joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
cmp dword [edi + 0x28c], 0
je 0x41d3fe
mov eax, dword [edi + 0x2a0]
dec eax
push eax
call fcn.0041d6b0
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
push 0
push 0xfffffffffffffffc
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f9d9
add esp, 4
mov dword [edi + 0x2ac], eax
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 4]
add ecx, ecx
push ecx
push eax
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 1
push dword [edi + 0x2ac]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b770
mov eax, dword [edi + 0x2ac]
test eax, eax
je 0x41d3fe
push 2
push eax
call fcn.0044f9cb
add esp, 8
mov dword [edi + 0x2ac], 0
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x41d410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
cmp dword [edi + 0x28c], 0
je 0x41d4cf
mov eax, dword [edi + 0x2a0]
dec eax
push eax
call fcn.0041d6b0
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
push 0
push 0xfffffffffffffffc
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f9d9
add esp, 4
mov dword [edi + 0x2ac], eax
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 4]
add ecx, ecx
push ecx
push eax
push dword [edi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x10]
mov ecx, edi
push 1
push dword [edi + 0x2ac]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041bd90
mov eax, dword [edi + 0x2ac]
test eax, eax
je 0x41d4cf
push 2
push eax
call fcn.0044f9cb
add esp, 8
mov dword [edi + 0x2ac], 0
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp + 8]
mov dword [esi + 0x28c], eax
push ecx
push 4
lea ecx, [esi + 0x2a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x438
mov dword [esi + 0x2e0], 0
call fcn.0044f9d9
add esp, 4
mov dword [esi + 0x2a8], eax
pop esi
pop ebp
ret 4
Function at 0x41d540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp + 8]
mov dword [esi + 0x28c], eax
push ecx
push 4
lea ecx, [esi + 0x2a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, 2
mov dword [esi + 0x2e0], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f9d9
add esp, 4
mov dword [esi + 0x2a8], eax
pop esi
pop ebp
ret 8

Function at 0x41d5b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp + 8]
mov dword [esi + 0x28c], eax
push ecx
push 4
lea ebx, [esi + 0x2a0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0xc], 0
je 0x41d694
mov eax, dword [ebx]
xor ecx, ecx
mov edx, 4
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f9d9
mov ecx, dword [ebx]
shl ecx, 2
push ecx
push 0
push eax
mov dword [esi + 0x2b0], eax
call fcn.00451c30
xor edi, edi
add esp, 0x10
cmp dword [ebx], edi
jle 0x41d681
nop
push 0
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
push 0
push 0xfffffffffffffffc
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x2b0]
mov eax, dword [ebp + 0xc]
push 1
push 0
mov dword [ecx + edi*4], eax
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
inc edi
cmp edi, dword [ebx]
jl 0x41d630
push 0
push 0
push 4
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
mov dword [esi + 0x2e0], 0
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0
push 4
push dword [esi + 0x28c]
mov byte [esi + 0x2e4], 0
mov dword [esi + 0x2e0], edi
call ebx
cmp edi, dword [esi + 0x2a0]
jge 0x41d72d
dec edi
test edi, edi
jle 0x41d72d
nop word [eax + eax]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
push 0
push 0xfffffffffffffffc
push dword [esi + 0x28c]
call ebx
mov eax, dword [ebp + 8]
push 1
push 0
add eax, eax
push eax
push dword [esi + 0x28c]
call ebx
sub edi, 1
jne 0x41d6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0
push 4
push dword [esi + 0x28c]
mov dword [esi + 0x2e0], edi
call ebx
test edi, edi
jle 0x41d7ad
nop word [eax + eax]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push dword [esi + 0x28c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
push 0
push 0xfffffffffffffffc
push dword [esi + 0x28c]
call ebx
mov eax, dword [ebp + 8]
push 1
push 0
add eax, eax
push eax
push dword [esi + 0x28c]
call ebx
sub edi, 1
jne 0x41d770
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41d7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x290]
mov ecx, dword [ecx + 0x294]
push ebx
push esi
add ecx, ecx
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x500
nop word [eax + eax]
mov ebx, 0x180
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, edx
mov ecx, edx
shr esi, 5
and ecx, 0x7e0f81f
and esi, 0xffc0f83f
imul ecx, edi
imul esi, edi
shr edx, 5
and edx, 0x7c0f83f
imul edx, edi
shr ecx, 5
xor esi, ecx
and esi, 0x7e0f81f
xor esi, edx
mov dword [eax - 4], esi
sub ebx, 1
jne 0x41d7f5
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
sub dword [ebp - 8], 1
mov dword [ebp - 4], eax
jne 0x41d7f0
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422c00
Capabilities:
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b3d28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x104]
push str..OiddInfo.ini
push 0xff
push eax
push 0x499393
push str.GAME_ID
push str.OIDD
call esi
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x104]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4b4ecb], al
test al, al
jne 0x422c40
push str..OiddInfo.ini
push 8
lea eax, [ebp - 0x104]
push eax
push 0x499393
push str.COM_PORT
push str.OIDD
call esi
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x104]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4b4da7], al
test al, al
jne 0x422c80
lea eax, [ebp - 0x204]
xorps xmm0, xmm0
push str..InitKey.DEY
push eax
movups xmmword [0x4b4ed8], xmm0
call fcn.00413a30
add esp, 8
lea eax, [ebp - 0x204]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x422d07
push 0
lea eax, [ebp - 0x208]
push eax
push 0x10
push 0x4b4ed8
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret
Function at 0x423a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4b3d28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x104]
push str.InitKey.DEY
push eax
call fcn.00413a30
add esp, 8
lea eax, [ebp - 0x104]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x423aad
push 0
lea eax, [ebp - 0x108]
push eax
push 0x10
push 0x4b4ed8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret

Function at 0x4241f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
je 0x424225
push esi
mov esi, dword [ebp + 8]
movsx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 8
xor edx, ecx
movzx ecx, dl
xor ax, word [ecx*2 + 0x4995a0]
movzx eax, ax
sub edi, 1
jne 0x424201
pop esi
pop edi
pop ebp
ret
Function at 0x434df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4b3d28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x498ecc
push str.InitKey.DEY
call fcn.0045af79
mov esi, eax
add esp, 8
test esi, esi
je 0x434e3e
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.0045b20f
push esi
push 1
lea eax, [ebp - 0x15]
push 1
push eax
call fcn.0045b20f
push esi
call fcn.0045ac26
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret 4
Function at 0x4487f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4b60d0], 1
push esi
movzx esi, word [ebp + 8]
push esi
jne 0x44880d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jmp 0x44881b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, dword [esi*4 + 0x4b7c18]
je 0x448848
test eax, eax
jne 0x44883b
mov dword [esi*4 + 0x4b7c18], 1
mov eax, 1
pop esi
pop ebp
ret
cmp eax, 1
jne 0x448852
mov eax, 2
pop esi
pop ebp
ret
cmp eax, 1
je 0x448857
cmp eax, 2
je 0x448857
xor eax, eax
pop esi
pop ebp
ret
mov dword [esi*4 + 0x4b7c18], 0
mov eax, 3
pop esi
pop ebp
ret

Function at 0x46f0ab
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046ed69

Function at 0x478efc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00478b01

Function at 0x482e5c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00482636

Function at 0x482e67
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00482871

Function at 0x483fa1
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483d28
Function at 0x401ef8
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call fcn.004055b0
pop ecx
xor ebx, ebx
pop ecx
push ebx
push 0x8000000
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x401f75
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.00405580
pop ecx
cmp eax, ebx
pop ecx
je 0x401f71
mov byte [eax], bl
lea eax, [ebp - 0x208]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401f15
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.004055b0
pop ecx
pop ecx
jmp 0x401f15
xor eax, eax
jmp 0x401fcd
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, ebx
jbe 0x401fbd
mov esi, 0x10000
cmp edi, esi
jae 0x401f89
mov esi, edi
lea eax, [ebp - 8]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401fc0
cmp dword [ebp - 8], esi
jne 0x401fc0
push dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 8], 1
call fcn.00401eaa
sub edi, esi
add dword [ebp + 0xc], esi
jmp 0x401f7a
mov ebx, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x401fd0
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x415bc8
call fcn.00404ce0
sub esp, 0x24
push ebx
and dword [ebp - 4], 0
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
pop edi
lea ecx, [ebp - 0x30]
call fcn.00403c01
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410c52
lea eax, [ebp + 8]
push edi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00410406
mov esi, 0x44c560
push esi
push dword [eax]
call fcn.004056d0
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp + 8]
setne bl
call fcn.00410be4
test bl, bl
je 0x40203b
push esi
lea ecx, [ebp - 0x14]
call fcn.00410d95
push 0x44c55c
lea ecx, [ebp - 0x14]
call fcn.00410d95
push 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x14]
call fcn.00403cc4
mov ebx, eax
test ebx, ebx
lea ecx, [ebp - 0x30]
je 0x4020be
call fcn.00403ee4
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.00403eab
test eax, eax
jne 0x402057
lea eax, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
call fcn.00403fb3
mov eax, dword [ebp - 0x30]
push 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call dword [eax + 0x38]
push dword [ebp + 8]
test eax, eax
je 0x4020a8
call fcn.00401fd0
pop ecx
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
and eax, esi
jmp 0x4020ae
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 8]
and edi, eax
mov byte [ebp - 4], 2
call fcn.00410be4
jmp 0x402057
call fcn.00403c7a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410be4
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403c3e
jmp 0x4020ea
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x402798
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
mov dword [0x451ca4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.004148d7
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
test eax, eax
jne 0x4027d7
push 0x10
push dword [0x44c448]
push str.AfxWinInit_failed_
push edi
call ebx
mov esi, 0x451ba0
push esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
ja 0x4027f9
push str._temp_
push esi
call fcn.004055b0
pop ecx
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.00405860
add eax, esi
pop ecx
cmp byte [eax - 1], 0x5c
je 0x402814
mov byte [eax], 0x5c
inc eax
push str.Nero.40_
push eax
call fcn.004055b0
push esi
call fcn.00401fd0
lea eax, [ebp - 0x253]
push esi
push eax
mov byte [ebp - 0x254], 0x22
call fcn.004055b0
lea eax, [ebp - 0x254]
push eax
call fcn.00405860
add esp, 0x18
lea eax, [ebp + eax - 0x254]
mov dword [ebp + 0x14], eax
push edi
push 0x4025de
push edi
push 0x67
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [0x451ca8], edi
jne 0x40289e
lea eax, [ebp - 0x354]
push pe_nt_image_headers32
push eax
push 5
push dword [0x451ca4]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10
lea eax, [ebp - 0x354]
push dword [0x44c448]
push eax
push edi
call ebx
cmp dword [0x451ca8], edi
jle 0x4028f8
push 0x44
lea eax, [ebp - 0x44]
pop ebx
push ebx
push edi
push eax
call fcn.00405120
push 1
mov dword [ebp - 0x44], ebx
pop eax
mov dword [ebp - 0x40], edi
push str.Setup.exe_
mov dword [ebp - 0x10], edi
push dword [ebp + 0x14]
mov word [ebp - 0x12], di
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.004055b0
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push edi
push 0x4000000
push edi
push edi
lea eax, [ebp - 0x254]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x402901
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
cmp edi, ebx
je 0x4029ab
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x4029ab
lea eax, [ebp + 0x14]
mov byte [esi], bl
push eax
push 0x20019
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4029a6
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40299d
cmp dword [ebp + 0x18], edi
jbe 0x402987
lea eax, [ebp - 0x104]
push edi
push eax
push esi
call fcn.00405920
add esp, 0xc
mov byte [esi + edi - 1], bl
jmp 0x402996
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004055b0
pop ecx
pop ecx
mov dword [ebp - 4], 1
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
jmp 0x4029ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4029b2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
and byte [ebp - 4], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 3]
and byte [ebp - 0x104], al
push 0x3f
stosw word es:[edi], ax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
and byte [ebp - 0x404], 0
push 0x7f
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x403]
and byte [ebp - 0x204], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jae 0x402a44
push 0x4526ec
push 0x104
push 0x4524b0
push 0x451cac
push str.Path
push str.Info
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
neg eax
sbb eax, eax
neg eax
jmp 0x402b80
mov edi, 0x4524b0
push 0x104
mov ebx, 0x451cac
push edi
push ebx
mov esi, 0x80000002
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
push esi
call fcn.00402901
add esp, 0x14
test eax, eax
jne 0x402ad4
push 0x104
push edi
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionApp_Paths_
push esi
call fcn.00402901
add esp, 0x14
test eax, eax
jne 0x402ad4
push 1
pop eax
cmp dword [0x4525d8], eax
mov dword [0x45321c], eax
jne 0x402b85
push 0x104
push edi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNeroMediaPlayer.exe
push esi
call fcn.00402901
add esp, 0x14
test eax, eax
je 0x402b85
push 0x5c
push edi
call fcn.00405580
pop ecx
test eax, eax
pop ecx
je 0x402ac7
and byte [eax], 0
push str.NeroFiles_
push edi
call fcn.004055c0
pop ecx
pop ecx
push 0x5c
push edi
call fcn.00405580
pop ecx
test eax, eax
pop ecx
je 0x402ae5
and byte [eax], 0
mov esi, 0x4525e8
push edi
push esi
call fcn.004055b0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.00405a1e
lea eax, [ebp - 4]
push eax
push esi
call fcn.004055b0
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004055c0
mov ebx, 0x453220
push esi
push ebx
call fcn.004055b0
push ebx
mov ebx, 0x453114
push ebx
call fcn.004055b0
push str.CoverDesigner
push ebx
call fcn.004055c0
add esp, 0x44
push str.CoverEditor
push esi
call fcn.004055c0
mov esi, 0x452f0c
push edi
push esi
call fcn.004055b0
push 0x44c560
push esi
call fcn.004055c0
push 0x4173e4
push esi
call fcn.004055c0
add esp, 0x20
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x402b80
Function at 0x402b89
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 1
pop eax
cmp dword [0x4525d8], eax
je 0x402d27
lea eax, [ebp - 0x114]
push 0x4524b0
push eax
call fcn.004055b0
lea eax, [ebp - 0x114]
push eax
call fcn.00405860
add esp, 0xc
cmp byte [ebp + eax - 0x115], 0x5c
je 0x402be1
lea eax, [ebp - 0x114]
push 0x44c560
push eax
call fcn.004055c0
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004055b0
lea eax, [ebp - 0x114]
push 0x4173a8
push eax
call fcn.004055c0
add esp, 0x10
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
je 0x402c2a
push edi
call fcn.00410943
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x402c31
xor eax, eax
jmp 0x402d27
push ebx
push edi
lea eax, [ebp - 0x114]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402d1e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x44c560
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402d1e
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov dh, cl
mov ecx, dword [eax + 0xc]
mov dl, byte [eax + 8]
movzx eax, byte [eax + 0xc]
shr ecx, 0x10
movzx ecx, cl
shl edx, 8
or edx, ecx
shl edx, 8
or eax, edx
cmp eax, dword [0x4525bc]
jb 0x402c9e
cmp eax, dword [0x4525c0]
ja 0x402c9e
push 1
pop esi
xor edi, edi
cmp dword [0x4525c4], edi
je 0x402cd8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push str.StringFileInfo040904B0ProductName
push ebx
call sub.VERSION.dll_VerQueryValueA
mov esi, eax
cmp esi, edi
je 0x402cd8
push dword [0x4525c4]
push dword [ebp - 8]
call fcn.004056d0
mov esi, eax
pop ecx
neg esi
sbb esi, esi
pop ecx
inc esi
cmp dword [0x4525cc], edi
je 0x402d1e
cmp esi, edi
je 0x402d1e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004055b0
lea eax, [ebp - 0x114]
push str.nerojpn.nls
push eax
call fcn.004055c0
add esp, 0x10
lea eax, [ebp - 0x114]
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jne 0x402d1e
xor esi, esi
push ebx
call fcn.0041096c
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408946
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop esi
call fcn.0040896e
and edx, edi
xor dword [ebx], esi
mov edi, edi
inc ebx
cmp ebx, eax
jne fcn.00408946
ret