joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48baac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405550
xor eax, eax
push ebp
push 0x48bbd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004050d0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405560
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x48bbc1
mov eax, dword [ebp - 0xc]
call fcn.00402f28
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x48bbba
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x48bb2f
call fcn.00404af4
jmp 0x48bbc1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x48bbe8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
mov esi, edx
shr esi, 0x10
and edx, 0xffff
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 0x10
mov dword [ebp - 0x20], ecx
mov edi, edx
and edi, 0xffff
push ebx
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x48bbf4
call fcn.0040aec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bbc1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00402f44
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bbde
lea eax, [ebp - 4]
call fcn.004050d0
ret
Function at 0x48c89c
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405550
mov eax, dword [ebp - 8]
call fcn.00405550
xor eax, eax
push ebp
push 0x48c99e
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x48c9b4
push dword [ebx + 0x38]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405464
mov eax, dword [ebp - 0xc]
call fcn.0040a294
test al, al
je 0x48c903
mov eax, dword [ebp - 0xc]
call fcn.00405560
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a294
test al, al
je 0x48c93e
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, 0x48c9c0
call fcn.004053e8
mov eax, dword [ebp - 0x10]
call fcn.0048c008
mov eax, dword [ebp - 0xc]
call fcn.00405560
push eax
mov eax, dword [ebp - 4]
call fcn.00405560
push eax
call sub.kernel32.dll_MoveFileA
mov eax, 0x48c9d8
call fcn.0048c008
push 0
mov eax, dword [ebp - 4]
call fcn.00405560
push eax
mov eax, dword [ebp - 8]
call fcn.00405560
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48c983
mov eax, 0x48c9f8
call fcn.0048c008
mov eax, dword [ebp - 8]
call fcn.00405560
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c9a5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004050f4
ret
Function at 0x48cf24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405550
mov eax, dword [ebp - 8]
call fcn.00405550
lea edi, [ebp - 0x50]
xor eax, eax
push ebp
push 0x48d0ba
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.0048cd7c
lea edx, [ebp - 0x54]
mov eax, esi
call fcn.0048d17c
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0xc]
mov ecx, 0x48d0d4
call fcn.004053e8
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov edx, 0x48d0ec
call fcn.004053e8
mov eax, dword [ebp - 0x58]
call fcn.0048c008
mov eax, dword [ebp - 0xc]
call fcn.0040a294
test al, al
jne 0x48cfdb
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x48d104
call fcn.0040aec4
mov eax, dword [ebp - 0x5c]
call fcn.0048c008
jmp 0x48d08a
push 0x48d128
push dword [ebp - 4]
push 0x48d134
push dword [ebp - 8]
push 0x48d150
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00405464
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x10]
mov edx, 0x48d160
call fcn.004053e8
mov eax, dword [ebp - 0x68]
call fcn.0048c008
mov dword [edi], 0x3c
mov eax, dword [ebp - 0xc]
call fcn.00405560
mov dword [edi + 0x10], eax
mov dword [edi + 4], 0x240
xor eax, eax
mov dword [edi + 8], eax
mov eax, 0x48d174
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x10]
call fcn.00405560
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 5
mov dword [edi + 0x20], 0x1d
push edi
call sub.shell32.dll_ShellExecuteExA
mov eax, dword [edi + 0x38]
test eax, eax
je 0x48d08a
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x14], 0
sete bl
mov eax, dword [edi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d0c1
lea eax, [ebp - 0x68]
call fcn.004050d0
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.004050f4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004050f4
ret

Function at 0x22134fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2213506
pushal
call 0x221350c
pop ebp
sub ebp, 0x10
sub ebp, 0x1e134fc
jmp 0x2213522
mov eax, 0x1e134fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d9
add byte [ecx + 0x5d9], bh
mov edx, 0x7ce227dc
xor byte [eax], dl
inc eax
dec ecx
jne 0x2213539
jmp 0x221354c
push edi
adc dword [edi + 0x55], edx
loopne 0x221352e
invalid
Function at 0x4019e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413cc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4164a0]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x401a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413cc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_unsigned_short_int_const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x401ae0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x413ceb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push str.mailto:
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
mov byte [esp + 0x24], 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx - 0xc]
push ebx
push 0x40
lea ecx, [esp + 0x18]
mov edi, eax
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
cmp eax, 0xffffffff
je 0x401b73
push esi
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_CToolBar::Layout]
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, eax
mov ebx, 1
call dword [sym.imp.MFC71U.DLL_CWinThread::CommonConstruct]
test eax, eax
mov byte [esp + 0xf], bl
jne 0x401b78
mov byte [esp + 0xf], 0
test bl, 1
je 0x401b87
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov al, byte [esp + 0xf]
test al, al
je 0x401bc0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00401680
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov edx, dword [esp + 0x10]
push 5
push 0x4168ac
push 0
push edx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x14]
mov esi, eax
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x401db0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401e4d
push ebx
push esi
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
lea edx, [edi + 1]
lea eax, [edi + edi]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
call fcn.00401d40
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edx, dword [esp + 0x34]
push edi
push esi
push edx
mov ebx, eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov dword [esp + 0xc], 0
je 0x401e48
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x401e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8b4
mov eax, dword [0x4205bc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x8b8], eax
push edi
je 0x402005
cmp dword [ebp + 0x10], ebx
je 0x401ea9
push esi
call fcn.00401ae0
add esp, 4
mov ecx, dword [esp + 0x8bc]
call fcn.00413187
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esp + 0x90], bx
mov ecx, 0x208
lea edi, [esp + 0x92]
rep stosd dword es:[edi], eax
push 0x410
lea eax, [esp + 0x94]
push eax
push str..htm
push SysReAllocStringLen
call fcn.00401db0
add esp, 0x10
test eax, eax
jne 0x401fdf
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._shellopencommand
lea ecx, [esp + 0x94]
push ecx
call edi
push 0x410
lea edx, [esp + 0x94]
push edx
mov eax, edx
push eax
push SysReAllocStringLen
call fcn.00401db0
add esp, 0x10
test eax, eax
jne 0x402005
mov ebx, dword [sym.imp.MSVCR71.dll_wcsstr]
lea ecx, [esp + 0x90]
push str.__1_
push ecx
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x401f6f
lea edx, [esp + 0x90]
push 0x416928
push edx
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x401f6f
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esp + eax*2 + 0x8e]
jmp 0x401f74
mov word [esi], 0
push 0x416924
push esi
call edi
mov ecx, dword [ebp + 8]
push ecx
push esi
call edi
lea edx, [esp + 0x10]
mov dword [esp + 0xc], edx
call dword [0x420044]
push eax
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
call fcn.00401730
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
cmp eax, ecx
je 0x401fca
push eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x8bc]
call fcn.00413187
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push edx
push ebx
push ebx
push esi
push str.explore
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x8bc]
call fcn.00413187
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x8bc]
mov eax, ebx
call fcn.00413187
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402a40
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x402a6c
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x402a89
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x402aad
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x416990
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
push esi
je 0x402a98
mov eax, dword [esp + 0x14]
mov dx, word [eax + 0x12]
mov cx, word [eax + 0x10]
mov word [esp + 0x1c], dx
mov dx, word [eax + 0x16]
mov ax, word [eax + 0x14]
mov word [esp + 0x1e], cx
mov word [esp + 0x20], dx
mov word [esp + 0x22], ax
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4046e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4206ec]
sub esp, 0xc
test eax, eax
mov dword [0x4206e8], 0
je 0x4046fc
xor eax, eax
add esp, 0xc
ret
push esi
push 0x4206f8
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
test eax, eax
jne 0x404798
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSID0280750F_22B0_46fd_BCCA_99B3BF28765EInprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40477c
lea ecx, [esp + 0xc]
push ecx
push 0x4206f8
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40476d
cmp dword [esp + 8], 1
jne 0x40476d
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x404798
mov eax, dword [0x4206e8]
test eax, eax
jle 0x40478e
mov word [0x4206ea], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
push 0x4206f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4206ec], eax
je 0x40477c
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x404860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x413fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2214
call fcn.00413200
mov eax, dword [0x4205bc]
push ebx
push esi
push edi
push 0x4206d0
mov dword [esp + 0x2220], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 1
mov dword [esp + 0x14], edi
mov eax, dword [0x4206ec]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x222c], esi
je 0x4048c7
cmp dword [0x4206f0], esi
jne 0x404a23
mov word [esp + 0x218], si
call fcn.004046e0
test eax, eax
jge 0x4048f8
push 0x2000
lea eax, [esp + 0x21c]
push str.This_program_requires_the_file_advrcntr2.dll__which_was_not_found_on_this_system.
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
jmp 0x40499d
mov ebx, dword [ebp + 8]
push ebx
call fcn.004047c0
add esp, 4
test eax, eax
jge 0x404a23
test bl, bl
mov dword [esp + 0x10], esi
je 0x404966
mov eax, dword [0x4206f0]
cmp eax, esi
jne 0x404949
mov eax, dword [0x4206ec]
cmp eax, esi
je 0x404966
push 6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x404940
push esi
call eax
add esp, 4
mov dword [0x4206f0], eax
jmp 0x404945
mov eax, dword [0x4206f0]
cmp eax, esi
je 0x404966
lea esi, [eax + 0x28]
push esi
mov edi, 2
call fcn.00404810
add esp, 4
test eax, eax
je 0x404964
call dword [esi]
mov dword [esp + 0x10], eax
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push 0x1f40
push 0x27d8
push edi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
lea edx, [esp + 0x238]
push 0x2000
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x28
push 0x4206d0
mov dword [0x4206f0], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x417074]
mov cx, word [0x417078]
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
xor eax, eax
mov ecx, 0x7e
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
push 0x100
lea edx, [esp + 0x1c]
push edx
push str.NeroSuppressProxyCheck
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4049fd
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MSVCR71.dll__wtoi]
add esp, 4
test eax, eax
jne 0x404a1c
test byte [0x4206f4], 1
jne 0x404a1c
push 0x10
push str.Nero
lea ecx, [esp + 0x220]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x80004005
jmp 0x404a30
push 0x4206d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x2224]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x221c]
call fcn.00413187
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x414489
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x84]
test eax, eax
jne 0x407ff7
push esi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
push 0x410
push 0x410
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_CDC::ReleaseAttribDC]
push 0x417eec
lea ecx, [esp + 0xc]
call dword [0x4160f8]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x407fe5
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x407fe5
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x84], eax
mov dword [edi + 0xf8], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x408ae0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x414595
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call sub.MFC71U.DLL_CWnd::CWnd
xor edi, edi
mov dword [esi], 0x4182e8
mov dword [esp + 0x20], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], 0x4177bc
lea ebx, [esi + 0x78]
mov ecx, ebx
mov byte [esp + 0x20], 1
call sub.MFC71U.DLL_CPropsetPropExchange::CPropsetPropExchange
lea ebp, [esi + 0x8c]
mov ecx, ebp
mov byte [esp + 0x20], 2
call sub.MFC71U.DLL_CStdioFile::CStdioFile
push 0xf
mov byte [esp + 0x24], 3
call dword [sym.imp.USER32.dll_GetSysColor]
push 8
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xffffffffffffffff
push edi
mov ecx, ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x74], edi
call sub.MFC71U.DLL_CObArray::SetSize
push 0xffffffffffffffff
push edi
mov ecx, ebp
call sub.MFC71U.DLL_CPtrArray::SetSize
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
push 0x410
push 0x411
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_CDC::ReleaseAttribDC]
push 0x417eec
lea ecx, [esp + 0x14]
call dword [0x4160f8]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x408c04
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
cmp eax, edi
je 0x408c04
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret