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
lea ecx, [esp + 0xc]
call fcn.0043b3f0
lea ecx, [esp + 0x264]
push ecx
push str.PowerDVD
lea ecx, [esp + 8]
mov dword [esp + 0x688], 0
call fcn.0043b690
lea ecx, [esp]
mov dword [esp + 0x680], 0xffffffff
call fcn.0043b4e0
jmp 0x428ca5
push str.PowerDVD
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.0043b7c0
add esp, 0xc
mov ecx, dword [esp + 0x678]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x674]
call fcn.0048c3c7
add esp, 0x684
ret

Function at 0x42a160
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
mov eax, dword [0x4b5320]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x16], ecx
xor eax, eax
mov dword [esp + 0x1a], ecx
mov dword [esp + 0x1e], ecx
mov dword [esp + 6], eax
push ecx
lea edx, [esp + 4]
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
push edx
push str.UI_Multiple_Language
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov word [esp + 0x1e], ax
mov word [esp + 0x20], ax
mov word [esp + 0x2e], cx
call fcn.0043acd0
add esp, 0xc
test eax, eax
je 0x42a242
mov eax, dword [esp]
test eax, eax
je 0x42a242
lea eax, [esp + 4]
push 8
push eax
call fcn.00434480
add esp, 8
test eax, eax
je 0x42a242
push 0x49d0c0
push 8
lea ecx, [esp + 0x1c]
push ecx
push str.UI_LanguageOld
call fcn.0043aeb0
add esp, 0x10
test eax, eax
je 0x42a242
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 8
test eax, eax
je 0x42a242
lea ecx, [esp + 4]
push ecx
push str.UI_LanguageOld
call fcn.0043afa0
push 0
push 0
push 0x429f90
call dword [sym.imp.MSVCR71.dll__beginthread]
add esp, 0x14
mov eax, 1
mov ecx, dword [esp + 0x24]
call fcn.0048c3c7
add esp, 0x28
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
call fcn.0048c3c7
add esp, 0x28
ret
Function at 0x42aca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x470
mov eax, dword [0x4b5320]
push esi
push edi
mov dword [esp + 0x474], eax
xor eax, eax
push 1
mov ecx, 0x82
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
push 5
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42acfa
lea ecx, [esp + 0x60]
push ecx
push eax
call fcn.00436b50
lea edx, [esp + 0x68]
push 0x49d21c
push edx
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 0x10
mov esi, dword [sym.imp.MSVCR71.dll_wcscpy]
lea eax, [esp + 0x268]
push 0x49d210
push eax
call esi
xor eax, eax
mov ecx, 0x16
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
add esp, 8
cmp ebx, 1
lea edx, [esp + 0x268]
lea eax, [esp + 0x60]
mov dword [esp + 8], 0x58
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0x49d210
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], 0x49d208
mov dword [esp + 0x3c], 0x8080e
jne 0x42ad89
lea ecx, [esp + 8]
push ecx
call dword [0x4b53c8]
test eax, eax
jne 0x42adb0
xor al, al
mov ecx, dword [esp + 0x474]
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x42adb0
lea edx, [esp + 8]
push edx
call dword [0x4b53cc]
test eax, eax
jne 0x42adb0
xor al, al
mov ecx, dword [esp + 0x474]
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call esi
mov ecx, dword [esp + 0x47c]
add esp, 8
mov al, 1
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42f5a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x428
mov eax, dword [0x4b5320]
push esi
mov esi, dword [esp + 0x430]
push edi
mov dword [esp + 0x42c], eax
lea eax, [esp + 8]
push esi
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 8
push str.Autorun.inf
lea ecx, [esp + 0xc]
push ecx
mov edx, ecx
push edx
call edi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42f65c
lea ecx, [esp + 8]
push ecx
push 0x10e
lea edx, [esp + 0x218]
push edx
push 0x497f10
push str.SHELLEXECUTE
push str.autorun
call dword [0x4b543c]
test eax, eax
jbe 0x42f65c
lea eax, [esp + 0x210]
push eax
push esi
mov ecx, eax
push ecx
call edi
push 1
push 0
push 0
lea edx, [esp + 0x21c]
push edx
push 0x499df8
push 0
call dword [0x4b549c]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x424]
call fcn.0048c3c7
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
pop edi
xor eax, eax
pop esi
call fcn.0048c3c7
add esp, 0x428
ret
Function at 0x430840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x492a3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x49c
mov eax, dword [0x4b5320]
push esi
push edi
push 1
push str.SoftwareCyberlinkPowerDVDPOUNewVersion
push SysReAllocString
lea ecx, [esp + 0x23c]
mov dword [esp + 0x4a8], eax
call fcn.0043b3f0
lea eax, [esp + 0xc]
push eax
push str.UI_NewVersion_Count
lea ecx, [esp + 0x238]
mov dword [esp + 0x4b4], 0
mov dword [esp + 0x14], 0
call fcn.0043b540
mov esi, dword [0x4b5554]
mov word [esp + 0x28], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push str.UI_NewVersion__d_Title
push edx
stosw word es:[edi], ax
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x238]
call fcn.0043b690
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x2c]
push str.UI_NewVersion__d_Date
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x23c]
call fcn.0043b740
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
push str.UI_NewVersion__d_Showed
push ecx
call esi
add esp, 0xc
push 0
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x238]
call fcn.0043b580
mov eax, dword [esp + 0xc]
inc eax
push eax
push str.UI_NewVersion_Count
lea ecx, [esp + 0x238]
call fcn.0043b580
mov esi, dword [esp + 0xc]
mov dword [esp + 0x4ac], 0xffffffff
lea ecx, [esp + 0x230]
call fcn.0043b4e0
mov ecx, dword [esp + 0x4a4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x49c]
mov eax, esi
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x828
mov eax, dword [0x4b5320]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x82c], eax
cmp dword [edi], 0
jne 0x4310c1
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [0x4b5430]
push 0
push 0
lea ecx, [esp + 0x630]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.MSVCR71.dll__wsplitpath]
mov esi, dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x63c]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x43c]
push 0x49cbbc
push eax
call esi
push 0x49da54
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x3c]
push 0x49cbbc
push edx
call esi
add esp, 0x34
lea eax, [esp + 0x10]
push eax
call dword [0x4b5458]
test eax, eax
mov dword [edi], eax
je 0x431074
push str.DKA_SetFCLPath
push eax
call dword [0x4b5440]
mov esi, eax
test esi, esi
je 0x431074
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
call fcn.00436e10
test eax, eax
je 0x43109f
mov word [esp + 0x218], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x218]
push ecx
push 0
push 0
push 0x8023
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x43108b
mov eax, 0x80004005
mov ecx, dword [esp + 0x82c]
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.CyberLinkPowerDVD001.FCL
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x18]
push eax
jmp 0x4310b1
push str.001.FCL
lea ecx, [esp + 0x424]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x10]
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x82c]
xor eax, eax
call fcn.0048c3c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4313b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x4b5320]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x497f10
push esi
mov dword [esp + 0x224], eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
push 1
push 0x23
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x431484
call fcn.00437780
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
push esi
call ebx
push esi
call fcn.00438950
add esp, 4
call fcn.00437750
push eax
push esi
call ebx
push esi
call fcn.00438950
add esp, 4
push str.Skins
push esi
call ebx
push esi
call fcn.00438950
xor eax, eax
mov word [esp + 0x14], 0
mov ecx, 0x81
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x18]
push eax
push str.Version
call fcn.0043b040
add esp, 0x10
test eax, eax
je 0x43146c
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
push esi
call fcn.00438950
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x21c]
call fcn.0048c3c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x21c]
xor eax, eax
call fcn.0048c3c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432110
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
lea ebx, [esi + 0x20]
push ebx
push edi
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], ebp
mov dword [ebx], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebp
mov dword [esi + 0x1c], eax
jne 0x43214a
push ebx
push edi
mov ecx, esi
call fcn.0042f690
mov dword [esi + 0x1c], eax
mov eax, dword [ebx]
mov edi, 1
cmp eax, edi
mov dword [esi + 0x14], edi
jle 0x432249
mov ebx, dword [sym.imp.MSVCR71.dll__wcsnicmp]
mov ebp, dword [sym.imp.MSVCR71.dll_wcslen]
jmp 0x432170
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + edi*4]
push str._autostart
push ecx
call dword [sym.imp.MSVCR71.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x432194
mov dword [esi], 1
jmp 0x432235
push str._Skin
call ebp
mov edx, dword [esi + 0x1c]
push eax
mov eax, dword [edx + edi*4]
push str._Skin
push eax
call ebx
add esp, 0x10
test eax, eax
je 0x432235
push str._FullScreen
call ebp
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx + edi*4]
push eax
push str._FullScreen
push edx
call ebx
add esp, 0x10
test eax, eax
jne 0x4321db
mov dword [esi + 4], 1
jmp 0x432235
push 0x49dbf0
call ebp
push eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + edi*4]
push 0x49dbf0
push ecx
call ebx
add esp, 0x10
test eax, eax
je 0x4322a1
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + edi*4]
push str._PDVDServAutostart
push eax
call dword [sym.imp.MSVCR71.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x43221e
mov dword [esi + 0x18], 1
jmp 0x432235
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx + edi*4]
push 1
push 0x49dbc0
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x43223b
lea eax, [edi + 1]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x20]
inc edi
cmp edi, eax
jl 0x432170
xor ebp, ebp
cmp dword [esi], ebp
jne 0x432263
cmp dword [esi + 0x1c], ebp
je 0x432263
mov ecx, dword [esi + 0x20]
sub ecx, dword [esi + 0x14]
test ecx, ecx
jle 0x432263
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebp
call fcn.00438030
test eax, eax
je 0x432298
call fcn.0042da70
cmp eax, 1
jne 0x432298
call fcn.00431ed0
cmp eax, 0xffffffff
je 0x432298
push eax
push str.UIFocusCDDrive
mov dword [esi + 0xc], 1
call fcn.0043ada0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
call fcn.00432020
pop edi
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x438950
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4b5320]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [0x4b5448]
cmp dword [ebp - 0x108], 2
jne 0x438990
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR71.dll__wmkdir]
jmp 0x4389cd
call dword [0x4b26bc]
mov edi, dword [ebp + 8]
test edi, edi
mov ebx, eax
jne 0x4389a3
xor eax, eax
jmp 0x4389c6
push edi
call dword [0x4b5480]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0048c3e0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.004010a0
push eax
call dword [sym.imp.MSVCR71.dll__mkdir]
add esp, 4
lea esp, [ebp - 0x124]
mov ecx, dword [ebp - 4]
call fcn.0048c3c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438dc0
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push str.UI_ApplicationDataUsed
mov dword [esp + 0xc], 0
call fcn.0043ae10
add esp, 8
test eax, eax
je 0x438e46
mov eax, dword [esp + 4]
test eax, eax
je 0x438e46
mov esi, dword [esp + 0xc]
push 0x104
push esi
push str.UI_ApplicationDataPath
call fcn.0043af30
add esp, 0xc
test eax, eax
je 0x438e0b
mov eax, 1
pop esi
pop ecx
ret
cmp dword [esp + 4], 1
jne 0x438e46
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x438e46
push esi
call dword [0x4b5420]
cmp eax, 0xffffffff
je 0x438e46
push esi
push str.UI_ApplicationDataPath
call fcn.0043afa0
add esp, 8
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4393d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x4b5320]
push ebx
push esi
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
push 5
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], 5
call fcn.0043add0
mov edx, dword [esp + 0x18]
mov esi, dword [ebp + 8]
add esp, 0xc
push 1
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x43945c
push 0x104
push esi
push eax
call dword [0x4b5430]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.Images_
push esi
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
mov ecx, dword [ebp + 0x10]
push 0x104
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0043b040
add esp, 0xc
test eax, eax
je 0x439508
lea ebx, [ebx]
lea edx, [esp + 0x10]
push 0x498530
push edx
call dword [sym.imp.MSVCR71.dll_wcscspn]
mov edi, eax
add esp, 8
test edi, edi
je 0x4394af
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
cmp edi, eax
je 0x4394af
mov bl, 1
jmp 0x4394b1
xor bl, bl
push 0x498530
push esi
call dword [sym.imp.MSVCR71.dll_wcscat]
push edi
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0x14
push esi
call dword [0x4b5420]
cmp eax, 0xffffffff
jne 0x4394e2
push esi
call fcn.00438950
add esp, 4
lea edx, [esp + edi*2 + 0x12]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
test bl, bl
jne 0x439480
push 0x498530
push esi
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
mov ecx, dword [esp + 0x21c]
call fcn.0048c3c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439520
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x104
push esi
push str.UICaptureFilePath
call fcn.0043af30
add esp, 0xc
test eax, eax
jne 0x43968a
xor ebx, ebx
push ebx
lea eax, [esp + 0x10]
push eax
push str.UI_MedionOEM
mov dword [esp + 0x18], ebx
call fcn.0043add0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, ebx
je 0x4395bc
push 1
push 0x27
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x439589
push str.CapturePersonPath
push str.CaptureShellPath
push esi
call fcn.004393d0
add esp, 0xc
cmp word [0x4b6258], bx
jne 0x4395ab
push str.PowerDVD
push 0x40
push 0x4b6258
push str.ProductName
call fcn.0043afe0
add esp, 0x10
push 0x4b6258
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x43966c
push ebx
lea ecx, [esp + 0x10]
push ecx
push str.UI_CaptureMyPictures
mov dword [esp + 0x18], ebx
call fcn.0043add0
mov edx, dword [esp + 0x18]
add esp, 0xc
neg edx
sbb edx, edx
push 1
and edx, 0x22
add edx, 5
push edx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x439603
push str.CapturePersonPath
push str.CaptureShellPath
push esi
call fcn.004393d0
add esp, 0xc
push ebx
lea eax, [esp + 0x14]
push eax
push str.UI_NoPowerDVDShown
mov dword [esp + 0x1c], ebx
call fcn.0043add0
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
cmp eax, ebx
jne 0x43964c
call fcn.00437780
push eax
push esi
call edi
push esi
call fcn.00438950
add esp, 4
call fcn.00437750
push eax
push esi
call edi
push esi
call fcn.00438950
add esp, 4
cmp dword [esp + 0xc], ebx
mov eax, str.Snapshot
je 0x43965c
mov eax, str.Movie_Snapshot
push eax
push esi
call edi
push esi
call dword [0x4b5420]
cmp eax, 0xffffffff
jne 0x439675
push esi
call fcn.00438950
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
push str.UICaptureFilePath
call fcn.0043afa0
add esp, 8
mov edi, dword [sym.imp.MSVCR71.dll_wcslen]
push esi
call edi
mov ebx, dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 4
cmp eax, 0x104
jge 0x4396b6
cmp word [esi + eax*2 - 2], 0x5c
je 0x4396b6
push 0x498530
push esi
call ebx
add esp, 8
push esi
call dword [0x4b5420]
cmp eax, 0xffffffff
jne 0x439711
push str.My_Documents
push esi
call dword [sym.imp.MSVCR71.dll_wcsstr]
add esp, 8
test eax, eax
je 0x4396e8
push str.CapturePersonPath
push str.CaptureShellPath
push esi
call fcn.004393d0
add esp, 0xc
push esi
call edi
add esp, 4
cmp eax, 0x104
jge 0x439708
cmp word [esi + eax*2 - 2], 0x5c
je 0x439708
push 0x498530
push esi
call ebx
add esp, 8
push esi
call fcn.00438950
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x43a590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x492da8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00416470
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00412f80
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x43a622
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret