joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cf00
Capabilities:
Clear file content
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
push eax
push ecx
push ebx
call sym.vidcap60.exe__SfFindResource_12
mov esi, eax
test esi, esi
jne 0x48cf26
pop esi
mov eax, 0x8004e00a
pop ebx
ret 0x10
push esi
push ebx
call sym.vidcap60.exe__SfLoadResource_8
test eax, eax
jne 0x48cf3b
pop esi
mov eax, 0x8000ffff
pop ebx
ret 0x10
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov edi, eax
call sym.vidcap60.exe__SfSizeofResource_8
test edi, edi
mov ebx, eax
je 0x48cfc7
test ebx, ebx
jbe 0x48cfc7
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x48cfbc
cmp esi, 0xffffffff
je 0x48cfbc
push ebp
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48cfa0
cmp dword [esp + 0x1c], ebx
je 0x48cfa5
mov ebp, 0x8004e009
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret 0x10
pop edi
pop esi
mov eax, 0x8004e007
pop ebx
ret 0x10
pop edi
pop esi
mov eax, 0x8000ffff
pop ebx
ret 0x10
Function at 0x48d560
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8300
push 0x5c43d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0x80004005
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jne 0x48d6a0
mov dword [esi + 0x18], ebx
lea eax, [ebp - 0x430]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edi, [esi + 0x224]
push 0x104
lea ecx, [ebp - 0x228]
push ecx
push edi
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esi + 0x434]
cmp eax, ebx
je 0x48d602
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0048d400
cmp eax, ebx
jl 0x48d602
cmp eax, 1
je 0x48d602
mov dword [esi + 0x438], 1
mov dword [ebp - 4], ebx
push 0x8000
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call ebx
mov dword [ebp - 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x14], eax
mov ecx, dword [ebp - 0x20]
push ecx
call ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x48d648
lea edx, [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48d687
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d680
lea ecx, [esi + 0x18]
push ecx
push 0x5f8f30
lea edx, [esi + 4]
push edx
call eax
mov dword [ebp - 0x1c], eax
jmp 0x48d687
mov dword [ebp - 0x1c], 0x80004002
mov eax, dword [ebp - 0x1c]
test eax, eax
jge 0x48d6a0
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov esi, dword [esi + 0x18]
test esi, esi
je 0x48d6ba
mov ecx, dword [esi]
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp + 0xc]
push eax
push 0
push esi
call dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x48e360
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
test eax, eax
je 0x48e435
test ecx, ecx
je 0x48e435
test edi, edi
je 0x48e435
push ecx
push eax
lea eax, [esp + 0x10]
push 0x5e8684
push eax
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call sym.vidcap60.exe__SfRegDeleteKey_8
lea edx, [esp]
push edx
lea eax, [esp + 0xc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x48e435
mov ecx, dword [0x621c80]
push esi
push ecx
call sym.vidcap60.exe__SfLang_GetLCID_4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push str.LangID
push eax
call esi
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x218]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.ModTime
push eax
mov dword [esp + 0x20], ecx
call esi
push edi
call dword [0x5d2620]
mov edx, dword [esp + 8]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push 0x5e86c4
push edx
call esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x210
ret 4
Function at 0x48eb40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x560
test edx, edx
push esi
push edi
mov esi, eax
je 0x48ebfe
cmp word [edx], 0
je 0x48ebfe
test esi, esi
je 0x48ebfe
xor eax, eax
mov ecx, 0x155
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, edx
lea edx, [esp + 0x10]
mov dword [esp + 0x560], 5
call fcn.0048d790
lea ecx, [esp + 8]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x48ebfe
push 4
lea edx, [esp + 0x10]
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push str.AppGrade
mov dword [esp + 0x20], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call esi
mov edx, dword [ebp + 8]
mov eax, dword [esp + 8]
xor ecx, ecx
push 4
test edx, edx
lea edx, [esp + 0x10]
push edx
push 4
sete cl
push 0
push str.AppMode
push eax
mov dword [esp + 0x24], ecx
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x48ebfe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x48ec10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x574
push ebx
push esi
xor esi, esi
cmp edx, esi
push edi
mov dword [esp + 0x1c], esi
je 0x48ed37
cmp word [edx], si
je 0x48ed37
cmp dword [ebp + 8], esi
je 0x48ed37
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, esi
sete bl
xor eax, eax
mov ecx, 0x155
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, edx
lea edx, [esp + 0x28]
mov dword [esp + 0x578], 5
call fcn.0048d790
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ed37
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.AppGrade
mov edi, 4
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x48ecd3
cmp dword [esp + 0x18], edi
jne 0x48ecd3
cmp dword [esp + 0x10], edi
jne 0x48ecd3
mov eax, dword [ebp + 8]
cmp eax, dword [esp + 0x24]
je 0x48ecdb
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.AppMode
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x48ed12
cmp dword [esp + 0x18], edi
jne 0x48ed12
cmp dword [esp + 0x10], edi
jne 0x48ed12
cmp ebx, dword [esp + 0x20]
je 0x48ed19
mov esi, 1
jmp 0x48ed1d
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48ed2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4905d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
mov dword [esp + 0x24], 0
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49060c
mov esi, 0x8004e007
jmp 0x4906b8
push edi
push 0x210
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x49062e
mov esi, 0x8007000e
jmp 0x490692
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x210
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x490692
cmp dword [esp + 0x10], 0x210
jne 0x490692
lea edx, [esp + 0xc]
push edx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
test esi, esi
jl 0x490692
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0
push 0x210
push edi
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jl 0x490692
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
push edx
push eax
call fcn.00490550
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4906b7
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [esp + 8]
test eax, eax
je 0x4906c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x494110
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xe8
push ebp
push esi
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebp, ebp
push ebp
push ecx
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4942c7
mov ecx, dword [esp + 0xc]
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
push ebp
push ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], 0x28
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4942c7
push ebx
push edi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebp
lea eax, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49428e
mov edx, dword [esp + 0xfc]
push 1
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00494060
test eax, eax
jne 0x494283
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x7c]
push edx
push ebp
push eax
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x494283
push 0x554
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp ebx, ebp
je 0x494283
xor eax, eax
mov ecx, 0x155
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x7c]
push ecx
lea esi, [ebx + 0x1c]
push esi
mov dword [ebx], 0x554
call dword [0x5d2618]
mov eax, dword [esp + 0x114]
mov edx, dword [esp + 0x10c]
add esp, 0xc
mov word [esi + 0x206], bp
mov esi, dword [esp + 0x104]
push eax
push esi
lea ecx, [esp + 0x30]
mov dword [ebx + 0x550], edx
mov edx, dword [esp + 0x24]
push ecx
push edx
call fcn.0048ddb0
test eax, eax
je 0x49427d
test dword [ebx + 0x448], esi
je 0x49427d
mov ecx, dword [esp + 0xfc]
push 1
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x34], ebx
call sym.vidcap60.exe__SfList_InsertList_16
inc dword [esp + 0x18]
jmp 0x494283
push ebx
call fcn.00493210
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
inc eax
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x30], 0x28
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x494173
mov esi, dword [esp + 0x18]
pop edi
pop ebx
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x4942d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 0xe8
ret 0x10
Function at 0x4953a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc1c
push esi
mov esi, dword [esp + 0xc24]
test esi, esi
jne 0x4953c1
mov eax, 0x80004003
pop esi
add esp, 0xc1c
ret 0xc
push ebp
push 0x104
lea eax, [esp + 0x220]
push eax
push esi
mov word [esp + 0x228], 0
call fcn.004952e0
mov ebp, eax
test ebp, ebp
jl 0x49554b
mov ecx, dword [esi]
push ebx
push edi
lea edx, [esp + 0x14]
push edx
push esi
call dword [ecx + 0x1c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
push 1
push 0x1a
lea edx, [esp + 0x434]
push edx
push 0
call sym.vidcap60.exe_int___stdcall_SfWtsGetSpecialFolderPath_struct_HWND_____unsigned_short_int___unsigned_long_int__int_
test eax, eax
mov ebx, dword [esp + 0xc38]
mov esi, dword [esp + 0xc34]
je 0x4954c8
lea eax, [esp + 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4954c8
test al, 0x10
je 0x4954c8
push 0x400
lea ecx, [esp + 0x430]
push ecx
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov edi, dword [0x5d24cc]
lea edx, [esp + 0x42c]
push str.SonyFile_Templates_
push edx
call edi
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x438]
push ecx
call edi
add esp, 0x10
push 0x400
lea edx, [esp + 0x430]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
push ebx
lea eax, [esp + 0x430]
push eax
push esi
call fcn.004049b0
lea ecx, [esp + 0x42c]
push ecx
push esi
call dword [0x5d24c4]
add esp, 8
test eax, eax
jne 0x4954c1
xor ebp, ebp
jmp 0x4954cc
mov ebp, 0x8004e03c
jmp 0x4954e1
test ebp, ebp
jne 0x4954e1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4954dc
test al, 0x10
jne 0x4954e1
mov ebp, 1
mov edx, dword [esp + 0x10]
push 0x100
push edx
lea eax, [esp + 0x2c]
push eax
call dword [0x5d2618]
mov edi, dword [0x5d2620]
lea ecx, [esp + 0x30]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x222], 0
je 0x495519
mov edx, ecx
push edx
call edi
add esp, 4
test esi, esi
jne 0x495521
xor eax, eax
jmp 0x495527
push esi
call edi
add esp, 4
cmp ebx, eax
jle 0x49553e
sub ebx, eax
dec ebx
push ebx
lea eax, [esp + 0x28]
push eax
push esi
call dword [0x5d2598]
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop ebx
mov eax, ebp
pop ebp
pop esi
add esp, 0xc1c
ret 0xc
Function at 0x495bc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
mov ecx, dword [esp + 0x21c]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x218]
mov dword [ecx], esi
cmp dword [edi + 0x54], esi
mov eax, 0x8004e016
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
je 0x495cf1
push ebx
push ebp
mov ebp, dword [esp + 0x224]
push esi
push esi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea edx, [esp + 0x18]
push edx
push 0x200
lea eax, [esp + 0x28]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jl 0x495cdb
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
call fcn.0048fb10
test eax, eax
je 0x495c4c
pop ebp
pop ebx
mov dword [esp + 8], 0x8004e033
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x20c
ret 0x10
mov ecx, dword [edi + 0x54]
mov ebx, dword [ecx]
test ebx, ebx
jle 0x495ceb
lea esp, [esp]
mov edx, dword [edi + 0x54]
mov eax, dword [edx + 8]
mov eax, dword [eax + esi*4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, edi
call fcn.00495870
test eax, eax
jl 0x495ca3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x495ca3
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
push 0
push ecx
lea ecx, [esp + 0x24]
push ecx
push ebp
push eax
call dword [edx + 0x30]
test eax, eax
mov eax, dword [esp + 0x18]
jge 0x495cb9
mov edx, dword [eax]
push eax
call dword [edx + 8]
inc esi
cmp esi, ebx
jl 0x495c60
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20c
ret 0x10
mov ecx, dword [esp + 0x22c]
pop ebp
pop ebx
mov dword [esp + 8], 0
pop edi
mov dword [ecx], eax
mov eax, dword [esp + 4]
pop esi
add esp, 0x20c
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.vidcap60.exe__SfErrorHandler_TranslateWin32Error_4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20c
ret 0x10

Function at 0x49cdb0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
push ebx
push esi
or esi, 0xffffffff
push edi
mov dword [esp + 0xc], esi
call sym.vidcap60.exe__SfIsWin95_0
test eax, eax
je 0x49cdf1
pushfd
pop eax
mov ecx, eax
and ecx, 0x200000
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
and eax, 0x200000
xor eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
setne al
jmp 0x49ce0b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x2c]
xor eax, eax
cmp ecx, 0x24a
sete al
test eax, eax
je 0x49ce29
pushaw
mov eax, 0
cpuid
mov dword [esp + 0x1c], eax
popaw
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x49ceb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8f00
push 0x5c43d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x48]
sub eax, 0x1e6
je 0x49cf02
sub eax, 0x64
je 0x49cef9
mov dword [ebp - 0x20], edi
jmp 0x49cf09
mov dword [ebp - 0x20], 2
jmp 0x49cf09
mov dword [ebp - 0x20], 1
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
call fcn.0049cdb0
cmp eax, 1
jl 0x49cf31
pushaw
mov eax, 1
cpuid
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
popaw
mov esi, dword [ebp - 0x24]
xor edi, edi
test esi, 0x10
je 0x49cf40
mov dword [ebp - 0x1c], 0x400
test esi, 0x8000
je 0x49cf6d
mov ecx, dword [ebp - 0x1c]
or ecx, 0x100
mov dword [ebp - 0x1c], ecx
test esi, 1
je 0x49cf6d
mov eax, ecx
or eax, 0x200
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 3
test esi, 0x800000
je 0x49cf86
or dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x20], 3
jne 0x49cf86
mov dword [ebp - 0x20], 4
test esi, 0x2000000
je 0x49cfd8
or dword [ebp - 0x1c], 0x20
mov dword [ebp - 4], edi
xorps xmm0, xmm0
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x49cfc9
test byte [ebp - 0x1c], 0x20
je 0x49cfdb
mov dword [ebp - 0x20], 5
jmp 0x49cfdb
or eax, 0xffffffff
test esi, 0x4000000
je 0x49d027
or dword [ebp - 0x1c], 0x40
mov dword [ebp - 4], 1
xorpd xmm0, xmm0
jmp 0x49d017
mov dword [ebp - 4], eax
test byte [ebp - 0x1c], 0x40
je 0x49d027
mov dword [ebp - 0x20], 6
test dword [ebp - 0x28], 1
je 0x49d06d
or dword [ebp - 0x1c], 0x1000
mov dword [ebp - 4], 2
haddpd xmm1, xmm0
jmp 0x49d06a
mov dword [ebp - 4], eax
test byte [ebp - 0x1c], 0x40
je 0x49d0a3
mov dword [ebp - 4], 3
stmxcsr dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
or ecx, 0x8040
mov dword [ebp - 0x3c], ecx
ldmxcsr dword [ebp - 0x3c]
mov dword [ebp - 4], eax
jmp 0x49d0a3
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d300
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov ebx, 1
mov dword [esp + 0x10], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x49d43b
mov ecx, dword [esp + 0x10]
cmp ecx, 4
jb 0x49d400
mov eax, dword [esp + 0x14]
cmp eax, 0x5a
jb 0x49d36b
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push ecx
push str.Windows_Me
push edx
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
test eax, eax
jbe 0x49d3c7
cmp word [esp + 0x22], 0x41
jne 0x49d39f
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
push eax
push str.Windows_98_SE
push ecx
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push edx
push str.Windows_98
push eax
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
cmp ecx, 4
jne 0x49d4f6
test eax, eax
jne 0x49d4f6
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push ecx
push str.Windows_95
push edx
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
mov esi, dword [esp + 0x128]
test esi, esi
jle 0x49d4f6
mov edi, dword [esp + 0x124]
push esi
push str.Windows_95
push edi
call dword [0x5d2618]
add esp, 0xc
mov word [edi + esi*2 - 2], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
cmp eax, 2
jne 0x49d4cb
cmp dword [esp + 0x10], 5
jb 0x49d4a3
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x49d47b
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
push eax
push 0x5e8f64
push ecx
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push edx
push str.Windows_2000
push eax
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push ecx
push 0x5e8f30
push edx
call fcn.004049b0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
mov esi, dword [esp + 0x128]
test esi, esi
jle 0x49d4f4
mov edi, dword [esp + 0x124]
push esi
push str.Unknown
push edi
call dword [0x5d2618]
add esp, 0xc
mov word [edi + esi*2 - 2], 0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x114
ret 8
Function at 0x49e920
Capabilities:
Get disk size

Disassembly:
sub esp, 0x640
push esi
push edi
mov edi, dword [esp + 0x64c]
push 0x104
lea eax, [esp + 0x3c]
push eax
push edi
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0xc], eax
je 0x49eac3
mov eax, dword [0x610be4]
xor esi, esi
cmp eax, esi
je 0x49e9b0
cmp dword [0x62210c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
jne 0x49ea2a
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x49e99e
push 0x5e90c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x62210c], eax
cmp dword [0x62210c], esi
jne 0x49ea2a
mov dword [0x610be4], esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp eax, esi
je 0x49eac3
mov eax, dword [esp + 0x24]
fild dword [esp + 0x24]
test eax, eax
jge 0x49e9e9
fadd qword [0x5d55f0]
mov ecx, dword [esp + 0x20]
fild dword [esp + 0x20]
test ecx, ecx
jge 0x49e9fb
fadd qword [0x5d55f0]
mov edx, dword [esp + 0x1c]
fmulp st(1)
test edx, edx
fild dword [esp + 0x1c]
jge 0x49ea0f
fadd qword [0x5d55f0]
mov eax, dword [esp + 0x650]
fmulp st(1)
cmp eax, esi
je 0x49eaa4
mov dword [esp + 8], eax
fild dword [esp + 8]
jmp 0x49ea98
push esi
push esi
lea ecx, [esp + 0x248]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
call dword [0x5d24f4]
push esi
push esi
lea eax, [esp + 0x25c]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x464]
push edx
call dword [0x5d25c8]
add esp, 0x28
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x44c]
push eax
call dword [0x62210c]
cmp eax, esi
je 0x49eac3
mov eax, dword [esp + 0x650]
fild qword [esp + 0x14]
cmp eax, esi
je 0x49eaa4
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jge 0x49eaa2
fadd qword [0x5d55f0]
fdivp st(1)
fcom qword [0x5e90c0]
fnstsw ax
test ah, 0x41
jne 0x49eaf1
pop edi
fstp st(0)
mov eax, 0xffffffff
pop esi
add esp, 0x640
ret 8
mov eax, 0x5c
cmp word [esp + 0x38], ax
jne 0x49eae4
cmp word [esp + 0x3a], ax
jne 0x49eae4
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x640
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x640
ret 8
call fcn.005c4484
pop edi
pop esi
add esp, 0x640
ret 8