joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454850
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x454920
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x454871
cmp al, 0x6b
jne 0x454920
cmp al, 0x6b
lea edx, [ecx + 1]
jne 0x4548e1
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x454895
mov al, byte [edx]
add edx, 1
cmp al, 0xba
je 0x454895
cmp al, 0xbb
jne 0x4548be
add ecx, 1
cmp ecx, esi
jl 0x454881
sub esi, ecx
test ecx, ecx
jne 0x4548e4
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0041b7b0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0041b7b0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x45490d
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0041b7b0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0041b7b0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x460ca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x460cb9
mov edi, ebx
mov ebx, eax
jmp 0x460cbb
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x460cd1
push eax
push esi
call fcn.00426860
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x460cef
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x460cd8
cmp eax, dword [edi + 4]
jge 0x460d06
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x460cf4
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x460d31
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
lea esp, [esp]
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x460d31
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x460d20
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x464d20
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.00465b80
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x464d3a
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x464dbc
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x464d88
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.0041c8d0
add esp, 8
test eax, eax
jne 0x464da9
push edi
mov edi, 0x4a9568
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x464d88
push ebx
call sub.MSVCR90.dll_getenv
add esp, 4
test eax, eax
jne 0x464dac
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.0041c8d0
add esp, 8
test eax, eax
je 0x464db3
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebx
call sub.MSVCR90.dll_getenv
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x466170
Capabilities:
Create process on windows
Create process suspended
Move file
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483426
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4b6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
push 0x44
push 0
lea eax, [ebp - 0x68]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov ecx, dword [ebp - 0x3c]
or ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, 1
mov word [ebp - 0x38], dx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
push 1
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [0x4c8aec]
mov dword [ebp - 0x70], eax
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_2692]
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x70]
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x78]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x46622d
push 1
call dword [sym.imp.MSVCR90.dll_exit]
jmp 0x46623c
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46a200
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 4]
push edx
push 0x20006
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a250
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0xc]
jmp 0x46a2a8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 4
lea ecx, [ebp + 0xc]
push ecx
push 3
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46a279
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 8], 0
jne 0x46a28c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x46a2c0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 4]
push edx
push 0x20006
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a319
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0xc]
jmp 0x46a38e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 1
push 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46a356
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x24]
cmp dword [edx + 8], 0
jne 0x46a369
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x46a3a0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 4]
push edx
push 0x20006
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a3f0
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0xc]
jmp 0x46a448
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 4
lea ecx, [ebp + 0xc]
push ecx
push 3
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46a419
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 8], 0
jne 0x46a42c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x46a460
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 3
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a4b6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x14]
jmp 0x46a4fe
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x46a4e2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x46a510
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 3
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a566
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x14]
jmp 0x46a5ae
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x46a592
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x46a5c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46a609
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0xc]
jmp 0x46a660
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x46a64d
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10]
jmp 0x46a660
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x46a830
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 8]
push edx
push 1
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0
je 0x46a87f
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0xc]
jmp 0x46a8e2
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x46a8cf
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10]
jmp 0x46a8e2
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x46e670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x46e6a2
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x46e6a2
mov dword [ebp - 0x10], 1
jmp 0x46e6a9
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 5], al
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x46e6d0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483698
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4b6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x5f0
call sub.mfc90.dll_Ordinal_4116
push 5
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46e9c0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp - 0x11c]
call dword [sym.imp.BCGCBPRO120090.dll_protected_virtual:_int___thiscall_CBCGPPropertyPage::OnInitDialog_void_]
push str.Download_and_Convert_
mov ecx, dword [ebp - 0x11c]
add ecx, 0xf40
call sub.mfc90.dll_Ordinal_6559
push str.Also_Download_Video_
mov ecx, dword [ebp - 0x11c]
add ecx, 0x16a8
call sub.mfc90.dll_Ordinal_6559
push str.Click_Here_To_Get_Pro_Version_
mov ecx, dword [ebp - 0x11c]
add ecx, 0x2650
call sub.mfc90.dll_Ordinal_6559
push str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
push 0x420
mov ecx, dword [ebp - 0x11c]
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_6559
mov eax, dword [ebp - 0x11c]
mov dword [eax + 0x2da0], 0xff0000
mov ecx, dword [ebp - 0x11c]
add ecx, 0x5f0
call dword [sym.imp.BCGCBPRO120090.dll_public:_void___thiscall_CBCGPEdit::EnableFolderBrowseButton_void_]
mov ecx, dword [0x4c8be8]
push ecx
mov ecx, dword [ebp - 0x11c]
add ecx, 0x5f0
call sub.mfc90.dll_Ordinal_6559
mov edx, dword [0x4c8bf4]
mov dword [ebp - 0x118], edx
push 0
mov eax, dword [ebp - 0x118]
push eax
push 0xf1
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x16c8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ecx, dword [ebp - 0x11c]
add ecx, 0x1ed0
call sub.mfc90.dll_Ordinal_2360
xor eax, eax
movsx ecx, ax
and ecx, 0xffff
movzx edx, cx
mov eax, 0x64
movsx ecx, ax
and ecx, 0xffff
movzx eax, cx
shl eax, 0x10
or edx, eax
push edx
push 0
push 0x401
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x1e94]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4c8bf8], 1
je 0x46eb14
mov ecx, dword [ebp - 0x11c]
call fcn.0046e760
jmp 0x46eb1f
mov ecx, dword [ebp - 0x11c]
call fcn.0046e890
mov ecx, dword [ebp - 0x11c]
add ecx, 0x408
call sub.mfc90.dll_Ordinal_6291
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x110]
push ecx
mov ecx, 0x4c7b84
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0
push 1
mov ecx, dword [ebp - 0x11c]
call dword [sym.imp.BCGCBPRO120090.dll_public:_void___thiscall_CBCGPPropertyPage::EnableVisualManagerStyle_int__class_CList_unsigned_int__unsigned_int__const__]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret
Function at 0x46f390
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x46f3b5
xor eax, eax
jmp 0x46f4a6
mov edx, dword [ebp - 0x24]
push edx
call sub.mfc90.dll_Ordinal_265
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x46f3fc
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
xor eax, eax
jmp 0x46f4a6
mov dword [ebp - 0x24], 0x34
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
push 0x4aa438
mov eax, dword [ebp - 0x20]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x46f433
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call sub.mfc90.dll_Ordinal_266
add esp, 4
xor eax, eax
jmp 0x46f4a6
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
and eax, 0xffff
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
mov dword [ebp - 4], edx
push 0xffffffffffffffff
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.004014a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x46fa80
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48502a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.196BB40D_1578_3D01_B289_BEFC77A11A1E
call sub.msi.dll_MsiRecordGetInteger
cmp eax, 5
je 0x46fc1f
push str.DA5E371C_6333_3D8A_93A4_6FD5B20BCC6E
call sub.msi.dll_MsiRecordGetInteger
cmp eax, 5
je 0x46fc1f
push str.F0C3E5D1_1ADE_321E_8167_68EF0DE699A5
call sub.msi.dll_MsiRecordGetInteger
cmp eax, 5
je 0x46fc1f
push str.1D8E6291_B0D5_35EC_8441_6616F567A0F7
call sub.msi.dll_MsiRecordGetInteger
cmp eax, 5
je 0x46fc1f
push str._vcredist_x86.exe
push 0x4c8aec
lea eax, [ebp - 0x10]
push eax
call fcn.00401660
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x46fc01
mov eax, dword [0x4c7b14]
mov dword [0x4c8a70], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Upgrading_library
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [0x4c8c00]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Please_wait.
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Upgrading_Microsoft_runtime_library_for_the_first_running..
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 4
push str._download_updates_vcredist_x86.exe
push 0x4c8bfc
lea ecx, [ebp - 0x24]
push ecx
call fcn.00401660
add esp, 0xc
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x30], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
mov byte [ebp - 4], 6
mov ecx, 0x4c8a68
call fcn.00469360
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x28]
jmp 0x46fc24
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret