joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49eb10
Capabilities:
Get disk size

Disassembly:
sub esp, 0x640
push esi
mov esi, dword [esp + 0x648]
push 0x104
lea eax, [esp + 0x38]
push eax
push esi
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
neg eax
sbb eax, eax
neg eax
mov dword [esp + 8], eax
je 0x49eca6
mov eax, dword [0x610be8]
test eax, eax
je 0x49eb8b
mov eax, dword [0x622110]
test eax, eax
jne 0x49ec2b
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49eb74
push 0x5e90c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x622110], eax
mov eax, dword [0x622110]
test eax, eax
jne 0x49ec2b
mov dword [0x610be8], 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x49eca6
mov eax, dword [esp + 0x18]
fild dword [esp + 0x18]
test eax, eax
jge 0x49ebc4
fadd qword [0x5d55f0]
mov ecx, dword [esp + 0x14]
fild dword [esp + 0x14]
test ecx, ecx
jge 0x49ebd6
fadd qword [0x5d55f0]
mov edx, dword [esp + 0x10]
fmulp st(1)
test edx, edx
fild dword [esp + 0x10]
jge 0x49ebea
fadd qword [0x5d55f0]
mov eax, dword [esp + 0x64c]
fmulp st(1)
test eax, eax
je 0x49ec09
mov dword [esp + 4], eax
fild dword [esp + 4]
jge 0x49ec07
fadd qword [0x5d55f0]
fdivp st(1)
fcom qword [0x5e90c0]
fnstsw ax
test ah, 0x41
jne 0x49ecd2
fstp st(0)
mov eax, 0xffffffff
pop esi
add esp, 0x640
ret 8
push 0
push 0
lea ecx, [esp + 0x244]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
call dword [0x5d24f4]
push 0
push 0
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x460]
push edx
call dword [0x5d25c8]
add esp, 0x28
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x448]
push eax
call dword [0x622110]
test eax, eax
je 0x49eca6
mov eax, dword [esp + 0x64c]
fild qword [esp + 0x1c]
test eax, eax
je 0x49ec09
mov dword [esp + 8], eax
fild dword [esp + 8]
jmp 0x49ebff
mov eax, 0x5c
cmp word [esp + 0x34], ax
jne 0x49ecc6
cmp word [esp + 0x36], ax
jne 0x49ecc6
or eax, 0xffffffff
pop esi
add esp, 0x640
ret 8
xor eax, eax
pop esi
add esp, 0x640
ret 8
call fcn.005c4484
pop esi
add esp, 0x640
ret 8
Function at 0x49ecf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
push ebp
push esi
mov esi, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0x10]
push eax
push esi
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
mov ebp, eax
cmp ebp, 3
mov dword [esp + 8], ebp
jl 0x49edf1
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49edf1
test al, 0x10
je 0x49edf1
push ebx
mov eax, 1
lea edx, [esi + ebp*2]
push edi
cmp word [edx], 0
mov edi, edx
je 0x49ed67
lea esp, [esp]
mov cx, word [edi]
cmp cx, 0x5c
je 0x49ed67
test cx, cx
je 0x49ed61
add edi, 2
cmp word [edi], 0
jne 0x49ed50
mov esi, edi
sub esi, edx
shr esi, 1
cmp esi, 1
jl 0x49ede4
lea ebx, [esi + 1]
test ebx, ebx
lea ebp, [esp + ebp*2 + 0x14]
jle 0x49ed90
push ebx
push edx
push ebp
call dword [0x5d2618]
add esp, 0xc
mov word [ebp + ebx*2 - 2], 0
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
add ebx, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49edb1
test al, 0x10
je 0x49edb1
mov eax, 1
jmp 0x49edc8
mov eax, dword [esp + 0x224]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x49ede4
cmp word [edi], 0x5c
jne 0x49ede4
mov word [esp + ebx*2 + 0x14], 0x5c
inc ebx
lea edx, [edi + 2]
mov dword [esp + 0x10], ebx
mov ebp, ebx
jmp 0x49ed44
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20c
ret 8
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret 8
Function at 0x49efc0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x664
mov eax, dword [esp + 0x668]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x21c]
push ecx
mov dword [esp + 0x14], 0
mov edi, 1
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x21c]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov eax, dword [esp + 0x678]
test eax, eax
je 0x49f017
push eax
lea eax, [esp + 0x21c]
push eax
jmp 0x49f024
push 0x5e8700
lea ecx, [esp + 0x21c]
push ecx
call dword [0x5d24cc]
add esp, 8
lea edx, [esp + 0x420]
push edx
lea eax, [esp + 0x21c]
push eax
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x49f18a
push ebp
mov ebp, dword [esp + 0x680]
jmp 0x49f060
test edi, edi
je 0x49f189
test ebx, ebx
je 0x49f189
mov edi, dword [0x5d24c4]
lea ecx, [esp + 0x450]
push 0x5d8fd8
push ecx
call edi
add esp, 8
test eax, eax
je 0x49f16f
lea edx, [esp + 0x450]
push 0x5e86f8
push edx
call edi
add esp, 8
test eax, eax
je 0x49f16f
mov eax, dword [esp + 0x678]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x18]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea eax, [esp + 0x450]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [0x5d24cc]
add esp, 8
test ebp, ebp
je 0x49f134
test byte [esp + 0x424], 0x10
je 0x49f134
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x67c]
push ebp
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0049efc0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x424]
mov ebx, eax
push edx
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
jmp 0x49f16f
push 0x80
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49f158
test al, 0x10
jne 0x49f16f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x49f16f
mov dword [esp + 0x10], 0x80004005
lea ecx, [esp + 0x424]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, 0xffffffff
mov edi, eax
jne 0x49f060
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x664
ret 0xc

Function at 0x49f1b0
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49f1ed
test al, 0x10
je 0x49f1ed
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
push esi
call fcn.0049efc0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x49f1f6
pop edi
mov eax, 0x80004005
pop esi
ret 0xc
mov eax, 0x8004e00d
pop esi
ret 0xc
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x49f200
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x460
push ebp
push esi
mov esi, dword [esp + 0x46c]
test esi, esi
mov ebp, 1
je 0x49f236
push esi
call dword [0x5d2620]
add esp, 4
cmp eax, 0x104
jb 0x49f236
pop esi
xor eax, eax
pop ebp
add esp, 0x460
ret 4
push edi
lea eax, [esp + 0xc]
push esi
push eax
call dword [0x5d2614]
add esp, 8
push 0x108
lea ecx, [esp + 0x10]
push ecx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea edx, [esp + 0xc]
push 0x5e8700
push edx
call dword [0x5d24cc]
add esp, 8
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x49f2dd
mov esi, dword [0x5d24c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
lea edx, [esp + 0x24c]
push 0x5d8fd8
push edx
call esi
add esp, 8
test eax, eax
je 0x49f2bc
lea eax, [esp + 0x24c]
push 0x5e86f8
push eax
call esi
add esp, 8
test eax, eax
jne 0x49f2da
lea ecx, [esp + 0x220]
push ecx
push edi
call ebx
test eax, eax
jne 0x49f290
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x460
ret 4
xor ebp, ebp
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x460
ret 4

Function at 0x49f5b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x49f5ff
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
push esi
mov dword [ecx], eax
mov dword [ecx + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov dword [eax + 4], edi
pop edi
mov eax, 0x8004e007
pop esi
add esp, 8
ret 8

Function at 0x49f640
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x418]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49f6bd
test al, 0x10
je 0x49f6bd
lea eax, [esp + 4]
push esi
push eax
call dword [0x5d2614]
add esp, 8
push 0x104
lea ecx, [esp + 8]
push ecx
call sym.vidcap60.exe__SfAddSlashToPathName_8
push 0x104
lea edx, [esp + 0x210]
push edx
push 0
push 0x5d49c0
push 0
lea eax, [esp + 0x18]
push eax
call sym.vidcap60.exe__SfCreateTempFileAndNameEx_24
test eax, eax
jne 0x49f6bd
lea ecx, [esp + 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
add esp, 0x410
ret 4
xor eax, eax
pop esi
add esp, 0x410
ret 4
Function at 0x4aa090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebp
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [esp + 0x80]
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 8]
cmp eax, dword [esi + 0x34]
jge 0x4aa0c2
xor ebp, ebp
jmp 0x4aa0cf
mov edx, dword [esi + 0x3c]
xor ecx, ecx
cmp eax, edx
setge cl
inc ecx
mov ebp, ecx
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x38]
jge 0x4aa0dc
xor eax, eax
jmp 0x4aa0e9
mov ecx, dword [esi + 0x40]
xor edx, edx
cmp eax, ecx
setge dl
inc edx
mov eax, edx
mov ecx, 0x29
push ebx
mov ebx, 0x27
push edi
mov edi, 0x2a
mov dword [esp + 0x34], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov ecx, 0x30
mov dword [esp + 0x1c], ebx
mov edx, 0x28
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov ebx, 0x2f
mov dword [esp + 0x40], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x58], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x54], edi
pop edi
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x14], 0x2d
mov dword [esp + 0x1c], 0x2b
mov dword [esp + 0x24], 0x31
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0x2e
mov dword [esp + 0x34], 0x2c
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x58], edx
pop ebx
je 0x4aa1b8
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4aa1a8
lea ecx, [ebp + eax*2]
add ecx, eax
mov eax, dword [esp + ecx*4 + 0x10]
jmp 0x4aa1d5
test ecx, ecx
je 0x4aa1b8
lea edx, [ebp + eax*2]
add edx, eax
mov eax, dword [esp + edx*4 + 0x34]
jmp 0x4aa1d5
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4aa1cb
lea ecx, [ebp + eax*2]
add ecx, eax
mov eax, dword [esp + ecx*4 + 0x58]
jmp 0x4aa1d5
lea edx, [ebp + eax*2]
add edx, eax
mov eax, dword [esp + edx*4 + 0x10]
movzx eax, ax
push eax
push 0
call sym.vidcap60.exe__SfLoadCursor_8
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebp
add esp, 0x74
ret 4
Function at 0x4aa6a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4aa802
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
cmp esi, 0x23e7
push edi
jne 0x4aa767
mov eax, dword [esp + 0x18]
push 0xfffffffffffffff0
push eax
xor edi, edi
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_GetScrollRange]
mov ebx, eax
test ebx, 0x200000
je 0x4aa704
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
push eax
call esi
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x10]
je 0x4aa704
mov edi, 1
test ebx, 0x100000
je 0x4aa743
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x10]
je 0x4aa743
test edi, edi
mov ebp, 1
je 0x4aa756
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4aa743
xor edi, edi
jmp 0x4aa756
test edi, edi
je 0x4aa74e
mov esi, 2
jmp 0x4aa75b
test ebp, ebp
je 0x4aa7fe
mov esi, 1
test edi, edi
jne 0x4aa767
test ebp, ebp
je 0x4aa7fe
mov eax, dword [esp + 0x24]
cmp eax, 0x23e7
jne 0x4aa80c
mov edi, dword [esp + 0x18]
cmp dword [0x62213c], edi
jne 0x4aa78b
mov eax, dword [0x622138]
test eax, eax
jne 0x4aa7b5
push 0
push 0x622138
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [0x622138]
test eax, eax
jne 0x4aa7af
mov eax, 3
mov dword [0x622138], eax
mov dword [0x62213c], edi
mov edi, 1
cmp esi, edi
jne 0x4aa806
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x20]
xor ebx, ebx
cmp eax, edi
setne bl
mov eax, dword [esp + 0x24]
test eax, eax
jle 0x4aa7fe
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp esi, edi
setne cl
mov esi, eax
add ecx, 0x114
mov edi, ecx
lea esp, [esp]
mov edx, dword [esp + 0x18]
push 0
push ebx
push edi
push edx
call ebp
dec esi
jne 0x4aa7f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov dword [esp + 0x24], eax
jmp 0x4aa81e
cmp eax, 5
mov edi, 1
jbe 0x4aa81e
mov dword [esp + 0x24], 5
cmp esi, 2
jne 0x4aa7c2
cmp dword [esp + 0x24], 0xffffffff
jne 0x4aa7c2
mov ecx, dword [esp + 0x20]
xor ebx, ebx
cmp ecx, edi
setne bl
mov dword [esp + 0x24], edi
add ebx, esi
jmp 0x4aa7cd
Function at 0x4ab970
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push edi
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.USER32.dll_IsWindow]
xor ebp, ebp
test eax, eax
jne 0x4ab996
mov dword [esp + 0x10], ebp
cmp dword [esi + 4], ebp
jne 0x4ab9a4
mov dword [esp + 0x10], ebp
jmp 0x4aba37
cmp dword [esp + 0x10], ebp
je 0x4aba37
cmp dword [esi + 0x18], ebp
je 0x4aba37
mov eax, dword [esi]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [sym.imp.USER32.dll_GetScrollRange]
mov edi, eax
test edi, 0x200000
je 0x4ab9f4
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
push eax
call ebx
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
je 0x4ab9f4
mov dword [esi + 0x14], 1
test edi, 0x100000
je 0x4aba1d
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
call ebx
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x14]
je 0x4aba1d
mov dword [esi + 0x10], 1
cmp dword [esi + 0x10], ebp
je 0x4aba3c
cmp dword [esi + 0x14], ebp
je 0x4aba37
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4aba37
mov dword [esi + 0x14], ebp
cmp dword [esi + 0x10], ebp
jne 0x4aba45
cmp dword [esi + 0x14], ebp
jne 0x4aba45
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x1c]
mov edi, 0x23e7
cmp eax, edi
jne 0x4aba58
mov dword [esi + 0x1c], 0x10
cmp dword [esi + 0x20], edi
jne 0x4aba64
mov dword [esi + 0x20], 0x4b
cmp dword [esi + 0x24], edi
jne 0x4aba70
mov dword [esi + 0x24], 0x19
cmp dword [esi + 0x28], edi
jne 0x4aba7c
mov dword [esi + 0x28], 3
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
mov edx, ecx
sub edx, eax
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0xc]
mov ebx, edx
sub ebx, eax
mov dword [esi + 0x38], ebx
mov ebx, dword [esp + 0x10]
add ecx, eax
add edx, eax
cmp ebx, ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
je 0x4abae1
cmp dword [esi + 0x18], ebp
je 0x4abae1
push 1
push esi
call sym.vidcap60.exe__SfWheel_AutoScrollOriginIcon_8
push esi
call sym.vidcap60.exe__SfWheel_AutoScrollSetCursor_4
mov eax, dword [esi + 0x58]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x58]
push ebp
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 4
Function at 0x4af310
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x45c
mov eax, dword [esp + 0x460]
push ebp
push eax
lea ecx, [esp + 0x25c]
push ecx
call dword [0x5d2614]
lea edx, [esp + 0x260]
push str..
push edx
call dword [0x5d24cc]
add esp, 0x10
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
xor eax, eax
cmp ebp, 0xffffffff
mov dword [esp + 4], eax
je 0x4af3bf
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
push edi
lea esp, [esp]
test byte [esp + 0x14], 0x10
je 0x4af39b
lea eax, [esp + 0x40]
mov ecx, dword [eax]
mov edx, 0x5d8fd8
cmp ecx, dword [edx]
je 0x4af39b
mov ecx, 3
mov edi, 0x5e86f8
lea esi, [esp + 0x40]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x4af3a9
lea eax, [esp + 0x14]
push eax
push ebp
call ebx
test eax, eax
jne 0x4af370
jmp 0x4af3b1
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x45c
ret 4

Function at 0x4af5e0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
push ebx
mov ebx, dword [esp + 0x2c8]
push ebp
mov ebp, dword [esp + 0x2c4]
push esi
mov esi, dword [esp + 0x2cc]
push edi
push ebx
push 0x2b4
push esi
lea eax, [esi + 0xc]
push 0
push ebp
mov edi, ecx
mov dword [esi + 4], 0
mov dword [esp + 0x24], eax
mov word [eax], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test bl, 2
je 0x4af661
mov eax, dword [esi + 4]
test eax, eax
je 0x4af659
push 0x4001
push 0x2b4
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 4]
jl 0x4af654
add eax, 0xe
mov dword [esi + 4], eax
jmp 0x4af671
mov ecx, dword [edi + 0x18]
mov dword [esi + 4], ecx
jmp 0x4af671
mov eax, dword [esi + 4]
test eax, eax
jne 0x4af64c
mov edx, dword [edi + 4]
add edx, 0xb
mov dword [esi + 4], edx
mov eax, dword [esp + 0x10]
cmp word [eax], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x4af69f
test eax, eax
jne 0x4af68c
add esp, 0x2b8
ret 0xc
push eax
call dword [0x5d2620]
add esp, 4
add esp, 0x2b8
ret 0xc
xor ax, ax
add esp, 0x2b8
ret 0xc

Function at 0x4af6b0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x600
push 0x2b4
push esi
push 0
lea edi, [esi + 0xc]
push eax
mov dword [esi + 4], 0
mov word [edi], 0
mov word [esi + 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test edi, edi
mov dword [esi + 4], 0xffffffff
jne 0x4af6f8
pop edi
xor eax, eax
pop esi
ret 0xc
push edi
call dword [0x5d2620]
add esp, 4
pop edi
pop esi
ret 0xc
Function at 0x4b05f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x618
push esi
push edi
add eax, 2
lea esi, [esp + 8]
push eax
mov ecx, esi
push ecx
mov edi, 1
call dword [0x5d2614]
add esp, 8
cmp word [esp + 8], 0
je 0x4b063e
lea esp, [esp]
mov ax, word [esi]
cmp ax, 0x2a
je 0x4b0639
test ax, ax
je 0x4b0631
add esi, 2
cmp word [esi], 0
jne 0x4b0620
jmp 0x4b063e
mov word [esi], 0
mov ax, word [esp + 0xa]
cmp ax, 0x3a
je 0x4b0664
cmp ax, 0x5c
jne 0x4b06f2
lea eax, [esp + 0xc]
call fcn.004b05a0
test eax, eax
jne 0x4b06f2
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x4b06e5
mov eax, dword [0x621c80]
lea edx, [esp + 8]
push edx
push 0xbcd7
push eax
call sym.vidcap60.exe__SfGetString_8
push eax
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x621c80]
add esp, 0xc
push 0x124
push 0xbcd0
push edx
call sym.vidcap60.exe__SfGetString_8
mov ecx, dword [esp + 0x628]
push eax
lea eax, [esp + 0x218]
push eax
push ecx
call sym.vidcap60.exe__SfMessageBox_16
cmp eax, 6
jne 0x4b06e5
pop edi
mov eax, 1
pop esi
add esp, 0x618
ret 4
pop edi
mov eax, esi
pop esi
add esp, 0x618
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x618
ret 4
Function at 0x4b4580
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x628
mov ecx, dword [0x621c80]
push esi
push 4
lea eax, [esp + 0x10]
push eax
push ecx
xor esi, esi
mov dword [esp + 0x14], 0x104
call sym.vidcap60.exe__SfLang_GetLangAbbrev_12
push str.Shared_Information
push str.SoftwareSony_Creative_Software
lea edx, [esp + 0x224]
push 0x5e8684
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 4]
push eax
push 0x20019
push esi
lea ecx, [esp + 0x228]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push esi
push str.HelpFolder
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b4727
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b4727
test al, 0x10
je 0x4b4727
lea eax, [esp + 0x14]
test eax, eax
je 0x4b4638
lea ecx, [esp + 0x14]
push ecx
call dword [0x5d2620]
add esp, 4
push ebx
mov ebx, dword [esp + 0x640]
mov esi, ebx
sub esi, eax
test esi, esi
push edi
mov edi, dword [esp + 0x640]
jle 0x4b4667
push esi
lea edx, [esp + 0x20]
push edx
push edi
call dword [0x5d2618]
add esp, 0xc
mov word [edi + esi*2 - 2], 0
push ebx
push edi
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov esi, dword [esp + 0x648]
test esi, esi
je 0x4b468e
push edi
call sym.vidcap60.exe__SfGetFileNameExtensionPtrW_4
mov ecx, eax
sub ecx, edi
sar ecx, 1
mov edx, ebx
sub edx, ecx
push edx
push esi
push eax
jmp 0x4b46c6
mov ecx, dword [esp + 0x63c]
push ebx
lea eax, [esp + 0x430]
push eax
push ecx
call sym.vidcap60.exe__SfGetModuleFileName_12
push edi
call sym.vidcap60.exe__SfGetFileNamePtrW_4
mov esi, eax
mov edx, esi
sub edx, edi
sar edx, 1
mov eax, ebx
sub eax, edx
push eax
lea ecx, [esp + 0x430]
push ecx
call sym.vidcap60.exe__SfGetFileNamePtrW_4
push eax
push esi
call fcn.004049b0
push edi
call sym.vidcap60.exe__SfGetFileNameExtensionPtrW_4
mov edx, eax
sub edx, edi
sar edx, 1
mov ecx, ebx
sub ecx, edx
mov edx, dword [esp + 0x638]
sub edx, 0
je 0x4b46f2
dec edx
jne 0x4b46fe
push ecx
push str..chm
jmp 0x4b46f8
push ecx
push str..hlp
push eax
call fcn.004049b0
push 0x104
lea eax, [esp + 0x18]
lea esi, [esp + 0x20]
mov ecx, edi
call fcn.004b4400
test eax, eax
jbe 0x4b4720
push ebx
mov eax, esi
push eax
push edi
call fcn.004049b0
pop edi
mov esi, 1
pop ebx
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x628
ret 0x14
Function at 0x4b4f00
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [esp + 0x210]
lea ecx, [eax - 0x65]
cmp ecx, 4
ja case.default.0x4b4f25
jmp dword [ecx*4 + 0x4b4f74]
mov eax, str.http:__mediasoftware.sonypictures.com_productinfo.asp_PlaceNews
jmp case.default.0x4b4f25
mov eax, str.http:__mediasoftware.sonypictures.com_productinfo.asp_PlaceFAQ
jmp case.default.0x4b4f25
mov eax, str.http:__mediasoftware.sonypictures.com_productinfo.asp_PlaceSupport
jmp case.default.0x4b4f25
mov eax, str.http:__mediasoftware.sonypictures.com_productinfo.asp_PlaceHome
jmp case.default.0x4b4f25
mov eax, 0x5e90f0
push 0
lea ecx, [esp + 4]
push ecx
push 0
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x208
ret 8