joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fab
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x42a13f
call fcn.00422efe
lea eax, [ebp - 0x10]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408fe0
xor eax, eax
call fcn.00422fd6
ret
mov edi, 0x400
push edi
lea ecx, [ebp - 0x28]
call fcn.00409c34
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x18], 0x3ff
call fcn.00409c57
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.ImagePath
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
mov dword [ebp - 0x10], ebx
jne 0x409041
lea ecx, [ebp - 0x28]
call fcn.00409e49
jmp 0x408fd8
cmp dword [ebp - 0x14], 2
je 0x409065
cmp dword [ebp - 0x14], 1
lea ecx, [ebp - 0x28]
jne 0x40903a
push ebx
call fcn.00409c57
mov ecx, dword [ebp + 0xc]
push eax
call dword [sym.imp.MFC80.DLL_Ordinal_784]
xor ebx, ebx
inc ebx
jmp 0x4090a0
push edi
lea ecx, [ebp - 0x38]
call fcn.00409c11
push 0x3ff
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00409c57
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00409c57
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
lea ecx, [ebp - 0x38]
jne 0x4090af
mov byte [ebp - 4], bl
call fcn.00409df9
lea ecx, [ebp - 0x28]
call fcn.00409e49
mov eax, ebx
jmp 0x408fda
push ebx
call fcn.00409c57
mov ecx, dword [ebp + 0xc]
push eax
call dword [sym.imp.MFC80.DLL_Ordinal_784]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.00409df9
jmp 0x409060

Function at 0x4090cc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4090f8
xor eax, eax
jmp 0x40912c
push ebx
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
pop ebx
pop esi
leave
ret

Function at 0x40912f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409158
xor eax, eax
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x40a8cd
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4266b0
call fcn.00422e50
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], esp
push 0x43d018
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [esi], ebx
mov dword [ebp - 4], ebx
call sub.MSVCR80.dll_fopen
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
mov dword [ebp + 0xc], edi
jne 0x40a916
lea eax, [ebp - 0x11]
push 0x434594
push eax
mov byte [ebp - 0x11], bl
call sub.MSVCR80.dll__CxxThrowException
push 2
push ebx
push edi
call sub.MSVCR80.dll_fseek
add esp, 0xc
test eax, eax
je 0x40a937
lea eax, [ebp - 0x12]
push 0x434594
push eax
mov byte [ebp - 0x12], bl
call sub.MSVCR80.dll__CxxThrowException
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push edi
mov dword [ebp - 0x20], ebx
call sub.MSVCR80.dll_fgetpos
pop ecx
test eax, eax
pop ecx
je 0x40a95e
lea eax, [ebp - 0x13]
push 0x434594
push eax
mov byte [ebp - 0x13], bl
call sub.MSVCR80.dll__CxxThrowException
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov dword [esi], eax
jne 0x40a978
lea eax, [ebp - 0x14]
push 0x434594
push eax
mov byte [ebp - 0x14], bl
call sub.MSVCR80.dll__CxxThrowException
push ebx
push ebx
push edi
call sub.MSVCR80.dll_fseek
add esp, 0xc
test eax, eax
je 0x40a998
lea eax, [ebp - 0x15]
push 0x434594
push eax
mov byte [ebp - 0x15], bl
call sub.MSVCR80.dll__CxxThrowException
push dword [esi]
call sub.MFC80.DLL_Ordinal_762
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
jne 0x40a9b8
lea eax, [ebp - 0x16]
push 0x434594
push eax
mov byte [ebp - 0x16], bl
call sub.MSVCR80.dll__CxxThrowException
push edi
push 1
push dword [esi]
push eax
call sub.MSVCR80.dll_fread
add esp, 0x10
cmp eax, 1
je 0x40a9fa
lea eax, [ebp - 0x17]
push 0x434594
push eax
mov byte [ebp - 0x17], bl
call sub.MSVCR80.dll__CxxThrowException
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x40a9ef
push dword [ebp - 0x1c]
call sub.MFC80.DLL_Ordinal_764
pop ecx
mov dword [ebp - 0x1c], ebx
mov eax, 0x40a9f5
ret
cmp edi, ebx
je 0x40aa05
push edi
call sub.MSVCR80.dll_fclose
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x40af9b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43fee0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0xffffffff
je 0x40afdb
call fcn.0040aeab
push 7
lea ecx, [ebp - 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x40afdb
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
pop ecx
jmp 0x40afdd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422a47
leave
ret
Function at 0x40bb0b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43fee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x40bb3d
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x40bbbd
push esi
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x40bb54
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x40bbbc
push esi
push dword [ebp - 0x18]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40bb75
push esi
call dword [sym.imp.MSVCR80.dll_free]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x40bbbb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x430f44
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40bb64
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b133
push esi
call dword [sym.imp.MSVCR80.dll_free]
lea esi, [ebp - 0x10]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00422a47
leave
ret

Function at 0x4104b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4104c1
call fcn.00410440
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x4104d0
mov eax, dword [eax + 4]
jmp 0x4104d3
add eax, 4
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push 0
push edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop esi
je 0x41050f
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.0040fe80
push 0x4352a4
lea ecx, [esp + 4]
push ecx
call sub.MSVCR80.dll__CxxThrowException
add esp, 0x14
ret 0xc

Function at 0x410520
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x410531
call fcn.00410440
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x410540
mov eax, dword [eax + 4]
jmp 0x410543
add eax, 4
mov edx, dword [esi + 0x1c]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x41057c
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.0040fe80
push 0x4352a4
lea eax, [esp + 4]
push eax
call sub.MSVCR80.dll__CxxThrowException
add esp, 0x14
ret 8
Function at 0x410590
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4105a1
call fcn.00410440
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x14]
add eax, 1
cmp dword [ecx + 0x18], 0x10
jb 0x4105b6
mov ecx, dword [ecx + 4]
jmp 0x4105b9
add ecx, 4
mov edx, dword [esp + 0x1c]
cmp dword [edx + 0x18], 0x10
jb 0x4105c8
mov edx, dword [edx + 4]
jmp 0x4105cb
add edx, 4
push eax
mov eax, dword [esi + 0x1c]
push ecx
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x4105ff
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.0040fe80
push 0x4352a4
lea ecx, [esp + 4]
push ecx
call sub.MSVCR80.dll__CxxThrowException
add esp, 0x14
ret 8

Function at 0x410610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004104b0
cmp dword [esp + 8], 4
je 0x410666
push 0x50000
push 0x65d
lea ecx, [esp + 0x18]
call fcn.0040fe80
push 0x4352a4
lea edx, [esp + 0x14]
push edx
call sub.MSVCR80.dll__CxxThrowException
cmp dword [esi + 0x18], 0x10
mov dword [esp + 0x28], 0
jb 0x410679
mov esi, dword [esi + 4]
jmp 0x41067c
add esi, 4
mov edx, dword [edi + 0x1c]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4106b7
push 0x50000
push eax
lea ecx, [esp + 0x18]
call fcn.0040fe80
push 0x4352a4
lea eax, [esp + 0x14]
push eax
call sub.MSVCR80.dll__CxxThrowException
mov eax, dword [esp + 0x28]
pop edi
pop esi
add esp, 0x1c
ret 4

Function at 0x4106d0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4106e1
call fcn.00410440
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x4106f0
mov eax, dword [eax + 4]
jmp 0x4106f3
add eax, 4
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
pop esi
je 0x410721
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.0040fe80
push 0x4352a4
lea ecx, [esp + 4]
push ecx
call sub.MSVCR80.dll__CxxThrowException
add esp, 0x14
ret 4
Function at 0x4108a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4272e2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x43fee0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.004104b0
cmp dword [esp + 0x14], 1
je 0x410915
push 0x50000
push 0x65d
lea ecx, [esp + 0x34]
call fcn.0040fe80
push 0x4352a4
lea edx, [esp + 0x30]
push edx
call sub.MSVCR80.dll__CxxThrowException
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x54]
push ecx
add eax, 1
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], bl
call fcn.00409dd0
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x48], 1
je 0x410947
mov edx, dword [esp + 0x24]
sub edx, eax
jne 0x410951
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x20]
cmp dword [edi + 0x18], 0x10
jb 0x41095c
mov ecx, dword [edi + 4]
jmp 0x41095f
lea ecx, [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esi + 0x1c]
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x410994
push 0x50000
push eax
lea ecx, [esp + 0x34]
call fcn.0040fe80
push 0x4352a4
lea ecx, [esp + 0x30]
push ecx
call sub.MSVCR80.dll__CxxThrowException
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4109a4
mov edx, dword [esp + 0x24]
sub edx, eax
jne 0x4109ae
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x50]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x18], 1
mov byte [esp + 0x48], bl
je 0x4109e1
mov ecx, dword [esp + 0x28]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_char_::deallocate_char___unsigned_int_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 8
Function at 0x411de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427641
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x43fee0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0x43158c
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0xc]
push eax
push 0
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00410280
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x412e50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp dword [0x4425f4], 0
mov dword [0x4425f0], 0
je 0x412e6c
xor eax, eax
add esp, 0xc
ret
mov eax, 0x442600
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x412e74
sub eax, edx
push esi
jne 0x412ee9
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSIDc6f7158b_a330_474c_b76e_ecf14355aabaInprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412efd
lea ecx, [esp + 0xc]
push ecx
push 0x442600
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412eda
cmp dword [esp + 8], 1
jne 0x412eda
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x412efd
push 0x442600
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4425f4], eax
jne 0x412f19
cmp dword [0x4425f0], 0
jle 0x412f0f
mov word [0x4425f2], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x412fd0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x42778b
mov eax, dword fs:[0]
push eax
mov eax, 0x1108
call fcn.00423020
mov eax, dword [0x43fee0]
xor eax, esp
mov dword [esp + 0x1104], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43fee0]
xor eax, esp
push eax
lea eax, [esp + 0x111c]
mov dword fs:[0], eax
push 0x4425d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 1
mov dword [esp + 0x14], esi
xor edi, edi
cmp dword [0x4425f4], edi
mov dword [esp + 0x1124], edi
je 0x413040
cmp dword [0x4425f8], edi
jne 0x41319f
mov byte [esp + 0x118], 0
call fcn.00412e50
test eax, eax
jge 0x413076
push 0x1000
push str.This_program_requires_the_file_advrcntr3.dll__which_was_not_found_on_this_system.
lea eax, [esp + 0x120]
push 0x1000
push eax
call dword [sym.imp.MSVCR80.dll__mbsnbcpy_s]
add esp, 0x10
jmp 0x41310f
mov ebp, dword [esp + 0x1130]
mov ebx, dword [esp + 0x112c]
push ebp
push ebx
call fcn.00412f20
add esp, 8
test eax, eax
jge 0x41319f
test bl, bl
je 0x4130cb
push ebp
push 0
call fcn.00412f20
add esp, 8
test eax, eax
jl 0x4130cb
mov ebp, dword [0x4425f8]
add ebp, 0x14
push ebp
mov esi, 2
call fcn.00412f80
add esp, 4
test eax, eax
je 0x4130cb
mov ecx, dword [ebp]
call ecx
mov edi, eax
mov edx, dword [esp + 0x1130]
mov eax, dword [esp + 0x1138]
mov ecx, dword [esp + 0x1134]
push edx
push eax
push ecx
push edi
push 0x12c
push 0x135
push esi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
push 0x1000
lea edx, [esp + 0x13c]
push 0x1000
push edx
call dword [sym.imp.MSVCR80.dll__snprintf_s]
add esp, 0x2c
push 0x4425d8
mov dword [0x4425f8], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ax, word [0x42dfa0]
mov cl, byte [0x42dfa2]
push 0xfd
lea edx, [esp + 0x1f]
push 0
push edx
mov word [esp + 0x24], ax
mov byte [esp + 0x26], cl
call sub.MSVCR80.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
push str.NeroSuppressProxyCheck
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x413178
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
test eax, eax
jne 0x413198
test byte [0x4425fc], 1
jne 0x413198
push 0x10
push str.Nero
lea edx, [esp + 0x120]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
jmp 0x4131ac
push 0x4425d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x111c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1104]
xor ecx, esp
call fcn.00422a47
add esp, 0x1114
ret
Function at 0x41501e
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x427a8f
call fcn.00422efe
push dword [ebp + 8]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_304]
and dword [ebp - 4], 0
push 0x42e2e4
lea ecx, [ebp - 0x18]
call dword [sym.imp.MFC80.DLL_Ordinal_304]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax - 0xc]
push 0
push 0x40
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_2271]
cmp eax, 0xffffffff
je 0x41509a
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_3997]
push dword [ebp - 0x18]
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.MFC80.DLL_Ordinal_1482]
test eax, eax
mov byte [ebp - 0xd], bl
jne 0x41509e
mov byte [ebp - 0xd], 0
test byte [ebp - 0x1c], bl
mov dword [ebp - 4], ebx
je 0x4150af
lea ecx, [ebp - 0x20]
call dword [sym.imp.MFC80.DLL_Ordinal_578]
cmp byte [ebp - 0xd], 0
je 0x4150e0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004086bc
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call dword [sym.imp.MFC80.DLL_Ordinal_781]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MFC80.DLL_Ordinal_578]
push 5
push 0x43158c
push 0
push dword [ebp - 0x14]
push str.open
push dword [ebp - 0x24]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x18]
mov esi, eax
call dword [sym.imp.MFC80.DLL_Ordinal_578]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_578]
mov eax, esi
call fcn.00422fd6
ret

Function at 0x41524e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
jne 0x4152d5
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
mov byte [ebp - 1], bl
call fcn.00409dd0
lea eax, [ebp - 0xc]
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00409c57
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push ebx
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00409c57
push esi
push eax
push esi
push dword [ebp + 0x10]
call dword [sym.imp.MSVCR80.dll__mbsnbcpy_s]
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ebx
call fcn.00409df9
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x4152db
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x424]
sub esp, 0x4a4
mov eax, dword [0x43fee0]
xor eax, ebp
mov dword [ebp + 0x420], eax
push esi
mov esi, dword [ebp + 0x42c]
xor eax, eax
cmp esi, eax
mov dword [ebp + 4], esi
mov dword [ebp + 8], eax
je 0x415422
cmp dword [ebp + 0x434], eax
je 0x415324
push esi
call fcn.0041501e
pop ecx
mov dword [ebp + 8], eax
jmp 0x415422
push ebx
push edi
mov edi, 0x410
push edi
push eax
mov byte [ebp + 0xc], al
lea eax, [ebp + 0xd]
push eax
call sub.MSVCR80.dll_memset
push edi
lea eax, [ebp + 0xc]
push eax
push str..htm
mov ebx, SysReAllocStringLen
push ebx
call fcn.0041524e
add esp, 0x1c
test eax, eax
jne 0x415406
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
lea eax, [ebp + 0xc]
push eax
call esi
push edi
lea eax, [ebp + 0xc]
push eax
push eax
push ebx
call fcn.0041524e
add esp, 0x10
test eax, eax
jne 0x415420
mov ebx, dword [sym.imp.MSVCR80.dll__mbsstr]
lea eax, [ebp + 0xc]
push str.__1_
push eax
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4153bd
lea eax, [ebp + 0xc]
push 0x42e2f4
push eax
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4153bd
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax + 0xb]
jmp 0x4153c0
mov byte [edi], 0
push 0x431efc
push edi
call esi
push dword [ebp + 4]
push edi
call esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
call fcn.00415116
push dword [ebp + 0x430]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x7c]
cmp dword [ebp - 0x80], eax
je 0x415420
push dword [ebp - 0x80]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
jmp 0x415420
push dword [ebp + 0x430]
xor eax, eax
push eax
push eax
push esi
push str.explore
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp + 8], eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x420]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop esi
call fcn.00422a47
add ebp, 0x424
leave
ret
Function at 0x416750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x427c73
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x43fee0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x44271c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.tinyxml::TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x44271c
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x43158c
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0041c5b0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret