joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469300
Capabilities:
Get session user name

Disassembly:
sub esp, 0xa2c
push ebx
mov ebx, dword [esp + 0xa34]
push esi
push edi
push str.Ddcl
call fcn.004bf140
test al, al
jne 0x46933e
push str.Untitled___autonumber__
mov esi, 0x104
mov edi, ebx
call fcn.004af0d0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xa2c
ret 4
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x6d8038
push 0x6caa14
lea eax, [esp + 0x18]
call fcn.00489ce0
push 0
push 0x6d803c
mov eax, str.Settings
call fcn.00480fe0
test al, al
jne 0x46944c
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x428]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x218]
push edx
push 0x6bc0cc
push str.SnapshotFileNameFormat
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
call fcn.0069c886
add esp, 8
test eax, eax
jne 0x4693ed
push str.SnapshotFileNameFormat
mov eax, str.Settings
call fcn.004a54a0
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
lea edi, [esp + 0x428]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x218]
push edx
push 0x6bc0cc
push str.FileNameFormat
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
call fcn.0069c886
add esp, 8
test eax, eax
jne 0x46944c
push str.FileNameFormat
mov eax, str.Settings
call fcn.004a54a0
push 0
call fcn.0069c84d
add esp, 4
lea esi, [esp + 0x830]
mov edi, eax
call fcn.004a75b0
lea esi, [esp + 0x628]
mov eax, edi
call fcn.004a7920
lea edx, [esp + 0x10]
push edx
mov eax, esi
push eax
lea ecx, [esp + 0x838]
push ecx
push str._s__s____s
mov esi, 0x104
mov edi, ebx
call fcn.004af0d0
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0xa2c
ret 4

Function at 0x4694b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push esi
mov esi, eax
call fcn.004f6080
xor ebx, ebx
mov byte [esi + 0xbf], bl
mov byte [esi + 0xc0], bl
mov dword [esi], 0x6df0d8
call fcn.004af5a0
test al, al
je 0x4694e0
xor al, al
jmp 0x4694fb
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 0xc], 6
setae al
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x120]
neg al
mov dword [esi + 0xc5], ebx
mov dword [esi + 0xd9], ebx
mov dword [esi + 0xc1], 0x9d
mov dword [esi + 0xc9], 0x9c
mov dword [esi + 0xcd], 0xa0
mov dword [esi + 0xd1], 0xa5
sbb eax, eax
and eax, 0xa1
mov dword [esi + 0xd5], eax
mov eax, dword [esp + 0x128]
mov dword [esi + 0xdd], ebx
mov dword [esi + 0xe1], ebx
mov byte [esi + 0xe5], 1
mov dword [esi + 0xe6], ecx
mov ecx, dword [esp + 0x12c]
mov dword [esi + 0xef], eax
mov byte [esi + 0xea], bl
mov dword [esi + 0xeb], edx
mov dword [esi + 0xf3], ecx
mov eax, esi
pop esi
pop ebx
add esp, 0x114
ret 0x10
Function at 0x46a8b0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x228
lea eax, [esp + 0x20]
push eax
mov eax, 0xba
mov ecx, esi
call fcn.00517df0
mov eax, dword [esi + 4]
push 0
lea ecx, [esp + 4]
push ecx
push str.Locate_output_folder:
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x14], 0x41
mov byte [esp + 0x18], 0x7f
call fcn.004ac390
test al, al
je 0x46a990
push edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ecx]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x46a928
or ecx, 0xffffffff
mov eax, SysReAllocString
jmp 0x46a930
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
shrd ecx, eax, 0xa
shr eax, 0xa
test ecx, ecx
jne 0x46a980
mov ecx, dword [esi + 4]
push 0x10
push str.No_free_space
push str.There_is_no_free_space_on_the_selected_drive_folder._Please_select_another_folder_and_try_again.
push ecx
call edi
mov eax, dword [esi + 4]
push 0
lea edx, [esp + 8]
push edx
push str.Locate_output_folder:
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x18], 0x41
mov byte [esp + 0x1c], 0x7f
call fcn.004ac390
test al, al
jne 0x46a900
pop edi
add esp, 0x228
ret
push 0xba
push esi
lea eax, [esp + 0x2c]
call fcn.00517f60
pop edi
add esp, 0x228
ret

Function at 0x46b360
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
lea eax, [esp + 8]
push eax
mov eax, 0xce
mov ecx, esi
call fcn.00517df0
cmp word [esp + 8], 0
jne 0x46b3bb
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xe
push 0
mov word [esp + 0x20], 0
call edi
cmp word [esp + 0xc], 0
jne 0x46b3ba
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 5
push 0
mov word [esp + 0x20], 0
call edi
pop edi
mov eax, dword [esi + 4]
push 0
lea ecx, [esp + 4]
push ecx
push str.Browse_for_folder
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x14], 0x41
mov byte [esp + 0x18], 0x7f
call fcn.004ac390
test al, al
je 0x46b3f5
push 0xce
push esi
lea eax, [esp + 0x10]
call fcn.00517f60
add esp, 0x210
ret
Function at 0x46bc60
Capabilities:
Get disk size

Disassembly:
sub esp, 0x228
lea eax, [esp + 0x20]
push eax
mov eax, 0x17a
mov ecx, esi
call fcn.00517df0
mov eax, dword [esi + 4]
push 0
lea ecx, [esp + 4]
push ecx
push str.Locate_output_folder:
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x14], 0x41
mov byte [esp + 0x18], 0x7f
call fcn.004ac390
test al, al
je 0x46bd40
push edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ecx]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x46bcd8
or ecx, 0xffffffff
mov eax, SysReAllocString
jmp 0x46bce0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
shrd ecx, eax, 0xa
shr eax, 0xa
test ecx, ecx
jne 0x46bd30
mov ecx, dword [esi + 4]
push 0x10
push str.No_free_space
push str.There_is_no_free_space_on_the_selected_drive_folder._Please_select_another_folder_and_try_again.
push ecx
call edi
mov eax, dword [esi + 4]
push 0
lea edx, [esp + 8]
push edx
push str.Locate_output_folder:
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x18], 0x41
mov byte [esp + 0x1c], 0x7f
call fcn.004ac390
test al, al
jne 0x46bcb0
pop edi
add esp, 0x228
ret
push 0x17a
push esi
lea eax, [esp + 0x2c]
call fcn.00517f60
pop edi
add esp, 0x228
ret

Function at 0x471260
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
push edi
push str.FindPlay
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push ebx
push 0x6bc0cc
push str.DefaultRecordFolder
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
xor edi, edi
cmp word [ebx], di
jne 0x471312
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0xe
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4712f0
lea ecx, [esp + 0xc]
push ecx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4712f0
lea edx, [esp + 0xc]
push edx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
push 0x6bc0cc
push 0x6bc140
push ebx
lea eax, [esp + 0x18]
call fcn.004ad3a0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call fcn.00471b10
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x471320
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
push edi
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push ebx
push 0x6bc0cc
push str.LastAudioDirectory
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
xor edi, edi
cmp word [ebx], di
jne 0x4713d8
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0xd
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4713b0
lea ecx, [esp + 0xc]
push ecx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4713b0
lea edx, [esp + 0xc]
push edx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
push 0x6bc0cc
push 0x6bc140
push ebx
lea eax, [esp + 0x18]
call fcn.004ad3a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
call fcn.004713f0
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4

Function at 0x471440
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
push edi
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push ebx
push 0x6bc0cc
push str.SnapshotSaveLocation
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
xor edi, edi
cmp word [ebx], di
jne 0x4714f8
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0x27
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4714d0
lea ecx, [esp + 0xc]
push ecx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
cmp word [esp + 0xc], di
jne 0x4714d0
lea edx, [esp + 0xc]
push edx
push edi
push edi
push 5
push edi
mov word [esp + 0x20], di
call esi
push 0x6bc0cc
push 0x6bc140
push ebx
lea eax, [esp + 0x18]
call fcn.004ad3a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
call fcn.00471b60
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x471de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov edx, 0x6ca7e8
mov ecx, eax
push esi
lea esp, [esp]
mov si, word [ecx]
cmp si, word [edx]
jne 0x471e16
test si, si
je 0x471e12
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x471e16
add ecx, 4
add edx, 4
test si, si
jne 0x471df0
xor ecx, ecx
jmp 0x471e1b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x471ef3
mov edx, 0x6ca7dc
mov ecx, eax
lea ebx, [ebx]
mov si, word [ecx]
cmp si, word [edx]
jne 0x471e56
test si, si
je 0x471e52
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x471e56
add ecx, 4
add edx, 4
test si, si
jne 0x471e30
xor ecx, ecx
jmp 0x471e5b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x471ef3
mov edx, 0x6ce0b0
mov ecx, eax
lea ebx, [ebx]
mov si, word [ecx]
cmp si, word [edx]
jne 0x471e96
test si, si
je 0x471e92
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x471e96
add ecx, 4
add edx, 4
test si, si
jne 0x471e70
xor ecx, ecx
jmp 0x471e9b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x471eeb
mov edx, 0x6ce0e4
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x471ecc
test si, si
je 0x471ec8
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x471ecc
add ecx, 4
add edx, 4
test si, si
jne 0x471ea6
xor ecx, ecx
jmp 0x471ed1
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x471eeb
mov ecx, 0x6c699c
call fcn.00401160
test eax, eax
je 0x471eeb
push edi
call fcn.00471260
jmp 0x471ef9
push edi
call fcn.00471320
jmp 0x471ef9
push edi
call fcn.00471440
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop esi
je 0x471f0d
shr eax, 4
and al, 1
jne 0x471f18
mov ecx, edi
call fcn.004ad6d0
test al, al
je 0x471f22
push edi
call fcn.004021c0
test al, al
jne 0x471f26
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret
Function at 0x4723d0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x644
fld qword [0x7235f8]
mov ecx, dword [esp + 0x64c]
push ebx
push ebp
mov ebp, dword [esp + 0x650]
fstp qword [ebp + 0x11]
lea ebx, [ebp + 0x11]
fldz
push esi
fst qword [ebp + 0x19]
xor esi, esi
push edi
fstp qword [ebp + 0x22]
lea eax, [esp + 0x38]
mov byte [ebp], 0
mov byte [ebp + 1], 1
mov byte [ebp + 2], 0
mov byte [ebp + 3], 1
mov byte [ebp + 4], 1
mov dword [ebp + 5], esi
mov dword [ebp + 9], 0x300
mov dword [ebp + 0xd], 0x240
mov byte [ebp + 0x21], 0
mov byte [ebp + 0x2a], 0
mov byte [ebp + 0x2b], 0
call fcn.00472350
push esi
push str.IsTimeElapsed
lea eax, [esp + 0x40]
mov word [esp + 0x248], si
call fcn.00480fe0
push esi
mov byte [ebp + 0x21], al
push str.IsFramerateChanged
lea eax, [esp + 0x40]
call fcn.00480fe0
mov byte [ebp + 1], al
lea eax, [esp + 0x240]
push eax
call fcn.00471c90
lea ecx, [esp + 0x240]
call fcn.00472a10
test al, al
je 0x472495
push esi
push str.IsResized
lea eax, [esp + 0x40]
call fcn.00480fe0
mov byte [ebp], al
jmp 0x472499
mov byte [ebp], 0
push 1
push str.IsKeepRatio
lea eax, [esp + 0x40]
call fcn.00480fe0
lea ecx, [esp + 0x38]
push ecx
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x450]
mov byte [ebp + 4], al
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x240]
push edx
push 0x6d98dc
push str.ExposureRate
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
lea eax, [ebp + 0x22]
push eax
lea eax, [esp + 0x244]
push 0x6c6700
push eax
call fcn.0069d13f
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
push str.SoftwareNCH_SoftwareDebut_s
lea edi, [esp + 0x450]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x240]
push edx
push str.30.0
push str.FrameRate
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
push ebx
lea eax, [esp + 0x244]
push 0x6c6700
push eax
call fcn.0069d13f
add esp, 0xc
push 0
push str.Width
lea eax, [esp + 0x40]
call fcn.004811b0
push 0
mov dword [ebp + 9], eax
push str.Height
lea eax, [esp + 0x40]
call fcn.004811b0
push 0
mov dword [ebp + 0xd], eax
push str.IsResizeTypeCrop
lea eax, [esp + 0x40]
call fcn.00480fe0
neg al
sbb eax, eax
neg eax
mov dword [ebp + 5], eax
mov eax, dword [esp + 0x65c]
test eax, eax
je 0x47259d
cmp eax, 3
jne 0x4725d5
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
cmp dword [esp + 0x28], 1
mov eax, str.Settings
setle dl
sub edx, 1
and edx, 0x1d
add edx, 1
push edx
push str.ScreenCaptureFPS
call fcn.004811b0
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [ebx]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x644
ret 8
Function at 0x472870
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x618
push ebx
push 0
push str.ScreenCaptureHWND
mov eax, str.Settings
call fcn.004811b0
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x47289d
pop ebx
add esp, 0x618
ret
push esi
push edi
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x21c]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x41c]
push eax
push 0x6bc0cc
push str.ScreenCaptureWndCaption
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
push esi
lea ecx, [esp + 0x10]
push ecx
push ebx
mov word [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
lea ecx, [esp + 8]
lea eax, [esp + 0x418]
pop esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x472934
test dx, dx
je 0x472922
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x472934
add eax, 4
add ecx, 4
test dx, dx
jne 0x472900
xor eax, eax
neg eax
sbb eax, eax
not eax
and eax, ebx
pop ebx
add esp, 0x618
ret
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb eax, eax
not eax
and eax, ebx
pop ebx
add esp, 0x618
ret

Function at 0x472950
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4729a0
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push str.ScreenCaptureWndCaption
push SysReAllocStringLen
mov esi, 0x6bc0cc
mov edx, edi
call fcn.004af710
xor eax, eax
jmp 0x4729f3
push 0x104
lea eax, [esp + 0x218]
push eax
push ebx
mov word [esp + 0x220], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push str.ScreenCaptureWndCaption
push SysReAllocStringLen
lea esi, [esp + 0x21c]
mov edx, edi
call fcn.004af710
mov eax, ebx
push str.ScreenCaptureHWND
push str.Settings
call fcn.00480f20
pop edi
pop esi
pop ebx
add esp, 0x410
ret 4
Function at 0x479040
Capabilities:
Check os version

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push edi
mov esi, eax
mov edi, ecx
call fcn.004af5a0
test al, al
jne 0x4790bb
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 0x1c], 6
setae al
test al, al
je 0x4790bb
push esi
push edi
push str._s_n_s
mov esi, 0x104
lea edi, [esp + 0x24]
mov byte [esp + 0x20], 0
mov dword [esp + 0x1c], 0x5001030e
call fcn.004af0d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov edx, edi
push ecx
mov esi, ebx
mov edi, ebp
call fcn.00404e70
jmp 0x479139
push esi
push edi
push str._s____s
mov esi, 0x104
lea edi, [esp + 0x24]
call fcn.004af0d0
add esp, 0xc
push 0
push 0x5001004b
push str.Button
push ebx
mov edx, edi
mov eax, ebp
call fcn.0051c9e0
cmp dword [ebp + 0xd0], 0
lea edi, [ebp + 0xcc]
je 0x479139
push fcn.00518250
mov ecx, ebx
mov eax, edi
call fcn.004f4620
mov esi, dword [edi + 4]
push 0
push 0
push ebx
push 0x4f5d40
push 0x2b
add esi, 0x28
call fcn.0051d2c0
mov edi, dword [edi + 4]
mov edx, dword [edi + 4]
push 1
push str.BorderFrame
push ebx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetPropW]
movzx eax, word [esp + 0x22c]
push eax
mov eax, ebx
mov ecx, ebp
call fcn.0051ad10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
Function at 0x47cd60
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [edi + 0x4d8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47ce40
push 0
push str.SnapshotOverwrite
mov eax, str.Settings
call fcn.00480fe0
test al, al
mov byte [esp + 0x10], al
je 0x47ce1b
cmp dword [edi + 0x6e4], 0
je 0x47ce1b
mov edx, ebx
lea esi, [esp + 0x18]
call fcn.004ad160
mov eax, esi
push eax
push str.Snapshot_file__s_already_exists._nDo_you_want_to_overwrite_it_
mov esi, 0x208
lea edi, [esp + 0x228]
call fcn.004af0d0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x6e4]
mov eax, dword [edx + 4]
add esp, 8
push str.Never_warn_when_overwriting_an_existing_snapshot
push str.Overwrite_snapshot
mov ecx, edi
push ecx
push eax
mov eax, str.Overwrite
lea edx, [esp + 0x20]
call fcn.004f4360
mov edx, dword [esp + 0x10]
push edx
push str.SnapshotOverwrite
mov ecx, str.Settings
mov byte [esp + 0x17], al
call fcn.00480f80
cmp byte [esp + 0xf], 0
je 0x47ce6a
mov edi, dword [ebp + 8]
push 0
call fcn.0069c84d
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call fcn.004abee0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
mov eax, ebx
call fcn.00401d20
mov esi, dword [ebp + 0xc]
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x47ce6a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x6e4]
test eax, eax
je 0x47ce6a
push eax
mov eax, ebx
call fcn.00447040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x483b60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x40], 0
push edi
je 0x483b86
cmp dword [esi], 0xffffffff
je 0x483b86
cmp dword [esi + 4], 0
jle 0x483b86
cmp dword [esi + 8], 0
jg 0x483b98
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
fldz
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
sub esp, 8
fstp qword [esp]
call edx
mov ecx, dword [esi + 8]
test ecx, ecx
mov dword [esp + 0x28], ecx
je 0x483b86
mov eax, 0xcccccccd
mul ecx
xor edi, edi
mov ebx, edx
push edi
shr ebx, 3
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call fcn.004d39b0
mov esi, dword [esp + 0x38]
test esi, esi
je 0x483b86
cmp esi, dword [esp + 0x30]
jb 0x483b86
cmp esi, dword [esp + 0x34]
ja 0x483b86
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
test al, al
je 0x483c09
mov eax, dword [ebp + 8]
mov dword [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x483cf9
cmp esi, dword [esp + 0x30]
jb 0x483cf9
cmp esi, dword [esp + 0x34]
ja 0x483cf9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
cmp eax, 0x32
jbe 0x483c55
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
test al, al
jne 0x483bf7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
lea eax, [esi + ecx*4]
cmp esi, eax
jae 0x483ca4
sub eax, esi
sub eax, 1
shr eax, 2
add eax, 1
lea ecx, [esi + 2]
mov edx, eax
movzx eax, byte [ecx - 1]
movzx ebx, byte [ecx - 2]
imul eax, eax, 0x9b
imul ebx, ebx, 0x19
add eax, ebx
movzx ebx, byte [ecx]
imul ebx, ebx, 0x4c
add eax, ebx
sar eax, 8
mov byte [ecx - 2], al
mov byte [ecx - 1], al
mov byte [ecx], al
add ecx, 4
sub edx, 1
jne 0x483c72
mov ebx, dword [esp + 0x24]
add esi, dword [esp + 0x3c]
add edi, 1
cmp edi, dword [esp + 0x20]
jbe 0x483c13
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
lea edx, [ebx + edi]
mov dword [esp + 0x20], edx
mov edx, edi
test edx, edx
mov dword [esp + 0x2c], edx
fild dword [esp + 0x2c]
jge 0x483cd5
fadd qword [0x7235b8]
mov edx, dword [esp + 0x28]
fild dword [esp + 0x28]
test edx, edx
jge 0x483ce7
fadd qword [0x7235b8]
fdivp st(1)
mov eax, dword [eax + 0x24]
sub esp, 8
fstp qword [esp]
call eax
jmp 0x483c13
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4853f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp byte [ebx + 0x22], 0
push ebp
push esi
push edi
je 0x485483
mov esi, dword [ebx + 0x1a]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov byte [ebx + 0x22], 0
mov eax, dword [esi + 4]
push 0x257f
push eax
call ebp
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x485436
mov ecx, dword [esi + 4]
push 0
push 1
push 0x28
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x1a]
cmp byte [eax + 0x2d], 0
je 0x485467
mov edx, dword [eax + 4]
push 1
push edx
mov eax, 0x257f
call fcn.004f6c00
mov esi, dword [ebx + 0x1a]
call fcn.004224d0
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [eax + 4]
push 0
push 0x257f
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebx + 0x1a]
call fcn.004224d0
pop edi
pop esi
pop ebp
pop ebx
ret 4