joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4525b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
cmp dword [edi + 0x3bc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, eax
jne 0x4525ce
cmp ebp, 2
jne 0x452745
cmp dword [edi + 0x3c0], 0
je 0x452745
xor bl, bl
cmp ebp, 3
mov byte [esp + 0x18], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x14], bl
mov byte [esp + 0x10], bl
ja case.default.0x4525f9
jmp dword [ebp*4 + 0x452750]
push ecx
mov eax, esp
mov dword [eax], 0xffffff
push edi
mov eax, 0x6f
mov byte [esp + 0x2c], 1
call fcn.00518160
push 0x6f
lea eax, [edi + 0x1b4]
push edi
call fcn.00517f60
jmp 0x45267a
mov bl, 1
mov byte [esp + 0x14], bl
jmp 0x45267a
push ecx
mov eax, esp
mov dword [eax], 0xff
push edi
mov eax, 0x6f
mov byte [esp + 0x20], 1
mov byte [esp + 0x2c], 1
call fcn.00518160
push 0x6f
lea eax, [edi + 0x1b4]
push edi
call fcn.00517f60
cmp esi, 2
je 0x45266e
cmp esi, 4
je 0x45266e
mov byte [esp + 0x10], 0
jmp 0x45267a
mov byte [esp + 0x10], 1
jmp 0x45267a
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x14]
mov esi, dword [edi + 0x3c0]
push eax
call fcn.00435e40
mov edx, dword [edi + 4]
xor ecx, ecx
test bl, bl
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
push eax
mov eax, 0x70
mov edx, edi
call fcn.00403e90
mov ecx, dword [esp + 0x24]
push ecx
mov eax, 0x6f
mov edx, edi
call fcn.00403e90
mov edx, dword [esp + 0x1c]
push edx
mov eax, 0xd6
mov edx, edi
call fcn.00403e90
mov esi, dword [esp + 0x10]
push esi
mov eax, 0x1f5e
mov edx, edi
call fcn.00403e90
push esi
mov eax, 0x1f5f
mov edx, edi
call fcn.00403e90
mov esi, edi
mov dword [edi + 0x3bc], ebp
call fcn.004f0a30
mov eax, dword [edi + 0xfd]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x111]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [edi + 0xfd], 0
je 0x452730
mov ecx, dword [eax + 4]
push 0x105
push 0
push 0
push ecx
call esi
mov edx, dword [edi + 0x3c0]
mov eax, dword [edx + 4]
push 0x585
push 0
push 0
push eax
call esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x452b50
Capabilities:
Hide graphical window

Disassembly:
push esi
push str.CaptureMode
mov eax, str.Settings
call fcn.004a5500
test al, al
je 0x452b77
push 0
push str.CaptureMode
mov eax, str.Settings
call fcn.004811b0
jmp 0x452b81
push str.PSei
call fcn.004bf140
push str.CaptureMode
mov eax, str.Settings
call fcn.004a5500
test al, al
je 0x452ba7
push 0
push str.CaptureMode
mov eax, str.Settings
call fcn.004811b0
jmp 0x452bb1
push str.PSei
call fcn.004bf140
lea eax, [edi + 0x1ac]
test eax, eax
je 0x452bc3
lea eax, [edi + 0x1b0]
jmp 0x452bc5
xor eax, eax
mov eax, dword [eax]
push ecx
mov ecx, esp
mov dword [ecx], eax
lea esi, [edi + 0x145]
mov eax, esi
call fcn.004e1d10
push str.To_enable_this__press__CtrlShiftEnter__or_uncheck_the__Show_the_recording_preview__in_Options.
push str.The_preview_is_disabled.
mov edx, esi
call fcn.00452390
cmp dword [edi + 0x3bc], 0
je 0x452cba
mov esi, dword [edi + 0x3c0]
test esi, esi
je 0x452cba
push 0
call fcn.00435e40
mov ecx, dword [edi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, 0x70
mov edx, edi
call fcn.00403e90
push 0
mov eax, 0x6f
mov edx, edi
call fcn.00403e90
push 1
mov eax, 0xd6
mov edx, edi
call fcn.00403e90
push 0
mov eax, 0x1f5e
mov edx, edi
call fcn.00403e90
push 0
mov eax, 0x1f5f
mov edx, edi
call fcn.00403e90
mov esi, edi
mov dword [edi + 0x3bc], 4
call fcn.004f0a30
mov edx, dword [edi + 0xfd]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x111]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [edi + 0xfd], 0
je 0x452ca5
mov eax, dword [eax + 4]
push 0x105
push 0
push 0
push eax
call esi
mov ecx, dword [edi + 0x3c0]
mov edx, dword [ecx + 4]
push 0x585
push 0
push 0
push edx
call esi
pop esi
ret
Function at 0x455bd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
push esi
push edi
lea eax, [esp + 0x60]
push eax
mov eax, 0x68
call fcn.00517df0
xor esi, esi
mov eax, 1
lea ecx, [esp + 0x60]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x455c71
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x14], 0x6dbbf0
call fcn.004cf2c0
cmp dword [esp + 0x10], edi
je 0x455cb6
cmp dword [esp + 0x14], esi
jle 0x455cb6
cmp dword [esp + 0x18], esi
jle 0x455cb6
push str.OverlayEffect
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x270]
call fcn.004af0d0
add esp, 8
push str.SourcePath
push SysReAllocStringLen
lea esi, [esp + 0x68]
mov edx, edi
call fcn.004af710
lea ecx, [esp + 0x10]
call fcn.004d0c50
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5e4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
call fcn.0045de60
push 0x400
call fcn.0069c0de
mov edi, eax
xor eax, eax
add esp, 4
cmp edi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
jne 0x45975c
mov dword [esp + 0x1c], eax
jmp 0x459766
mov dword [esp + 0x1c], 0xff
mov dword [edi], eax
mov eax, dword [ebx + 4]
push 0x64
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4597e5
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jl 0x4597e1
mov edi, edi
mov edx, dword [ebx + 4]
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x104b
push 0x64
push edx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00481290
push 2
push edi
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jge 0x459790
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x1e0]
push edx
mov byte [esp + 0x13], 0
call fcn.00471260
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x1e0]
push eax
call esi
cmp eax, 0xffffffff
je 0x45982d
mov dl, 1
lea ecx, [esp + 0x1e0]
call fcn.004abd60
cmp dword [ebx + 0xbd1], eax
je 0x45982d
mov dword [ebx + 0xbd1], eax
mov byte [esp + 0xf], 1
lea ecx, [esp + 0x3e8]
push ecx
call fcn.00471440
lea edx, [esp + 0x3e8]
push edx
call esi
cmp eax, 0xffffffff
je 0x459869
mov dl, 1
lea ecx, [esp + 0x3e8]
call fcn.004abd60
cmp dword [ebx + 0xbd5], eax
je 0x459869
mov dword [ebx + 0xbd5], eax
mov al, 1
jmp 0x45986d
mov al, byte [esp + 0xf]
cmp byte [ebp + 0xc], 0
jne 0x4598a6
test al, al
jne 0x4598a6
mov ebx, dword [esp + 0x18]
xor esi, esi
test ebx, ebx
jbe 0x459894
mov eax, dword [edi + esi*4]
push eax
call fcn.0069c8fa
add esi, 1
add esp, 4
cmp esi, ebx
jb 0x459881
push edi
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, ebx
call fcn.004596b0
mov ecx, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push 0x1009
push 0x64
push ecx
call esi
mov edx, dword [ebx + 4]
push 0
push 0
push 0xb
push 0x64
push edx
call esi
mov eax, dword [ebx + 0x163]
mov ecx, dword [eax + 0x53]
test ecx, ecx
je 0x459970
cmp dword [ecx + 0x117], 3
jne 0x459970
mov esi, dword [eax + 4]
push 0
push str.Updating_list_of_recordings
lea edi, [esp + 0x68]
call fcn.00510e60
mov dword [esp + 0x1da], esi
mov eax, esi
mov esi, edi
mov dword [esp + 0x60], 0x6dcb60
mov dword [esp + 0x11f], 0x6df490
invalid
test byte [edi + ecx*2], ah
add dword [eax], eax
invalid
push eax
Function at 0x45a280
Capabilities:
Delete file
Get file attributes

Disassembly:
sub esp, 0x250
push ebx
push ebp
push esi
push 0xa8f
push edi
call fcn.00459d20
test al, al
je 0x45a3fc
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 2
push 0xffffffffffffffff
push 0x100c
push 0x64
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
mov ecx, dword [edi + 4]
push 0
push 0
push 0x1004
push 0x64
push ecx
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push str.Qyol
mov dword [esp + 0x18], eax
call fcn.004bf140
test al, al
mov byte [esp + 0x13], al
mov ecx, str.Are_you_sure_you_want_to_move_the_file_s__to_Recycle_Bin_
jne 0x45a2f5
mov ecx, str.Are_you_sure_you_want_to_delete_the_file_s__permanently_
mov eax, dword [edi + 4]
push str.Debut_Video_Capture_Software
push ecx
push eax
mov ecx, str.Cancel
mov eax, str.Delete
call fcn.004f39e0
test al, al
je 0x45a3fc
xor ebp, ebp
cmp dword [esp + 0x14], ebp
jle 0x45a389
mov edi, edi
mov edx, dword [edi + 4]
push 2
push ebp
push 0x102c
push 0x64
push edx
call ebx
push eax
call esi
shr eax, 1
test al, 1
je 0x45a37a
lea esi, [esp + 0x50]
mov eax, ebp
mov edx, edi
call fcn.0045aca0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x50
jne 0x45a36f
cmp byte [esp + 0x13], 0
jne 0x45a406
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x45a417
lea eax, [esp + 0x50]
push eax
push edi
call fcn.0045a8c0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add ebp, 1
cmp ebp, dword [esp + 0x14]
jl 0x45a320
mov eax, dword [edi + 0xf1]
push str.LVColumn
push str.FindPlay
call fcn.00480f20
movzx ecx, byte [edi + 0xf5]
push ecx
push str.LVAscending
mov ecx, str.FindPlay
call fcn.00480f80
push 1
push 0
push edi
call fcn.00459720
mov edx, dword [edi + 4]
push 0
push 0
push 0x1004
push 0x64
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ebp, dword [esp + 0x18]
cmp ebp, eax
jge 0x45a42f
push ebp
mov eax, 0x64
mov ecx, edi
call fcn.00519790
mov eax, dword [edi + 4]
push 0
push ebp
push 0x1013
push 0x64
push eax
call ebx
push eax
call esi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
lea edx, [esp + 0x50]
call fcn.00401d80
test al, al
jne 0x45a36f
mov edx, dword [edi + 4]
push edx
mov esi, str.Debut_Video_Capture_Software
mov eax, str.The_file_could_not_be_deleted.
call fcn.004f3850
jmp 0x45a37a
mov ecx, dword [edi + 4]
push 0x64
push ecx
call ebx
lea edx, [esp + 0x1c]
push edx
push 0xffffffffffffffff
push 0x102b
push eax
mov dword [esp + 0x3c], 2
mov dword [esp + 0x38], 0
call esi
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
pop esi
pop ebp
mov ecx, edi
pop ebx
add esp, 0x250
jmp edx
Function at 0x45ab30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x218]
push ebp
push esi
push edi
push 1
push str.Prism
call fcn.004b6ee0
test al, al
jne 0x45ac89
mov eax, dword [ebx + 4]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x1032
push 0x64
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x45ac89
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x1004
push 0x64
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov esi, eax
xor edi, edi
test esi, esi
mov dword [esp + 0x14], esi
jle 0x45ac89
mov edx, dword [ebx + 4]
push 2
push edi
push 0x102c
push 0x64
push edx
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 1
test al, 1
je 0x45abf0
lea esi, [esp + 0x18]
mov eax, edi
mov edx, ebx
call fcn.0045aca0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45abec
mov eax, esi
call fcn.00401cc0
test edx, edx
ja 0x45ac04
jb 0x45abec
cmp eax, 0xa00000
jae 0x45ac04
mov esi, dword [esp + 0x14]
add edi, 1
cmp edi, esi
jl 0x45aba0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
push 0
call fcn.0069c84d
add esp, 4
push 0
mov esi, eax
push str.PromotePrismTimestamp
mov eax, str.Settings
call fcn.004811b0
mov ecx, esi
sub ecx, eax
cmp ecx, 0x1255c0
jl 0x45ac89
push str.PromotePrismTimestamp
push str.Settings
mov eax, esi
call fcn.00480f20
mov ecx, dword [ebx + 0x163]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0x405
push str.Maybe_Later
push 0x406
push str.Try_it_Now
push str.Some_file_sizes_are_very_large._Convert_to_a_smaller_file_using_Prism_Video_Converter.
add ecx, 0x2145
xor eax, eax
call fcn.0048c020
mov edx, dword [ebx + 0x163]
mov eax, dword [edx + 4]
push 0x585
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x45b7b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x444]
push 0xa93
push edi
call fcn.00459d20
test al, al
je 0x45b94b
mov eax, dword [edi + 4]
xor esi, esi
push esi
push esi
push 0x1004
push 0x64
xor ebx, ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ebp, ebp
test eax, eax
mov dword [esp + 0x2c], eax
jle 0x45b939
mov ecx, dword [edi + 4]
push 2
push ebp
push 0x102c
push 0x64
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 1
test al, 1
je 0x45b8fc
lea esi, [esp + 0x30]
mov eax, ebp
mov edx, edi
call fcn.0045aca0
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45b8fc
lea edi, [esp + 0x238]
call fcn.004ad1c0
mov eax, edi
push 0x6ca7e8
push eax
call fcn.006b227b
add esp, 8
test eax, eax
je 0x45b88d
mov ecx, edi
push 0x6ca7dc
push ecx
call fcn.006b227b
add esp, 8
test eax, eax
je 0x45b88d
xor bl, bl
jmp 0x45b88f
mov bl, 1
lea edi, [esp + 0x238]
call fcn.0065e5f0
test al, al
jne 0x45b8a5
test bl, bl
je 0x45b8f5
jmp 0x45b8a9
test bl, bl
je 0x45b8cb
push 0x6ce224
lea eax, [esp + 0x24]
call fcn.00480990
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
call fcn.00480990
lea eax, [esp + 0x20]
jmp 0x45b8eb
push 0x6ce224
lea eax, [esp + 0x18]
call fcn.00480990
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
call fcn.00480990
lea eax, [esp + 0x14]
push 0x6ce228
call fcn.00480990
mov edi, dword [esp + 0x444]
add ebp, 1
cmp ebp, dword [esp + 0x2c]
jl 0x45b811
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x45b921
cmp word [ebx], 0
je 0x45b921
mov edx, dword [edi + 4]
mov eax, ebx
call fcn.0041fa20
mov esi, dword [esp + 0x14]
test esi, esi
je 0x45b939
cmp word [esi], 0
je 0x45b939
mov edx, dword [edi + 4]
mov eax, esi
call fcn.0041fae0
push ebx
call fcn.0069c8fa
add esp, 4
push esi
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 4
Function at 0x45b960
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Write file on windows

Disassembly:
mov eax, 0x1638
call fcn.006ab750
push ebx
mov ebx, dword [esp + 0x1640]
push ebp
push esi
push edi
push 0xa92
push ebx
call fcn.00459d20
test al, al
je 0x45baf1
push ebx
call fcn.0045ab30
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x30]
push eax
push 0x104
call edi
push str..tmp
lea ecx, [esp + 0x34]
push ecx
lea esi, [esp + 0x240]
call fcn.004ac1f0
lea edx, [esp + 0x440]
push edx
push 0x104
call edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x1004
push 0x64
mov esi, eax
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x45ba6f
mov edx, dword [ebx + 4]
push 2
push edi
push 0x102c
push 0x64
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 1
test al, 1
je 0x45ba64
lea esi, [esp + 0x30]
mov eax, edi
mov edx, ebx
call fcn.0045aca0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ba64
lea ecx, [esp + 0x10]
push ecx
mov eax, esi
call fcn.004ae050
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 2
push 0x6ce230
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 1
cmp edi, ebp
jl 0x45ba03
mov esi, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x45ba7b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x238]
push ecx
push str._show__type_data__label_BACKUP__list___s___burn__exit
mov esi, 0x800
lea edi, [esp + 0x650]
call fcn.004af0d0
mov ecx, dword [ebx + 4]
add esp, 8
lea eax, [esp + 0x18]
push eax
mov edx, edi
push ecx
mov eax, str.Run_ExpressBurn
lea esi, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], str.ExpressBurn
mov dword [esp + 0x28], str.CopyCD
mov dword [esp + 0x2c], str.burnsetup
mov dword [esp + 0x30], str.Express_Burn
mov byte [esp + 0x34], 1
mov byte [esp + 0x35], 0
call fcn.00484be0
lea edx, [esp + 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1638
ret 4
Function at 0x45bb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x430
push ebx
push ebp
mov ebp, dword [esp + 0x43c]
push esi
push edi
push 0xa94
push ebp
call fcn.00459d20
test al, al
je 0x45bc74
xor esi, esi
xor edi, edi
push ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.0045ab30
mov eax, dword [ebp + 4]
push esi
push esi
push 0x1004
push 0x64
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x2c], eax
jle 0x45bc62
mov ecx, dword [ebp + 4]
push 2
push ebx
push 0x102c
push 0x64
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 1
test al, 1
je 0x45bc25
lea esi, [esp + 0x30]
mov eax, ebx
mov edx, ebp
call fcn.0045aca0
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45bc25
lea edi, [esp + 0x238]
call fcn.004ad1c0
mov eax, edi
push 0x6ca7e8
push eax
call fcn.006b227b
add esp, 8
test eax, eax
je 0x45bbfb
mov ecx, edi
push 0x6ca7dc
push ecx
call fcn.006b227b
add esp, 8
test eax, eax
je 0x45bbfb
push 0x6ce224
lea eax, [esp + 0x18]
call fcn.00480990
mov edx, esi
push edx
lea eax, [esp + 0x18]
call fcn.00480990
lea eax, [esp + 0x14]
jmp 0x45bc1b
push 0x6ce224
lea eax, [esp + 0x24]
call fcn.00480990
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
call fcn.00480990
lea eax, [esp + 0x20]
push 0x6ce228
call fcn.00480990
add ebx, 1
cmp ebx, dword [esp + 0x2c]
jl 0x45bb67
mov edi, dword [esp + 0x20]
test edi, edi
je 0x45bc4a
cmp word [edi], 0
je 0x45bc4a
mov edx, dword [ebp + 4]
mov eax, edi
call fcn.0041f9c0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x45bc62
cmp word [esi], 0
je 0x45bc62
mov edx, dword [ebp + 4]
mov eax, esi
call fcn.0041fc60
push edi
call fcn.0069c8fa
add esp, 4
push esi
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 4
Function at 0x45bc90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x73e0
call fcn.006ab750
push ebx
push ebp
mov ebp, dword [esp + 0x73ec]
push esi
push edi
push 0xa95
push ebp
mov edi, ecx
call fcn.00459d20
test al, al
je 0x45c382
push ebp
call fcn.0045ab30
lea esi, [esp + 0x1af0]
call fcn.0060e450
mov eax, esi
push eax
call fcn.0060e600
mov ecx, dword [ebp + 4]
push 0
push 0
push 0x1004
push 0x64
push ecx
mov dword [esp + 0x6624], edi
mov dword [ebp + 0x7bd], edi
mov byte [esp + 0x29], 0
mov byte [esp + 0x2a], 1
mov byte [esp + 0x2b], 0
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edi, eax
push 0
mov dword [esp + 0x2c], edi
call fcn.0069c8fa
add esp, 4
push edi
call fcn.0069c0de
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
xor esi, esi
test edi, edi
mov dword [esp + 0x20], eax
jle 0x45bd59
mov edi, edi
mov edx, dword [ebp + 4]
push 2
push esi
push 0x102c
push 0x64
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
mov ecx, dword [esp + 0x20]
shr eax, 1
and al, 1
mov byte [esi + ecx], al
add esi, 1
cmp esi, edi
jl 0x45bd30
mov edx, dword [ebp + 4]
xor esi, esi
push esi
push esi
push 0x1032
push 0x64
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
cmp eax, 1
jle 0x45bda1
mov eax, dword [ebp + 4]
push str.Debut_Video_Capture_Software
push str.More_than_one_file_is_selected_for_upload._Do_you_want_to_apply_different_upload_settings_to_each_file__the_upload_dialog_will_be_opened_every_time__or_do_you_want_to_apply_the_same_upload_settings_for_all_files__the_upload_dialog_will_be_opened_only_once__
push eax
mov ecx, str.All_files
mov eax, str.Each_file
mov byte [esp + 0x23], 1
call fcn.004f38c0
test al, al
je 0x45bda1
mov byte [esp + 0x15], 1
mov ecx, dword [ebp + 4]
mov eax, dword [ebp]
mov edx, dword [eax + 0x30]
push 1
push 0x3f6
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], esi
mov byte [ebp + 0xbd9], 1
call edx
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1c], ebx
jle 0x45c244
lea esp, [esp]
mov eax, dword [esp + 0x20]
cmp byte [ebx + eax], 0
je 0x45c22f
lea esi, [esp + 0xc0]
invalid

Function at 0x45e5c0
Capabilities:
Create directory

Disassembly:
push ebp
push esi
mov esi, edi
call fcn.004f6080
lea esi, [edi + 0xc1]
mov byte [edi + 0xbf], 0
mov byte [edi + 0xc0], 0
mov dword [edi], 0x6df030
mov word [esi], 0
call fcn.004ac170
push 0x6bc0cc
push str.ScheduleTasks
lea ebp, [edi + 0x2c9]
push ebp
mov eax, esi
call fcn.004ad3a0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
pop esi
mov dword [edi + 0x4d1], eax
mov dword [edi + 0x4d5], ecx
mov eax, edi
pop ebp
ret 8
Function at 0x463940
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x424
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
mov ebp, dword [esp + 0x434]
push esi
push edi
push ebp
lea esi, [esp + 0x14]
call fcn.004643c0
mov edi, esi
mov esi, dword [ebx + 0xc7]
call fcn.00460a90
mov eax, dword [ebx + 0xc7]
push 0x104
lea ecx, [esp + 0x24]
push ecx
push ebp
mov dword [eax + 0x13d], ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 0x20]
push edx
push str.Selecting_Window:__s
mov esi, 0x104
lea edi, [esp + 0x230]
call fcn.004af0d0
mov ecx, dword [ebx + 4]
add esp, 8
mov eax, edi
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [ebx + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 4]
push eax
call fcn.005176b0
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret 8

Function at 0x464800
Capabilities:
Check os version
Persist via run registry key

Disassembly:
sub esp, 0x114
call fcn.004af5a0
test al, al
jne 0x46485b
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 4], 6
setae al
test al, al
je 0x46485b
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
je 0x46485b
push 0
push str.InstalledByAdmin
mov eax, str.Settings
call fcn.00480fe0
test al, al
je 0x46485b
mov eax, 0x6d78d0
call fcn.004c1dd0
test al, al
jne 0x46486e
mov ecx, dword [0x735b94]
mov eax, dword [ecx]
add esp, 0x114
jmp fcn.004c1c30
add esp, 0x114
ret

Function at 0x464880
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword [0x735b94]
mov ecx, dword [eax]
sub esp, 0x208
push esi
push edi
push ecx
push str.__s___logon
mov esi, 0x104
lea edi, [esp + 0x10]
call fcn.004af0d0
add esp, 8
push 0x6bc140
push SysReAllocStringLen
mov esi, edi
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004af710
pop edi
pop esi
add esp, 0x208
ret