joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce2f
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0xa5c
test eax, eax
push ebx
push esi
push edi
jne 0x40ce50
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x40cfd8
lea ecx, [eax + 0x10]
lea esi, [ebp - 0x238]
call fcn.0044a0a8
lea eax, [ebp - 0x850]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x850]
push eax
push str.TempFolder
push str.Settings
call fcn.00444aef
mov ebx, dword [ebp + 8]
push 0x54c6b0
push 0x54c894
lea eax, [ebp - 0x440]
push eax
add ebx, 0x8252
push str._s_s_s
mov edi, ebx
call fcn.0044b138
add esp, 0x10
push ebx
call fcn.00401d14
push str..mp3
lea eax, [ebp - 0x238]
push eax
push ebx
push dword [ebp + 0x14]
call fcn.0044a0d6
mov dword [ebp - 4], 1
jmp 0x40cf0c
push dword [ebp - 4]
lea eax, [ebp - 0x238]
push eax
push str._s_d
lea edi, [ebp - 0x648]
call fcn.0044b138
add esp, 0xc
push str..mp3
mov eax, edi
push eax
push ebx
push dword [ebp + 0x14]
call fcn.0044a0d6
inc dword [ebp - 4]
push dword [ebp + 0x14]
call fcn.00401d29
test al, al
jne 0x40cedb
mov eax, dword [ebp + 8]
push dword [eax + 4]
lea eax, [ebp - 0xa58]
push eax
call fcn.00405ab8
test al, al
je 0x40ce42
mov eax, dword [ebp + 0x10]
add eax, 8
lea edi, [ebp - 4]
mov dword [ebp + 0x10], eax
call fcn.00404af5
mov eax, dword [eax]
cdq
mov ecx, 0x3e8
idiv ecx
imul eax, eax, 0x5dc0
cdq
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x40cf79
or ecx, 0xffffffff
mov eax, SysReAllocString
jmp 0x40cf7f
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp edi, eax
jb 0x40cfa9
ja 0x40cf89
cmp esi, ecx
jb 0x40cfa9
mov eax, dword [ebp + 8]
push 0x2010
push str.Not_Enough_Free_Space
push 0x54c898
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40ce42
lea esi, [ebp - 0x18]
call fcn.0040784a
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call fcn.00421066
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x416dac
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x4c4
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
lea eax, [ebp - 0x208]
inc ebx
call fcn.004019f3
cmp byte [ebp + 0xc], 0
jne 0x416e94
push esi
lea edi, [ebp - 0x208]
call fcn.00419e53
test eax, eax
mov dword [ebp + 0xc], eax
mov edi, str..exe
jl 0x416e08
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00535c2f
test eax, eax
pop ecx
pop ecx
je 0x416e08
mov ebx, dword [ebp + 0xc]
jmp 0x416e97
and dword [ebp - 0x4c0], 0
push 0x2b0
lea eax, [ebp - 0x4bc]
push 0
push eax
call fcn.005251f0
add esp, 0xc
push pe_nt_image_headers32
push 0x2b4
lea eax, [ebp - 0x4c0]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp dword [ebp - 0x4c0], 0
je 0x416e97
push dword [ebp - 0x4c0]
push 0xffffffffffffffff
push dword [esi + 0x824a]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ebx, eax
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00535c2f
pop ecx
pop ecx
add esi, 0x824e
test eax, eax
push ebx
je 0x416e89
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.004215cf
jmp 0x416e97
push dword [ebp + 8]
push esi
call fcn.004215cf
jmp 0x416e97
push 2
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x418525
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
push esi
push edi
push str..iso
call fcn.00459bd3
push str..img
call fcn.00459bd3
push 0x55104c
call fcn.00459bd3
push str.CopyCD
push str.SoftwareNCH_Swift_SoundExpressBurnSettings
push SysReAllocString
call fcn.00401128
xor eax, eax
lea ecx, [ebp - 0x668]
push ecx
push eax
push eax
push 0x23
push eax
mov word [ebp - 0x668], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x53ec98
push str.NCH_SoftwareExpressBurnTemplates_vacation_list_en
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.0044a0d6
mov ecx, 0x548c7c
lea eax, [ebp - 0x460]
lea esi, [ebp - 0x258]
call fcn.00401d5c
jmp 0x4185f1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x460]
push eax
push 0x548be0
mov esi, 0x104
lea edi, [ebp - 0x870]
call fcn.0044b138
add esp, 0xc
push 0x80
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esi, [ebp - 0x258]
call fcn.00401d99
cmp dword [ebp - 0x258], 0xffffffff
jne 0x4185b2
call fcn.004492f3
push str.HandleCDBurningOnArrival
call fcn.0042ff9d
call fcn.004012f6
test al, al
je 0x41861c
push str.HandleDVDBurningOnArrival
call fcn.0042ff9d
pop edi
pop esi
leave
ret
Function at 0x41f19c
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
cmp byte [edi + 0x1d], 0
je 0x41f1de
push ebx
push esi
mov esi, dword [edi + 0x15]
push 0
mov ebx, 0x257f
push ebx
mov byte [edi + 0x1d], 0
call fcn.0047a58b
mov eax, dword [edi + 0x15]
push 0
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x15]
lea edi, [esi + 0x41]
call fcn.00404079
pop esi
pop ebx
pop edi
ret
Function at 0x423784
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4237e0
mov eax, dword [ebp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4237ae
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4237e2
xor al, al
pop ebx
pop ebp
ret 0x10

Function at 0x4237e7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallExpressBurn
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42382a
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push str.EstimatedSize
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 8

Function at 0x42820b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x5aa60a], 0
jne 0x428230
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x5aa60a], 1
add esp, 0x190

Function at 0x428760
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
push esi
mov esi, edx
jbe 0x42879a
push ebx
lea ebx, [ebx]
movzx ebx, byte [esi]
mov edx, eax
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
and edx, 0xff
sub ecx, 1
add esi, 1
xor bx, word [edx*2 + 0x53ee70]
test ecx, ecx
movzx eax, bx
ja 0x428770
pop ebx
pop esi
ret

Function at 0x42a80d
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0x10]
push eax
mov ebx, 0xf003f
push ebx
push 0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x42a851
push str.UninstallExpressBurn
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push edi
push SysReAllocString
call esi
test eax, eax
jne 0x42a87a
push str.UninstallExpressBurn
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x42a8dc
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
call fcn.004012f6
test al, al
je 0x42a929
push str._usermode
call fcn.0044b3a8
test al, al
je 0x42a929
call fcn.0044b1eb
test al, al
je 0x42a929
cmp byte [ebp + 8], 0
mov eax, str._uninstall__quiet
jne 0x42a915
mov eax, str._uninstall
push 1
push eax
mov eax, dword [0x5a9cc0]
push dword [eax]
call fcn.0045a8c5
jmp 0x42aa30
push esi
lea eax, [ebp - 0x244]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x53ec98
push esi
push str.nchuninst
lea eax, [ebp - 0x244]
push eax
push eax
call fcn.0044a0d6
lea ecx, [ebp - 0x244]
call fcn.0044a673
lea ecx, [ebp - 0x244]
call fcn.0044a4b7
push esi
push str.uninst.exe
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x44c]
push eax
mov eax, dword [0x5a9cc0]
push dword [eax]
call fcn.00401c07
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005251f0
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x2c], eax
add esp, 0xc
cmp byte [ebp + 8], 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], str._uninstall2__quiet
jne 0x42a9d8
mov dword [ebp - 0x28], str._uninstall2
mov dword [ebp - 0x20], 1
call fcn.004012f6
test al, al
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
je 0x42aa22
mov eax, dword [0x5a9cc0]
mov ecx, dword [eax]
lea eax, [ebp - 0x654]
call fcn.00401963
lea eax, [ebp - 0x654]
push eax
call fcn.00401f7b
test al, al
jne 0x42aa22
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], str.runas
call esi
cmp eax, 1
je 0x42aa2f
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x5675cc
call esi
pop esi
leave
ret 4

Function at 0x42aa34
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push esi
je 0x42aa60
call fcn.0044f1fa
test al, al
jne 0x42ab05
call fcn.0044c9d3
test al, al
jne 0x42ab05
cmp byte [ebp + 8], bl
mov byte [ebp - 5], bl
jne 0x42aa75
lea eax, [ebp - 5]
push eax
call fcn.0045a6c7
test al, al
je 0x42aab8
push 0x5a9a38
call fcn.0045818f
mov al, byte [ebp - 5]
mov byte [ebp - 5], al
lea eax, [ebp - 5]
push eax
call fcn.00443f1d
test al, al
je 0x42aab8
cmp byte [ebp + 8], bl
jne 0x42aab3
push 0x40
push 0xfffd
push str.Uninstall_Completed
push str.Uninstall_is_complete._We_are_sorry_to_see_you_go._If_you_change_your_mind_and_decide_to_reinstall_Express_Burn__please_visit_www.nchsoftware.com.
push ebx
mov ecx, str.Close
call fcn.0046eae8
call fcn.004423d3
mov eax, dword [0x5a9cc0]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push ebx
push dword [eax]
call esi
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x53ec98
push str.nchuninst
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0044a0d6
push 5
push ebx
lea eax, [ebp - 0x41c]
push eax
call esi
pop esi
pop ebx
leave
ret 4
Function at 0x42ab0b
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
push str.LQUIET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
neg eax
add esp, 0x208
ret

Function at 0x42b51d
Capabilities:
Copy file
Create directory
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1954
call fcn.0052d050
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [eax + 0x883], bl
push esi
push edi
jne 0x42b544
xor al, al
jmp 0x42bef4
push str.template
add eax, 4
lea esi, [esp + 0x74]
call fcn.00455dc2
mov eax, dword [esp + 0x70]
invalid

Function at 0x42c250
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa34
push ebx
push esi
push edi
mov esi, 0x2712
push esi
mov edi, eax
call fcn.00402fa6
cmp eax, 0xffffffff
je 0x42c43f
push esi
push edi
call fcn.00402ee0
mov ebx, eax
test ebx, ebx
je 0x42c43f
cmp byte [ebx + 0x883], 0
je 0x42c43f
mov eax, dword [edi + 0x21f]
mov edi, dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x14], edi
call dword [eax + 4]
mov esi, eax
add esi, 0x4a7
call fcn.0041f81f
and dword [esp + 0x10], 0
mov ecx, edi
call fcn.0040657a
test eax, eax
jbe 0x42c2ed
push dword [esp + 0x10]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov esi, eax
add esi, 0x4a7
call fcn.0041f81f
inc dword [esp + 0x10]
mov ecx, edi
call fcn.0040657a
cmp dword [esp + 0x10], eax
jb 0x42c2c4
push 0
push edi
push ebx
call fcn.0042b51d
push str.BaseFolder
mov esi, str.template
lea eax, [ebx + 4]
push esi
call fcn.00455c6a
call fcn.00455c6a
test eax, eax
jne 0x42c335
push str.BaseFolder
push esi
lea eax, [ebx + 4]
call fcn.00455c6a
mov edi, eax
call fcn.00455cef
lea ecx, [ebx + 0x19]
push ecx
push eax
call fcn.00405818
mov edi, dword [esp + 0x14]
and word [esp + 0x220], 0
and word [esp + 0x18], 0
push str.templates.current
lea esi, [esp + 0x1c]
call fcn.00449edc
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x53ec98
push str.template.xml
mov eax, esi
push eax
lea eax, [esp + 0x22c]
push eax
call fcn.0044a0d6
push str.Current
push str.name
lea esi, [ebx + 4]
push str.template
mov eax, esi
call fcn.00455c6a
call fcn.00455c6a
push eax
call fcn.00405818
push 0x3e8
push 2
push 0
push 0xc0000000
lea eax, [esp + 0x230]
push eax
call fcn.00449134
push ecx
mov ecx, esp
mov dword [esp + 0x14], eax
mov dword [ecx], eax
mov eax, esi
call fcn.00427204
cmp word [ebx + 0x67a], 0
je 0x42c425
push str.templates.current
lea esi, [esp + 0x42c]
call fcn.00449edc
lea esi, [ebx + 0x67a]
mov ecx, esi
lea eax, [esp + 0x630]
call fcn.004019a9
push 0x53ec98
lea eax, [esp + 0x634]
push eax
lea eax, [esp + 0x430]
push eax
lea eax, [esp + 0x844]
push eax
call fcn.0044a0d6
lea eax, [esp + 0x838]
push eax
push esi
call fcn.00401c07
cmp dword [esp + 0x10], 0xffffffff
mov eax, dword [ebx + 0x429]
mov dword [edi + 9], eax
je 0x42c43f
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c488
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc8
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
xor ebx, ebx
lea eax, [ebp - 0x29c]
push eax
push ebx
push ebx
push 0x27
push ebx
mov word [ebp - 0x29c], bx
call esi
cmp word [ebp - 0x29c], bx
jne 0x42c4cf
lea eax, [ebp - 0x29c]
push eax
push ebx
push ebx
push 5
push ebx
mov word [ebp - 0x29c], bx
call esi
push 0x1e
pop ecx
mov esi, str.Supported_Image_Files
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x8b4]
push eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x29c]
push eax
mov edi, str.ImageDir
push edi
mov esi, str.Settings
push esi
mov word [ebp - 0x4a4], bx
call fcn.00444aef
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push ebx
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x8b4]
push ecx
push str.Select_a_new_background_image_for_the_menu
lea ecx, [ebp - 0x4a4]
push ecx
push eax
mov eax, 0x5687f0
call fcn.00449a64
test al, al
je 0x42c680
lea eax, [ebp - 0x8b4]
push eax
push edi
push esi
call fcn.00444b22
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1de]
call fcn.0045ed50
mov esi, 0x2712
push esi
mov eax, edi
call fcn.00402fa6
cmp eax, 0xffffffff
je 0x42c680
push esi
push edi
call fcn.00402ee0
cmp eax, ebx
je 0x42c680
cmp byte [eax + 0x883], bl
je 0x42c680
push str.template
add eax, 4
lea esi, [ebp - 0xc]
call fcn.00455d30
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x42c680
cmp dword [eax], ebx
setne cl
cmp cl, bl
je 0x42c680
mov eax, dword [eax]
push str.menu
lea esi, [ebp - 0xc]
call fcn.00455d30
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x42c60f
cmp dword [eax], ebx
setne cl
cmp cl, bl
je 0x42c60f
mov eax, dword [eax]
push str.background
lea esi, [ebp - 0x14]
call fcn.00455d30
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x42c605
cmp dword [eax], ebx
setne cl
cmp cl, bl
je 0x42c605
mov eax, dword [eax]
lea ecx, [ebp - 0x4a4]
push ecx
push str.file
add eax, 5
push eax
call fcn.0041ec22
lea esi, [ebp - 0xc]
call fcn.00455d84
jmp 0x42c5bf
lea ecx, [ebp - 0x4a4]
lea eax, [ebp - 0xcc4]
mov word [ebp - 0x6ac], bx
mov word [ebp - 0xabc], bx
call fcn.004019a9
push str.templates.current
lea esi, [ebp - 0x6ac]
call fcn.00449edc
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x53ec98
lea eax, [ebp - 0xcc4]
push eax
mov eax, esi
push eax
lea eax, [ebp - 0xabc]
push eax
call fcn.0044a0d6
push ebx
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
mov esi, edi
call fcn.0042cf09
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42c926
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8b4
and word [esp + 0x4a4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.templates
lea esi, [esp + 0x4b4]
call fcn.00449edc
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x53ec98
push str.templates.xml
mov eax, esi
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.0044a0d6
lea eax, [esp + 0x120]
push eax
call fcn.00401d29
test al, al
je 0x42c996
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx + 4]
push str.Downloading_manifest
lea eax, [esp + 0x32c]
call fcn.00403ee5
push 1
lea eax, [esp + 0x124]
push eax
push str.http:__www.nch.com.au_components_ebtemplates_templates.xml
lea edx, [esp + 0x426]
lea ecx, [esp + 0x18]
call fcn.00488f5c
mov esi, dword [eax]
lea eax, [esp + 0x328]
call fcn.00403f96
cmp esi, 2
jne 0x42c9f9
push 0x2010
push str.Network_Error
push str.Could_not_connect_to_server._Make_sure_this_computer_has_an_active_internet_connection_or_try_again_at_a_later_time.
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42ca80
lea eax, [esp + 0x6b8]
push eax
lea eax, [esp + 0x124]
push eax
lea esi, [esp + 0x18]
call fcn.004058fd
push str.templates
mov eax, esi
call fcn.00455c6a
test eax, eax
jne 0x42ca3c
push 0x2010
push str.Error
push str.Could_not_resolve_templates_to_download_at_this_time._Please_try_again_at_a_later_time.
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42ca77
lea eax, [esp + 0x28]
call fcn.0042ca89
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x28]
push ecx
push fcn.0047e33a
push eax
push 0x47
push dword [0x5a9cd0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x42ca6d
mov eax, ebx
call fcn.0042cd99
lea eax, [esp + 0x28]
push eax
call fcn.0042caed
lea esi, [esp + 0x10]
call fcn.0040578b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e8bb
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc3c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, str.infozip3
push esi
push ebx
mov edi, eax
call fcn.0044524a
lea eax, [esp + 0x428]
push eax
push esi
push ebx
call fcn.00405ae3
test al, al
jne 0x42e90e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov esi, dword [edi + 4]
neg al
sbb eax, eax
inc eax
inc eax
mov ebx, eax
call fcn.004e54d1
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x42ea6d
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x42ea67
cmp dword [ebx], 0
setne al
test al, al
je 0x42ea67
mov eax, dword [ebx]
test eax, eax
setne cl
test cl, cl
je 0x42ea40
add eax, 4
push eax
push str.Downloading__s...
mov esi, 0x104
lea edi, [esp + 0x638]
call fcn.0044b138
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0
mov edx, edi
push edx
call dword [eax + 0x20]
push str.templates
lea esi, [esp + 0x224]
call fcn.00449edc
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebx]
mov esi, 0x414
add eax, esi
push eax
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00401dde
mov eax, dword [ebx]
add eax, esi
push eax
push str.http:__www.nch.com.au_components_ebtemplates__s
mov esi, 0x104
lea edi, [esp + 0x430]
call fcn.0044b138
pop ecx
pop ecx
push 1
lea eax, [esp + 0x1c]
push eax
mov eax, edi
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.004285f3
cmp dword [esp + 0x10], 0
je 0x42e9ed
cmp dword [ebx], 0
je 0x42e927
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
mov dword [ebx], ecx
call fcn.0052009d
pop ecx
jmp 0x42e927
mov eax, dword [ebx]
add eax, 0x20c
push eax
call fcn.00401d14
mov esi, dword [ebx]
lea eax, [esp + 0x838]
push eax
lea eax, [esp + 0x1c]
call fcn.00401016
lea ecx, [esp + 0xa40]
lea eax, [esi + 0x20c]
push ecx
call fcn.00401016
lea eax, [esp + 0x838]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0045bb73
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x42ea5c
mov eax, dword [ebx]
test eax, eax
je 0x42e911
mov ebx, eax
jmp 0x42e911
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x42ea6d
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42efe2
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [ebx + 8]
mov eax, dword [esi]
test eax, eax
je 0x42effb
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x42f049
and dword [ebp + 8], 0
push edi
lea eax, [ebp + 8]
push eax
push 0x53ff80
push 1
push 0
push 0x53fda0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, dword [ebp + 8]
test edi, edi
je 0x42f048
mov eax, dword [esi]
test eax, eax
je 0x42f02e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
mov eax, dword [edi]
push 0
push esi
add ebx, 0xc
push ebx
push edi
call dword [eax + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x42f048
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x440146
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x110
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x440155
sub eax, edx
sar eax, 1
push ebx
mov ebx, eax
je 0x44026e
push dword [ebp + 8]
lea eax, [ebp - 0x110]
call fcn.00423e39
push 0x12
mov ecx, 0x56abf8
pop edx
mov eax, edi
sub ecx, edi
push esi
mov esi, dword [ecx + eax]
mov dword [eax], esi
add eax, 4
dec edx
jne 0x440187
mov eax, 0x56ac40
lea ecx, [edi + 0x48]
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x44019f
cmp eax, 0x56bc40
jl 0x44019a
xor esi, esi
mov dword [ebp + 8], esi
lea eax, [esi + 1]
cdq
idiv ebx
lea eax, [esi + 2]
movzx ecx, byte [ebp + edx - 0x110]
cdq
idiv ebx
mov ch, byte [ebp + esi - 0x110]
shl ecx, 8
movzx eax, byte [ebp + edx - 0x110]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x110]
or ecx, eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax*4]
xor dword [eax], ecx
lea eax, [esi + 4]
cdq
idiv ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x12
mov esi, edx
jl 0x4401b8
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 4]
mov eax, edi
call fcn.00440273
mov eax, dword [ebp + 8]
mov dword [edi + ebx*4], eax
mov eax, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
inc ebx
inc ebx
cmp ebx, 0x12
jl 0x440214
lea ebx, [edi + 0x4c]
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0x80
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 4]
mov eax, edi
call fcn.00440273
mov eax, dword [ebp + 8]
mov dword [ebx - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
add ebx, 8
dec dword [ebp - 8]
jne 0x440247
dec dword [ebp - 0xc]
jne 0x440240
pop esi
pop ebx
leave
ret 4