joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ba90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x44bb60
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x44bab1
cmp al, 0x6b
jne 0x44bb60
cmp al, 0x6b
lea edx, [ecx + 1]
jne 0x44bb21
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x44bad5
mov al, byte [edx]
add edx, 1
cmp al, 0xba
je 0x44bad5
cmp al, 0xbb
jne 0x44bafe
add ecx, 1
cmp ecx, esi
jl 0x44bac1
sub esi, ecx
test ecx, ecx
jne 0x44bb24
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00412a20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00412a20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x44bb4d
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00412a20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00412a20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x457ed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x457ee9
mov edi, ebx
mov ebx, eax
jmp 0x457eeb
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x457f01
push eax
push esi
call fcn.0041dae0
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x457f1f
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x457f08
cmp eax, dword [edi + 4]
jge 0x457f36
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x457f24
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x457f61
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
lea esp, [esp]
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x457f61
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x457f50
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x45bf50
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.00481180
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x45bf6a
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x45bfec
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x45bfb8
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.00413b40
add esp, 8
test eax, eax
jne 0x45bfd9
push edi
mov edi, 0x4a99a0
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x45bfb8
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x45bfdc
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.00413b40
add esp, 8
test eax, eax
je 0x45bfe3
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x45d1c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
sub edx, 1
push edi
mov edi, ecx
js 0x45d1e4
push esi
mov esi, dword [esp + 0xc]
mov ecx, eax
and ecx, 7
mov cl, byte [ecx + edi]
xor byte [eax + esi], cl
inc eax
cmp eax, edx
jle 0x45d1d3
pop esi
mov eax, 1
pop edi
ret 8
Function at 0x45fb20
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x4ca0c0], 0
push esi
mov esi, ecx
jne 0x45fb43
push 0
push dword [0x4ee198]
push str.Please_upgrade_to_Pro_version_for_getting_the_converter.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x45fb5b
push 1
push 0
push 0
push str.https:__videoconverter.guru_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.mfc140u.dll_CWnd::FromHandle]
push 0
push dword [0x4ca0b0]
push 0x465
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop esi
ret
Function at 0x4655b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x62c
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x624], eax
mov eax, dword [esp + 0x634]
push ebx
push ebp
mov ebp, dword [esp + 0x638]
xor ebx, ebx
mov eax, dword [eax + 8]
push esi
mov esi, ecx
mov dword [esp + 0x14], eax
push edi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
cmp dword [esi + 0x11c], ebx
je 0x465765
nop word [eax + eax]
mov eax, dword [esi + 0x120]
mov dword [esp + 0x20], 0
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test edi, edi
je 0x465630
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
inc eax
push ecx
push 0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x134]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x46581d
test eax, eax
je 0x4657ef
lea eax, [esp + 0x128]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x465692
test edi, edi
je 0x465600
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x465600
mov dword [esp + 0x10], 0
nop word [eax + eax]
push 0x400
lea eax, [esp + 0x234]
push eax
push ebp
call fcn.004011f0
mov esi, eax
push esi
push ebp
call fcn.004026d0
add esp, 0x14
test eax, eax
jne 0x465723
lea edi, [ebx + esi]
cmp edi, 0x27ff
jg 0x46579b
push esi
lea eax, [esp + 0x234]
push eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x11c]
add eax, ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push ebp
mov ebx, edi
call fcn.004011d0
add esp, 0x10
test eax, eax
jne 0x4656a0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x128], 0
mov dword [esp + 0x20], 0
mov eax, dword [eax + 0x11c]
mov byte [eax + ebx], 0
test ebx, ebx
je 0x465780
jmp 0x46574a
cmp eax, 6
je 0x4656fc
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
cmp eax, 2
je 0x465600
cmp eax, 3
jne 0x4657c9
lea edi, [eax - 2]
jmp 0x465600
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x62c
ret 8
push 0x19a
lea ecx, [esp + 0x18]
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x190
lea ecx, [esp + 0x14]
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x198
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x24], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19e
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x24], edi
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x192
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x24], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x6d
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x24], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x465ae0
Capabilities:
Get socket status
Print debug messages

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 0x234]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
push edi
xor edi, edi
mov ecx, dword [ebp + 0x118]
mov esi, ecx
mov dword [esp + 0x14], edi
lea ebx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x465b20
mov eax, dword [edx + 4]
sub esi, ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
test ecx, ecx
je 0x465c82
test esi, esi
jle 0x465c35
nop word [eax + eax]
mov eax, dword [ebp + 0x120]
mov dword [esp + 0x20], 0
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test ebx, ebx
je 0x465b80
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
inc eax
push ecx
push 0
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x465c57
test eax, eax
je 0x465cc3
lea eax, [esp + 0x128]
push eax
push dword [ebp + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x465bde
test ebx, ebx
je 0x465c27
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x465c27
mov eax, dword [ebp + 0x118]
xor ebx, ebx
push esi
add eax, edi
push eax
push dword [esp + 0x18]
call fcn.00401290
mov edi, eax
push edi
push dword [esp + 0x20]
call fcn.004026d0
add esp, 0x14
sub eax, ebx
je 0x465c1d
sub eax, 2
je 0x465c16
sub eax, 1
jne 0x465c9d
jmp 0x465c23
mov ebx, 1
jmp 0x465c23
sub esi, edi
add dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x465b50
mov ecx, dword [ebp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x22c
ret 8
push 0x6d
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x24], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19b
lea ecx, [esp + 0x14]
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19e
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x12c], ebx
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x192
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x24], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x465d00
Capabilities:
Get socket status

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x465e48
push eax
call fcn.00401df0
add esp, 4
mov dword [esi + 0x170], eax
test eax, eax
je 0x465e63
push dword [esi + 0x120]
push eax
call fcn.00401170
push 0
push 4
push 0x21
push dword [esi + 0x170]
call fcn.00402290
mov ebp, dword [sym.imp.WS2_32.dll_select]
add esp, 0x18
xor edi, edi
mov dword [esp + 0x18], 0xb4
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x128], 0
test edi, edi
je 0x465d9e
mov eax, dword [esi + 0x120]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
test ebx, ebx
je 0x465dba
mov eax, dword [esi + 0x120]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test edi, edi
jne 0x465dc2
test ebx, ebx
je 0x465df4
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
push ebx
lea eax, [esp + 0x28]
xor edi, edi
push eax
lea eax, [esp + 0x134]
push eax
mov eax, dword [esi + 0x120]
inc eax
push eax
call ebp
cmp eax, 0xffffffff
je 0x465ed2
test eax, eax
je 0x465eac
push dword [esi + 0x170]
call fcn.004027f0
push eax
push dword [esi + 0x170]
call fcn.004026d0
add esp, 0xc
sub eax, 0
je 0x465e2f
sub eax, 2
je 0x465e25
sub eax, 1
jne 0x465e7e
lea edi, [eax + 1]
jmp 0x465d75
mov ebx, 1
jmp 0x465d75
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x22c
ret
push 0x19e
lea ecx, [esp + 0x18]
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19e
lea ecx, [esp + 0x18]
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19e
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
mov dword [esp + 0x12c], 0
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x192
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x12c], ebx
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x6d
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x12c], ebx
call fcn.004602d0
push 0x4b4ec8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x468570
Capabilities:
Get file version info

Disassembly:
sub esp, 0x218
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push edi
mov ebp, edx
mov ebx, ecx
call dword [sym.imp.mfc140u.dll_AfxGetModuleState]
push 0x208
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x468648
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x468648
push esi
push edi
call dword [sym.imp.mfc140u.dll_operator]
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push esi
push edi
push dword [esp + 0x18]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x46863a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4ac2a4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x46863a
mov ecx, dword [esp + 0x14]
push esi
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp], eax
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
mov eax, 1
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00475a12
add esp, 0x218
ret
push esi
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
xor eax, eax
jmp 0x468621
mov ecx, dword [esp + 0x220]
xor eax, eax
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x218
ret

Function at 0x4686e0
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x208
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x21c]
lea eax, [esp + 0x10]
push edi
push 0x200
push 0
push eax
mov edi, edx
mov dword [esp + 0x1c], 0
mov ebp, ecx
call sub.VCRUNTIME140.dll_memset
push 0x400
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x18
mov dword [esi], 0
nop dword [eax + eax]
lea eax, [esp + 0x10]
push eax
push 0x200
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46879c
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4687a4
mov edx, dword [esi]
lea eax, [edx + ecx]
cmp eax, 0x400
ja 0x468798
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [edx + edi]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
add dword [esi], eax
test eax, eax
je 0x4687a4
push 0xffffffffffffffff
push edi
call ebx
add esp, 8
test eax, eax
je 0x468740
jmp 0x4687a4
xor al, al
jmp 0x4687b1
mov dword [esp + 0x10], 0
push 0xffffffffffffffff
push edi
call ebx
add esp, 8
test eax, eax
sete al
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x208
ret

Function at 0x469fe0
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x46a430
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call dword [sym.imp.mfc140u.dll_CMFCPropertyPage::OnInitDialog]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [ebx + 0x328]
push str.Download_and_Convert_
call edi
push str.Also_Download_Video_
lea ecx, [ebx + 0x3a8]
call edi
push str.Compatible_with_TV_IPhone
lea ecx, [ebx + 0x428]
call edi
push str.Click_Here_To_Get_Pro_Version_
lea ecx, [ebx + 0x630]
call edi
mov ebp, dword [sym.imp.mfc140u.dll_CWnd::GetDlgItem]
mov ecx, ebx
push 0x420
call ebp
push str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
mov ecx, eax
call edi
push 1
push 0
lea ecx, [ebx + 0x1d8]
mov dword [ebx + 0xdc8], 0xff0000
call dword [sym.imp.mfc140u.dll_CMFCEditBrowseCtrl::EnableFolderBrowseButton]
push dword [0x4ee04c]
lea ecx, [ebx + 0x1d8]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [0x4ee064]
push 0xf1
push dword [ebx + 0x3c8]
call esi
push 0
push dword [0x4ee06c]
push 0xf1
push dword [ebx + 0x448]
call esi
push 0
lea ecx, [ebx + 0x5a8]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 0x640000
push 0
push 0x401
push dword [ebx + 0x548]
call esi
cmp dword [0x4ee068], 1
mov ecx, ebx
je 0x46a52e
call 0x46a730
jmp 0x46a533
call 0x46a630
lea ecx, [ebx + 0x158]
call dword [sym.imp.mfc140u.dll_CWnd::SetFocus]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x14]
mov ecx, 0x4ca0e8
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x3fd
mov ecx, ebx
call ebp
test eax, eax
je 0x46a58b
mov eax, dword [eax + 0x20]
mov esi, dword [sym.imp.UxTheme.dll_SetWindowTheme]
push 0x4aae40
push 0x4aae40
push eax
call esi
push 0x3fe
mov ecx, ebx
call ebp
test eax, eax
je 0x46a5ae
mov eax, dword [eax + 0x20]
push 0x4aae40
push 0x4aae40
push eax
call esi
push 0x43b
mov ecx, ebx
call ebp
test eax, eax
je 0x46a5cb
mov eax, dword [eax + 0x20]
push 0x4aae40
push 0x4aae40
push eax
call esi
push 0x3fb
mov ecx, ebx
call ebp
test eax, eax
je 0x46a5e8
mov eax, dword [eax + 0x20]
push 0x4aae40
push 0x4aae40
push eax
call esi
push 0x43e
mov ecx, ebx
call ebp
test eax, eax
je 0x46a605
mov eax, dword [eax + 0x20]
push 0x4aae40
push 0x4aae40
push eax
call esi
mov ecx, dword [esp + 0x21c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x210
ret
Function at 0x470550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
mov dword [esp + 0x10], 3
push eax
push 0x20019
push 0
push dword [ecx + 0xc]
mov dword [esp + 0x1c], 4
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x470597
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
pop esi
add esp, 0x10
ret 8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x28]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
test eax, eax
push dword [esp + 8]
cmovne ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 4]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
pop esi
add esp, 0x10
ret 8

Function at 0x4728b0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x98
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0x4ca0cc], 0
je 0x4728ed
xor eax, eax
cmp dword [0x4ca0d0], eax
setne al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00475a12
add esp, 0x98
ret
push esi
push edi
push 0x90
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0x18], 2
push str.USER32
sete al
mov dword [0x4ca0c4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4729ce
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4afccc
push esi
call edi
mov dword [0x4ca0e0], eax
test eax, eax
je 0x4729ce
push str.MonitorFromWindow
push esi
call edi
mov dword [0x4ca0e4], eax
test eax, eax
je 0x4729ce
push str.MonitorFromRect
push esi
call edi
mov dword [0x4ca0d8], eax
test eax, eax
je 0x4729ce
push str.MonitorFromPoint
push esi
call edi
mov dword [0x4ca0dc], eax
test eax, eax
je 0x4729ce
push str.EnumDisplayMonitors
push esi
call edi
mov dword [0x4ca0d4], eax
test eax, eax
je 0x4729ce
push str.EnumDisplayDevicesW
push esi
call edi
mov dword [0x4ca0c8], eax
test eax, eax
je 0x4729ce
cmp dword [0x4ca0c4], 0
je 0x4729b6
push str.GetMonitorInfoW
jmp 0x4729bb
push str.GetMonitorInfoA
push esi
call edi
mov dword [0x4ca0d0], eax
test eax, eax
je 0x4729ce
mov eax, 1
jmp 0x472a16
mov dword [0x4ca0e0], 0
xor eax, eax
mov dword [0x4ca0e4], 0
mov dword [0x4ca0d8], 0
mov dword [0x4ca0dc], 0
mov dword [0x4ca0d0], 0
mov dword [0x4ca0d4], 0
mov dword [0x4ca0c8], 0
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
mov dword [0x4ca0cc], 1
call fcn.00475a12
add esp, 0x98
ret
Function at 0x478340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483d34
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b8014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
test eax, eax
js 0x478435
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push eax
push 1
call sub.mfc140u.dll_CListCtrl::InsertItem
mov edi, eax
test edi, edi
js 0x478438
mov ecx, ebx
call fcn.00477f90
mov esi, eax
xor ecx, ecx
mov edx, 0x4c
mov dword [ebp + 8], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.mfc140u.dll_operator
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4783ea
push 0x476c80
push 0x476af0
push dword [ebp + 8]
mov dword [eax], esi
lea esi, [eax + 4]
push 0x4c
push esi
call fcn.00475ecc
jmp 0x4783ec
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x478435
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
push 4
push 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0xc], 0xffffffff
call sub.mfc140u.dll_CListCtrl::SetItem
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10