joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121ec
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push 0x3e8
push eax
lea esi, [ebp - 4]
call fcn.0040c550
cmp dword [ebp - 4], 0xffffffff
je 0x4122e1
push ebx
mov ebx, dword [edi + 0x219]
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x4122ac
mov esi, 0x228
jmp 0x412231
mov ebx, dword [ebp - 8]
lea eax, [ebx + 4]
push eax
push str.__s__r_n
lea edi, [ebp - 0x458]
call fcn.00417ed8
pop ecx
pop ecx
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040c4e2
mov ebx, dword [ebx + 0x20c]
jmp 0x41228b
lea eax, [ebx + 0x20c]
push eax
lea eax, [ebx + 4]
push eax
push str._s_s_r_n
lea edi, [ebp - 0x458]
call fcn.00417ed8
add esp, 0xc
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040c4e2
test ebx, ebx
je 0x41228f
mov ebx, dword [ebx]
test ebx, ebx
jne 0x41225b
push 0x46e05c
lea eax, [ebp - 4]
push eax
call fcn.0040c4e2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 8], eax
jne 0x41222e
mov edi, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 4]
push esi
call fcn.0040c43e
push esi
mov dword [edi + 0x211], eax
call fcn.0040c2b2
mov dword [edi + 0x215], eax
mov byte [edi + 0x210], 0
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x412666
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
push esi
push edi
call fcn.00401182
test al, al
je 0x41269b
call fcn.00412397
mov eax, dword [0x4885a0]
xor ebx, ebx
cmp eax, ebx
je 0x41269d
push ebx
push 0x3e8
push ebx
push 0x41282a
call eax
jmp 0x41269d
xor ebx, ebx
push ebx
call fcn.0043f1b3
pop ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
mov esi, 0x104
push eax
mov word [ebp - 0x220], bx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x220]
push eax
push str._tempoperfect_rl__s
lea edi, [ebp - 0x428]
call fcn.00417ed8
pop ecx
pop ecx
lea eax, [ebp - 0x630]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, edi
push eax
lea eax, [ebp - 0x630]
push eax
mov esi, 0x486090
push esi
call fcn.0040151b
mov eax, dword [0x486298]
cmp eax, 0xffffffff
je 0x41271d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
mov ebx, 0x80
push ebx
push 1
push 0
push 0
push 0xc0000000
push esi
call edi
cmp eax, 0xffffffff
mov dword [0x486298], eax
je 0x412757
push 8
lea eax, [ebp - 0xc]
push eax
push 0x486298
call fcn.00401576
jmp 0x412802
push 0
push ebx
push 3
push 0
push 1
push SysReAllocString
push esi
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x412802
push 8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401538
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004014d8
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
imul eax, eax, 0x3e8
add eax, dword [ebp - 0x10]
lea ecx, [eax - 0x7d0]
cmp dword [ebp - 8], ecx
jle 0x412802
add eax, 0x7d0
cmp dword [ebp - 8], eax
jge 0x412802
push str.Something_Else
mov esi, str.Abnormal_Termination_Detected
push esi
push str.Did_TempoPerfect_hang_or_crash_when_last_run__r_n_r_nClick_It_Crashed_if_TempoPerfect_failed._Click_Something_Else_if_it_was_because_of_something_else__a_hard_logoff_for_example__or_if_you_did_not_notice_anything_wrong_or_dont_remember.
xor edi, edi
push edi
mov eax, str.It_Crashed
call fcn.00420198
test al, al
je 0x412802
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x46e64c
push esi
push str.Oops__TempoPerfect_had_an_abnormal_termination._Help_us_fix_this_problem_by_clicking_Report_Bug_below_and_entering_a_bug_report_for_our_developers._r_n_r_nWe_appreciate_your_help_
push edi
mov eax, str.Report_Bug
call fcn.00420198
test al, al
je 0x412802
push edi
call fcn.004128fd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4128fd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2edc
call fcn.0044c310
push ebx
push esi
push edi
lea eax, [esp + 0x830]
push eax
push 0x459720
push 0x459c74
push str.Software
call fcn.004116a0
call fcn.0040bcdc
mov ebx, eax
shr ebx, 0x14
call fcn.0040bd24
mov esi, eax
shr esi, 0x14
xor edi, edi
cmp byte [ebp + 8], 0
mov dword [esp + 0x14], esi
mov word [esp + 0x218], di
je 0x4129af
lea eax, [esp + 0x628]
call fcn.0041373d
push str..dmp
push 0x46b3ac
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x224]
push eax
call fcn.00413e38
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
xor eax, eax
call fcn.00412eb1
test al, al
jne 0x4129af
mov word [esp + 0x218], di
cmp word [esp + 0x218], di
mov word [esp + 0x420], di
jne 0x4129cb
mov word [esp + 0x420], di
jmp 0x412a38
push edi
call fcn.0043f1b3
pop ecx
mov dword [esp + 0x10], eax
call fcn.00401597
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea esi, [esp + 0xc40]
lea edi, [esp + 0xa38]
call fcn.00411eca
lea esi, [esp + 0x628]
lea eax, [esp + 0x10]
call fcn.0040cb4f
call fcn.00417e48
call fcn.0043f2f0
cdq
mov ecx, 0x2710
idiv ecx
mov eax, esi
push edx
push eax
mov eax, edi
push eax
lea eax, [esp + 0x42c]
push str._s__s__04d.dmp
push eax
call fcn.00401000
mov esi, dword [esp + 0x28]
add esp, 0x14
push esi
push ebx
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0xe54]
push eax
call fcn.00413052
lea eax, [esp + 0x100]
push eax
mov dword [esp + 0x104], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0041800d
test al, al
mov ecx, str._wine
jne 0x412a7b
mov ecx, 0x459720
cmp byte [0x48782c], 0
mov eax, str.PureVirtualCall
jne 0x412a8e
mov eax, str.AbTermOrHang
lea edx, [esp + 0xe48]
push edx
lea edx, [esp + 0x834]
push edx
push dword [0x488334]
mov esi, 0x825
push ecx
push dword [esp + 0x118]
lea edi, [esp + 0x1eac]
push dword [esp + 0x118]
push eax
push str.https:__www.nch.com.au_software_bug.html_softwareTempoPerfectversion5.01xi_s_Win_d_d_s_MAIN_Cmd_d_iid_sdata_s
call fcn.00417ed8
add esp, 0x20
push 1
xor esi, esi
push esi
push esi
mov eax, edi
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp word [esp + 0x218], si
je 0x412b38
push esi
push str.Uploading_Crash_Dump_File
lea eax, [esp + 0x20]
call fcn.0040e7e8
mov eax, dword [esp + 0x75]
push esi
push str.Uploading_crash_dump_file
lea ecx, [esp + 0x7d]
call dword [eax + 0x20]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x424]
push eax
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x81]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004308da
lea eax, [esp + 0x18]
call fcn.0040e824
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412f53
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
call fcn.00417f4c
neg al
mov dword [ebp - 0x44], 0x40
sbb eax, eax
or dword [ebp - 0x3c], 0xffffffff
and dword [ebp - 0x38], 0
and eax, 0x20
add eax, 0x20
mov esi, eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x459720
push str.ProcessorNameString
push str.HardwareDescriptionSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x24c]
call fcn.00401071
lea edx, [ebp - 0x24c]
call fcn.0043c2df
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x454]
call fcn.004012da
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x3c]
shrd eax, ecx, 0x14
push eax
push esi
push str.osbits_dmemphys_dcpu_s
push dword [ebp + 8]
shr ecx, 0x14
call fcn.0041bf23
add esp, 0x14
pop esi
leave
ret 4
Function at 0x41315e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2dcc
call fcn.0044c310
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x50]
push esi
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 0x108]
mov dword [esp + 0x14], ebx
call fcn.0041373d
push str..dmp
push 0x46b3ac
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x31c]
push eax
call fcn.00413e38
lea esi, [ebx + 0x31c]
push dword [esi]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [esp + 0x310]
push eax
push dword [ebx + 0x320]
lea eax, [esp + 0x1c]
push dword [esi]
push edi
call fcn.00412eb1
xor esi, esi
test al, al
jne 0x4131e9
mov word [esp + 0x310], si
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push str.VersionCheckAfterCrash
push str.Settings
call fcn.0040163a
lea eax, [ebx + 0x52c]
test eax, eax
je 0x413389
push 0x46e64c
push str.Abnormal_Execution_Problem
push str.TempoPerfect_Metronome_Software_has_crashed_because_of_an_abnormal_exception._r_n_r_nHelp_us_fix_this_problem_by_clicking_Report_Bug_below__then_sharing_the_details_with_our_developers._r_n_r_nThank_you_for_your_help_
push esi
mov eax, str.Report_Bug
call fcn.00420198
test al, al
je 0x413389
cmp word [esp + 0x310], si
jne 0x413245
mov word [esp + 0x108], si
jmp 0x4132ae
push esi
call fcn.0043f1b3
pop ecx
mov dword [esp + 0x10], eax
call fcn.00401597
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea esi, [esp + 0xb30]
lea edi, [esp + 0x720]
call fcn.00411eca
lea esi, [esp + 0x928]
lea eax, [esp + 0x10]
call fcn.0040cb4f
call fcn.00417e48
call fcn.0043f2f0
cdq
mov ecx, 0x2710
idiv ecx
mov eax, esi
push edx
push eax
mov eax, edi
push eax
lea eax, [esp + 0x114]
push str._s__s__04d.dmp
push eax
call fcn.00401000
add esp, 0x14
push dword [ebx + 0x940]
lea eax, [esp + 0x10c]
push dword [ebx + 0x93c]
push eax
lea eax, [esp + 0xd44]
push eax
call fcn.00413052
lea eax, [esp + 0x518]
push eax
push 0x459720
push 0x459c74
push str.Software
call fcn.004116a0
lea eax, [esp + 0xd38]
push eax
lea eax, [esp + 0x51c]
push eax
add ebx, 0x734
push ebx
push str.https:__www.nch.com.au_software_bug.html_softwareTempoPerfectversion5.01xiGUI__siid_sdata_s
mov esi, 0x825
lea edi, [esp + 0x1d98]
call fcn.00417ed8
add esp, 0x10
push 1
xor esi, esi
push esi
push esi
mov eax, edi
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp word [esp + 0x310], si
je 0x413389
push esi
push str.Uploading_Crash_Dump_File
lea eax, [esp + 0x28]
call fcn.0040e7e8
mov eax, dword [esp + 0x7d]
push esi
push str.Uploading_crash_dump_file
lea ecx, [esp + 0x85]
call dword [eax + 0x20]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x318]
push eax
lea eax, [esp + 0x89]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004308da
lea eax, [esp + 0x20]
call fcn.0040e824
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x413886
Capabilities:
Get common file path

Disassembly:
xor ecx, ecx
push eax
push ecx
push ecx
push 2
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
ret
Function at 0x41390c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
xor esi, esi
lea eax, [ebp - 0x264]
push eax
push esi
push esi
push 0x2e
push esi
mov word [ebp - 0x264], si
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x58
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00444dd0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x58
mov dword [ebp - 0x50], str.All_Files
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], 0x103
mov dword [ebp - 0x2c], str.Select_file_path
mov dword [ebp - 0x28], 0x8080c
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
neg eax
sbb eax, eax
neg eax
pop esi
leave
ret 0xc

Function at 0x413fe3
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x413ffc
xor al, al
jmp 0x41407d
push esi
mov ecx, 0x46b3ec
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.0040c3bc
jmp 0x414066
lea eax, [ebp - 0x254]
call fcn.0040c41a
test al, al
jne 0x41405b
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.0040151b
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x41404e
lea ecx, [ebp - 0x45c]
call fcn.00413fe3
jmp 0x41405b
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.0040c3f9
cmp dword [ebp - 0x254], 0xffffffff
jne 0x414011
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x414080
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
mov ebx, ecx
cmp word [ebx], 0
push edi
mov edi, edx
jne 0x41409c
xor al, al
jmp 0x414152
push esi
mov ecx, 0x46b3ec
mov eax, ebx
lea esi, [ebp - 0x258]
call fcn.0040c3bc
jmp 0x414109
lea eax, [ebp - 0x258]
call fcn.0040c41a
test al, al
jne 0x4140fe
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x460]
push eax
call fcn.0040151b
mov eax, dword [ebp - 0x254]
shr eax, 4
test al, 1
je 0x4140f0
mov edx, edi
lea ecx, [ebp - 0x460]
call fcn.00414080
jmp 0x4140fe
lea eax, [ebp - 0x460]
push eax
mov eax, edi
call fcn.00413676
lea esi, [ebp - 0x258]
call fcn.0040c3f9
cmp dword [ebp - 0x258], 0xffffffff
jne 0x4140b1
lea esi, [edi + 0x7f]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
shr esi, 7
jmp 0x414144
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41414f
cmp eax, 3
je 0x41414f
cmp dword [ebp - 4], esi
jbe 0x41414f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 4], esi
add esi, esi
push ebx
call edi
test eax, eax
je 0x414123
mov al, 1
jmp 0x414151
xor al, al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x414156
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x41416f
xor al, al
jmp 0x414202
push esi
mov ecx, 0x46b3ec
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.0040c3bc
jmp 0x4141eb
lea eax, [ebp - 0x254]
call fcn.0040c41a
test al, al
jne 0x4141e0
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.0040151b
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x4141c1
lea ecx, [ebp - 0x45c]
call fcn.00414156
jmp 0x4141e0
push 0x80
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.0040c3f9
cmp dword [ebp - 0x254], 0xffffffff
jne 0x414184
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x415203
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov esi, eax
call fcn.0040df3c
push 0x104
lea eax, [ebp - 0x208]
push eax
xor ebx, ebx
mov dword [esi], 0x47b568
push 0x59
mov byte [esi + 0x3a], bl
mov dword [esi + 0x3b], ebx
push 0x400
mov dword [esi + 0x3f], ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0x208], bx
mov edi, 0x4597fc
jne 0x415263
lea eax, [ebp - 0x208]
push eax
mov eax, edi
call fcn.00401016
mov ecx, edi
lea eax, [ebp - 0x208]
call fcn.00401031
test eax, eax
je 0x415292
lea eax, [ebp - 0x208]
push eax
call fcn.00415539
test al, al
jne 0x415292
lea eax, [ebp - 0x208]
call fcn.004150bc
mov dword [esi + 0x3f], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4155e5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x284]
push eax
call fcn.0040c2e2
push 7
pop ecx
push 0x459720
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x48c]
mov esi, str.Installer.exe
lea edi, [ebp - 0x78]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00413e38
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x48c]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 8]
lea eax, [ebp + 8]
push esi
push eax
call fcn.0040cac3
xor edi, edi
inc edi
cmp dword [ebp + 8], edi
je 0x4156e5
cmp dword [ebp + 8], 2
jne 0x415695
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
cmp word [eax], 0
je 0x415681
lea ecx, [ebp - 0x48c]
push ecx
push eax
push esi
lea eax, [ebp + 0x10]
push eax
call fcn.0040cac3
mov eax, dword [eax]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x4156e5
cmp eax, 2
jne 0x415695
push str.The_installer_could_not_be_downloaded.
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov dword [ebx], 2
jmp 0x4156e7
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00444dd0
mov dword [ebp - 0x30], edi
mov word [ebp - 0x2c], di
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
xor edi, edi
lea eax, [ebp - 0x5c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x48c]
push eax
push edi
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4156e5
push str.The_installer_could_not_be_run.
jmp 0x415686
mov dword [ebx], edi
lea ecx, [ebp - 0x284]
call fcn.00414156
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x415b24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb50
push ebx
push esi
push edi
lea eax, [ebp - 0x328]
push eax
push 0x46f058
lea edi, [ebp - 4]
mov dword [ebp - 4], 0x46f034
call fcn.0043c614
lea eax, [ebp - 0x328]
push eax
push str.https:__www.nch.com.au_metronome__s
mov esi, 0x104
lea edi, [ebp - 0x120]
call fcn.00417ebb
lea eax, [ebp - 0x224]
pop ecx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x120]
pop ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x103
lea edi, [ebp - 0x11f]
jmp 0x415b9a
push dword [ebp - 4]
lea esi, [ebp - 0x10]
call fcn.0043e18d
mov al, byte [edi]
inc edi
cmp al, bl
mov byte [ebp - 4], al
jne 0x415b8c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [eax + ecx], bl
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00415cda
lea eax, [ebp - 0x1c]
push 0x104
mov esi, eax
mov dword [ebp - 4], eax
call fcn.0043b05c
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x18], ebx
jne 0x415be5
mov eax, 0x459720
push eax
lea eax, [ebp - 4]
call fcn.0043be87
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
push dword [ebp - 0x10]
call fcn.0043f1ec
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
pop ecx
jne 0x415c0c
mov eax, 0x46b312
push eax
lea eax, [ebp - 0x224]
push eax
push 0x473820
push str.https:__www.nch.com.au_general_eulaconfirm.html_softwareTempoPerfectappname_sversion5.01bootstrapfalseinstaller_stests_s
mov esi, 0x825
lea edi, [ebp - 0xb50]
call fcn.00417ebb
add esp, 0x10
push 1
push ebx
push ebx
mov eax, edi
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [ebp - 0x1c]
call fcn.0043f1ec
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4164cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
call fcn.00416d32
test al, al
jne 0x4164ec
xor al, al
leave
ret
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41650c
push str.To_install_software_you_must_be_logged_on_as_this_computers_Administrator._If_you_are_not_able_to_do_this__ask_your_computer_Administrator_to_log_in_and_run_the_setup_file_again.
push 0
call fcn.0040e300
jmp 0x4164e8
call fcn.00410852
test al, al
je 0x4164e8
push 0xfffffffffffffffe
call fcn.0041e414
mov al, 1
leave
ret
Function at 0x416a66
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.0044c310
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x45c]
push eax
push edi
push edi
push 0x26
push edi
mov word [ebp - 0x45c], di
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x459720
push 0x459724
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x108c]
push eax
call fcn.00413e38
push str.NCH_Swift_Sound
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0xe84]
push eax
call fcn.0040151b
lea eax, [ebp - 0x664]
call fcn.0041373d
push str.NCH_SoftwareProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xc7c]
push eax
call fcn.0040151b
push str.NCH_Swift_SoundProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xa74]
push eax
call fcn.0040151b
xor ebx, ebx
cmp word [ebp - 0x108c], di
mov word [ebp - 0x86c], di
je 0x416b84
lea eax, [ebp - 0x108c]
mov ecx, 0x46b3ec
lea esi, [ebp - 0x254]
call fcn.0040c3bc
jmp 0x416b66
lea eax, [ebp - 0x254]
call fcn.0040c41a
test al, al
jne 0x416b5b
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x416b5b
mov ecx, str.Components
lea eax, [ebp - 0x224]
call fcn.00401031
test eax, eax
jne 0x416b8b
lea esi, [ebp - 0x254]
call fcn.0040c3f9
cmp dword [ebp - 0x254], 0xffffffff
jne 0x416b2b
inc ebx
mov eax, ebx
imul eax, eax, 0x208
lea eax, [ebp + eax - 0x108c]
cmp word [eax], di
jne 0x416b19
xor al, al
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x254], 0xffffffff
je 0x416ba0
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x416b86

Function at 0x416d32
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
cmp word [0x488338], 0
je 0x416d57
push dword [ebp + 8]
mov eax, 0x488338
call fcn.00401016
jmp 0x416e6c
push ebx
push esi
push edi
lea eax, [ebp - 0xa28]
call fcn.0041373d
mov esi, 0x459720
push esi
push 0x459724
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00413e38
push esi
push str.Program_Files
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00413e38
push esi
mov edi, 0x46b3ac
push edi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0xc30]
push eax
call fcn.00413e38
lea eax, [ebp - 0x820]
push eax
call fcn.00416e72
push esi
push edi
lea eax, [ebp - 0x820]
push eax
mov edi, 0x488338
push edi
call fcn.00413e38
push dword [ebp + 8]
mov eax, edi
call fcn.00401016
push str.InstalledByAdmin
push str.Settings
call fcn.00411703
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
push esi
push str.testfolder
push edi
lea eax, [ebp - 0x208]
push eax
call fcn.00413e38
push 0
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
je 0x416e3c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
push str.InstalledByAdmin
push str.Settings
call fcn.0040163a
jmp 0x416e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x416e4c
cmp eax, 5
jne 0x416e69
push edi
lea eax, [ebp - 0xc30]
call fcn.00401016
mov ecx, edi
call fcn.00413f98
push dword [ebp + 8]
mov eax, edi
call fcn.00401016
pop edi
pop esi
pop ebx
mov al, 1
leave
ret 4