joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fce9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8e64
call fcn.0059fbd0
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc48]
mov dword [ebp - 0xc], edi
call fcn.004a20d8
push str..dmp
push 0x5b0844
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004a2dab
lea esi, [edi + 0x31c]
push dword [esi]
xor ebx, ebx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x428]
push ecx
push dword [edi + 0x320]
mov dword [ebp - 4], eax
push dword [esi]
push eax
lea eax, [ebp - 0xc]
call fcn.0049f89b
test al, al
jne 0x49fd68
mov word [ebp - 0x428], bx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x944], ebx
jne 0x49fd9f
lea eax, [ebp - 0x220]
push eax
push str.VersionCheckAfterCrash
push 0x5bbe1c
mov word [ebp - 0x220], 0x31
mov word [ebp - 0x21e], bx
call fcn.00457b57
lea eax, [edi + 0x52c]
test eax, eax
je 0x49ff5f
mov eax, dword [edi + 0x944]
cmp eax, ebx
je 0x49fdeb
jge 0x49fddd
neg eax
push eax
push str.https:__www.nch.com.au_switch_ko_kb__d.html
mov esi, 0x104
lea edi, [ebp - 0x630]
call fcn.004a9039
pop ecx
pop ecx
mov eax, edi
push eax
call fcn.004010ca
jmp 0x49fde3
push eax
call fcn.004a9b17
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004ae412
push 0x5bcd74
push 0x5e4348
push str.Switch______._r_n_r_n_______________.__
mov eax, 0x5e3cdc
call fcn.0045af81
test al, al
je 0x49ff5f
cmp word [ebp - 0x428], bx
jne 0x49fe23
mov word [ebp - 0x220], bx
jmp 0x49fe9f
push ebx
call fcn.00590318
pop ecx
mov dword [ebp - 4], eax
call fcn.004478f3
add dword [ebp - 4], eax
lea esi, [ebp - 0x630]
lea eax, [ebp - 4]
call fcn.004477b2
lea esi, [ebp - 0x838]
lea eax, [ebp - 4]
call fcn.004477f7
call fcn.004a8fa9
call fcn.00591a41
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [ebp - 0x428]
push eax
mov esi, edx
call fcn.004019f9
test eax, eax
push esi
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x220]
jne 0x49fe91
push str.zero__s__s__04d.dmp
jmp 0x49fe96
push str._s__s__04d.dmp
push eax
call fcn.00401000
add esp, 0x14
push dword [edi + 0x940]
lea eax, [ebp - 0x220]
push dword [edi + 0x93c]
push eax
lea eax, [ebp - 0x4e58]
push eax
call fcn.0049fbd6
lea eax, [ebp - 0xa40]
push eax
push 0x5b07d8
push 0x5dbe18
push str.Software
call fcn.00457b24
lea eax, [ebp - 0xe50]
push eax
call fcn.004a1464
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0x4e58]
push eax
lea eax, [ebp - 0xa40]
push eax
add edi, 0x734
push edi
push str.https:__www.nch.com.au_software_ko_bug.html_softwareSwitchversion11.19langkoxiGUI__siid_sdata_sappbits32rdf_s
mov esi, 0x2002
lea edi, [ebp - 0x8e60]
call fcn.004a9039
add esp, 0x14
mov eax, edi
push eax
call fcn.004010ca
cmp word [ebp - 0x428], bx
je 0x49ff5f
push ebx
push 0x5e3ef8
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0x5c8654
call dword [0x5c8674]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004c79b6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a026c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [esi], ebx
je 0x4a042d
cmp dword [esi + 4], ebx
jne 0x4a0293
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4a042d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call edi
push str.SymCleanup
push dword [esi + 4]
mov dword [esi + 0x2c], eax
call edi
push str.StackWalk64
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.SymGetOptions
push dword [esi + 4]
mov dword [esi + 0x38], eax
call edi
push str.SymSetOptions
push dword [esi + 4]
mov dword [esi + 0x24], eax
call edi
push str.SymFunctionTableAccess64
push dword [esi + 4]
mov dword [esi + 0x34], eax
call edi
push str.SymGetLineFromAddr64
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.SymGetModuleBase64
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.SymGetModuleInfo64
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x4a0332
call fcn.004a9266
test al, al
je 0x4a0332
push str.SymGetModuleInfo
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
push str.SymGetSymFromAddr64
push dword [esi + 4]
call edi
push str.UnDecorateSymbolName
push dword [esi + 4]
mov dword [esi + 0x28], eax
call edi
push str.SymLoadModule64
push dword [esi + 4]
mov dword [esi + 0x3c], eax
call edi
push str.SymGetSearchPath
push dword [esi + 4]
mov dword [esi + 0x30], eax
call edi
cmp dword [esi + 0x10], ebx
mov dword [esi + 0x40], eax
pop edi
je 0x4a041e
cmp dword [esi + 0x14], ebx
je 0x4a041e
cmp dword [esi + 0x1c], ebx
je 0x4a041e
cmp dword [esi + 0x20], ebx
je 0x4a041e
cmp dword [esi + 0x24], ebx
je 0x4a041e
cmp dword [esi + 0x28], ebx
je 0x4a041e
cmp dword [esi + 0x2c], ebx
je 0x4a041e
cmp dword [esi + 0x34], ebx
je 0x4a041e
cmp dword [esi + 0x38], ebx
je 0x4a041e
cmp dword [esi + 0x3c], ebx
je 0x4a041e
cmp dword [esi + 0x30], ebx
je 0x4a041e
cmp dword [ebp + 8], ebx
je 0x4a03e6
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a03c1
sub eax, edx
inc eax
push eax
call fcn.00591b73
cmp eax, ebx
pop ecx
mov dword [esi + 0xc], eax
je 0x4a03e6
mov edx, dword [ebp + 8]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x4a03dc
push ebx
push dword [esi + 0xc]
push dword [esi + 8]
call dword [esi + 0x2c]
call dword [esi + 0x24]
or eax, 0x210
push eax
call dword [esi + 0x34]
mov eax, dword [esi + 0x40]
cmp eax, ebx
mov byte [ebp - 0x400], bl
je 0x4a041a
push 0x400
lea ecx, [ebp - 0x400]
push ecx
push dword [esi + 8]
call eax
mov al, 1
jmp 0x4a042f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
xor al, al
pop ebx
leave
ret 4
Function at 0x4a161c
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x110
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a162b
sub eax, edx
sar eax, 1
push ebx
mov ebx, eax
je 0x4a1744
push dword [ebp + 8]
lea eax, [ebp - 0x110]
call fcn.004471b7
push 0x12
mov ecx, 0x5e4a48
pop edx
mov eax, edi
sub ecx, edi
push esi
mov esi, dword [ecx + eax]
mov dword [eax], esi
add eax, 4
dec edx
jne 0x4a165d
mov eax, 0x5e4a90
lea ecx, [edi + 0x48]
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x4a1675
cmp eax, str._d__lu___d
jl 0x4a1670
xor esi, esi
mov dword [ebp + 8], esi
lea eax, [esi + 1]
cdq
idiv ebx
lea eax, [esi + 2]
movzx ecx, byte [ebp + edx - 0x110]
cdq
idiv ebx
mov ch, byte [ebp + esi - 0x110]
shl ecx, 8
movzx eax, byte [ebp + edx - 0x110]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x110]
or ecx, eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax*4]
xor dword [eax], ecx
lea eax, [esi + 4]
cdq
idiv ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x12
mov esi, edx
jl 0x4a168e
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 4]
mov eax, edi
call fcn.004a1749
mov eax, dword [ebp + 8]
mov dword [edi + ebx*4], eax
mov eax, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
inc ebx
inc ebx
cmp ebx, 0x12
jl 0x4a16ea
lea ebx, [edi + 0x4c]
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0x80
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 4]
mov eax, edi
call fcn.004a1749
mov eax, dword [ebp + 8]
mov dword [ebx - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
add ebx, 8
dec dword [ebp - 8]
jne 0x4a171d
dec dword [ebp - 0xc]
jne 0x4a1716
pop esi
pop ebx
leave
ret 4

Function at 0x4a1fde
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
push 0x18
mov ebx, 0xbb8
pop edi
jmp 0x4a200b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4a201d
cmp ebx, edi
jbe 0x4a201d
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, edi
add edi, edi
push dword [esp + 0x14]
push dword [esp + 0x14]
call esi
test eax, eax
je 0x4a1ff1
mov al, 1
jmp 0x4a201f
xor al, al
pop edi
pop esi
pop ebx
ret 8

Function at 0x4a2025
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push 0x18
mov ebx, 0xbb8
pop edi
jmp 0x4a2052
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4a2066
cmp ebx, edi
jbe 0x4a2066
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, edi
add edi, edi
push 3
push dword [esp + 0x18]
push dword [esp + 0x18]
call esi
test eax, eax
je 0x4a2038
mov al, 1
jmp 0x4a2068
xor al, al
pop edi
pop esi
pop ebx
ret 8

Function at 0x4a21ac
Capabilities:
Get common file path

Disassembly:
xor ecx, ecx
push eax
push ecx
push ecx
push 2
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
ret
Function at 0x4a3166
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x4a317f
xor al, al
jmp 0x4a3200
push esi
mov ecx, 0x5b086c
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.00401d9a
jmp 0x4a31e9
lea eax, [ebp - 0x254]
call fcn.00401df8
test al, al
jne 0x4a31de
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401f2d
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x4a31d1
lea ecx, [ebp - 0x45c]
call fcn.004a3166
jmp 0x4a31de
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.00401dd7
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4a3194
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x4a3203
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
mov ebx, ecx
cmp word [ebx], 0
push edi
mov edi, edx
jne 0x4a321f
xor al, al
jmp 0x4a32d5
push esi
mov ecx, 0x5b086c
mov eax, ebx
lea esi, [ebp - 0x258]
call fcn.00401d9a
jmp 0x4a328c
lea eax, [ebp - 0x258]
call fcn.00401df8
test al, al
jne 0x4a3281
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x460]
push eax
call fcn.00401f2d
mov eax, dword [ebp - 0x254]
shr eax, 4
test al, 1
je 0x4a3273
mov edx, edi
lea ecx, [ebp - 0x460]
call fcn.004a3203
jmp 0x4a3281
lea eax, [ebp - 0x460]
push eax
mov eax, edi
call fcn.004a1fa0
lea esi, [ebp - 0x258]
call fcn.00401dd7
cmp dword [ebp - 0x258], 0xffffffff
jne 0x4a3234
lea esi, [edi + 0x7f]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
shr esi, 7
jmp 0x4a32c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4a32d2
cmp eax, 3
je 0x4a32d2
cmp dword [ebp - 4], esi
jbe 0x4a32d2
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 4], esi
add esi, esi
push ebx
call edi
test eax, eax
je 0x4a32a6
mov al, 1
jmp 0x4a32d4
xor al, al
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4a32d9
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x4a32f2
xor al, al
jmp 0x4a3385
push esi
mov ecx, 0x5b086c
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.00401d9a
jmp 0x4a336e
lea eax, [ebp - 0x254]
call fcn.00401df8
test al, al
jne 0x4a3363
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401f2d
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x4a3344
lea ecx, [ebp - 0x45c]
call fcn.004a32d9
jmp 0x4a3363
push 0x80
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.00401dd7
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4a3307
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret
Function at 0x4a3388
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6fc
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
push edi
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jne 0x4a33b9
mov dword [ebx], 2
mov eax, ebx
jmp 0x4a35b2
push esi
call fcn.00401b98
test al, al
je 0x4a33ac
mov eax, dword [edi]
push 0
push 0x5befa0
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
test al, al
je 0x4a33e3
mov dword [ebx], 1
jmp 0x4a33b2
mov edi, 0x5b086c
mov eax, esi
mov ecx, edi
lea esi, [esp + 0x4b0]
xor ebx, ebx
call fcn.00401d9a
jmp 0x4a3419
lea eax, [esp + 0x4b0]
call fcn.00401df8
test al, al
jne 0x4a340d
inc ebx
lea esi, [esp + 0x4b0]
call fcn.00401dd7
cmp dword [esp + 0x4b0], 0xffffffff
jne 0x4a33fc
push 0
call fcn.00590318
test ebx, ebx
pop ecx
mov dword [esp + 0x20], eax
jbe 0x4a35ab
fldz
mov dword [esp + 0x14], ebx
fstp qword [esp + 0x18]
fild dword [esp + 0x14]
jge 0x4a344d
fadd qword [0x60d1e8]
fld1
mov eax, dword [ebp + 8]
fdivrp st(1)
mov ecx, edi
lea esi, [esp + 0x50]
fstp qword [esp + 0x30]
call fcn.00401d9a
or edi, 0xffffffff
cmp dword [esp + 0x50], edi
je 0x4a35ab
xor ebx, ebx
inc ebx
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
test al, al
jne 0x4a3530
lea eax, [esp + 0x50]
call fcn.00401df8
test al, al
jne 0x4a3598
lea eax, [esp + 0x80]
push eax
push dword [ebp + 8]
lea eax, [esp + 0x2b0]
push eax
call fcn.00401f2d
mov eax, dword [esp + 0x54]
shr eax, 4
test bl, al
lea eax, [esp + 0x2a8]
je 0x4a354a
fld qword [esp + 0x18]
push dword [ebp + 0xc]
fstp qword [esp + 0x44]
lea edx, [esp + 0x3c]
fld qword [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
fstp qword [esp + 0x50]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], 0x5c8684
call fcn.004a3388
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4a3524
lea eax, [esp + 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4a3516
and dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
jmp 0x4a3522
mov dword [esp + 0x14], 2
lea eax, [esp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
jne 0x4a357c
mov dword [esp + 0x38], 0x608e7c
cmp dword [esp + 0x50], edi
mov esi, dword [esp + 0x10]
mov dword [esi], ebx
je 0x4a3546
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x4a35b2
push eax
call fcn.00401ee5
mov ecx, dword [esp + 0x20]
sub ecx, dword [ebp + 0xc]
cmp eax, ecx
jg 0x4a357c
push 0x80
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
fld qword [esp + 0x30]
mov eax, dword [esi]
fadd qword [esp + 0x18]
push ecx
push ecx
mov ecx, esi
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fstp qword [esp]
call dword [eax + 0x24]
lea esi, [esp + 0x50]
call fcn.00401dd7
cmp dword [esp + 0x50], edi
jne 0x4a3473
mov eax, dword [esp + 0x10]
and dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a3d32
Capabilities:
Empty the recycle bin
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax]
cmp eax, 0xffffffff
je 0x4a3e28
cmp eax, 0x12c
je 0x4a3dfb
cmp eax, 0x12d
je 0x4a3df7
cmp eax, 0x12e
je 0x4a3dd8
cmp eax, 0x12f
je 0x4a3e23
cmp eax, 0x130
jne 0x4a3e37
mov edi, dword [esi + 4]
push 0x5e5c34
lea eax, [ebp - 0x188]
call fcn.00404863
lea eax, [ebp - 0x390]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x278d00
lea eax, [ebp - 0x390]
push eax
lea edx, [ebp - 0x9a]
lea ecx, [ebp - 4]
call fcn.004a3388
push str.LowDiskSpc
call fcn.004a9c14
lea eax, [ebp - 0x188]
call fcn.00404912
push 2
pop eax
jmp 0x4a3e39
lea edx, [esi + 8]
lea edi, [ebp - 0x390]
call fcn.00401671
mov eax, edi
push eax
call fcn.004a9048
mov ecx, esi
call fcn.004a3d32
jmp 0x4a3e39
push 3
jmp 0x4a3dd5
mov esi, dword [esi + 4]
push 5
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
test eax, eax
mov esi, str.LowDiskSpc
jne 0x4a3e18
push esi
call fcn.004a9c14
push esi
mov eax, str.EmptyRecycleBin
call fcn.004a9c36
xor eax, eax
inc eax
jmp 0x4a3e39
push str.LowDiskSpc
mov eax, str.NoFreeSpace
call fcn.004a9c36
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4a45ff
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov esi, eax
call fcn.004059e9
xor ebx, ebx
lea eax, [esi + 0xcb]
mov dword [esi], 0x609640
mov byte [eax], bl
mov dword [eax + 1], ebx
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x59
push 0x400
mov dword [esi + 0xd0], ebx
mov word [ebp - 0x208], bx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0x208], bx
mov edi, 0x5daf70
jne 0x4a4667
lea eax, [ebp - 0x208]
push eax
mov eax, edi
call fcn.00401016
mov ecx, edi
lea eax, [ebp - 0x208]
call fcn.0040106a
test eax, eax
je 0x4a4699
lea eax, [ebp - 0x208]
push eax
call fcn.004a498e
test al, al
jne 0x4a4699
lea eax, [ebp - 0x208]
call fcn.004a4592
mov dword [esi + 0xd0], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a4a89
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x494
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [esp + 0x90]
push eax
call fcn.00401aa4
push 7
pop ecx
push 0x5b07d8
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x2a4]
mov esi, str.Installer.exe
lea edi, [esp + 0x80]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004a2dab
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x298]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 8]
lea eax, [esp + 0x18]
push esi
push eax
call fcn.0044d2c2
xor edi, edi
inc edi
cmp dword [esp + 0x10], edi
je 0x4a4ba3
cmp dword [esp + 0x10], 2
jne 0x4a4b4b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
cmp word [eax], 0
je 0x4a4b37
lea ecx, [esp + 0x298]
push ecx
push eax
push esi
lea eax, [esp + 0x20]
push eax
call fcn.0044d2c2
mov eax, dword [eax]
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x4a4ba3
cmp eax, 2
jne 0x4a4b4b
push 0x5e6130
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov dword [ebx], 2
jmp 0x4a4ba5
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.005970f0
mov dword [esp + 0x60], edi
mov word [esp + 0x64], di
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
xor edi, edi
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2b8]
push eax
push edi
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4a4ba3
push 0x5e6160
jmp 0x4a4b3c
mov dword [ebx], edi
lea ecx, [esp + 0x90]
call fcn.004a32d9
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a577c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
call fcn.004a6261
test al, al
jne 0x4a5799
xor al, al
leave
ret
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a57ca
push 0x10
push 0xfffe
push 0x5e76e4
push 0x5e7808
push 0
mov ecx, 0x5bf5a4
call fcn.0045aac8
jmp 0x4a5795
call fcn.0045680e
test al, al
je 0x4a5795
push 0xfffffffffffffffe
call fcn.004b2f42
mov al, 1
leave
ret
Function at 0x4a5c8c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.0059fbd0
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x45c]
push eax
push edi
push edi
push 0x26
push edi
mov word [ebp - 0x45c], di
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x5b07d8
push 0x5b0828
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x108c]
push eax
call fcn.004a2dab
push str.NCH_Swift_Sound
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0xe84]
push eax
call fcn.00401f2d
lea eax, [ebp - 0x664]
call fcn.004a20d8
push str.NCH_SoftwareProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xc7c]
push eax
call fcn.00401f2d
push str.NCH_Swift_SoundProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xa74]
push eax
call fcn.00401f2d
xor ebx, ebx
cmp word [ebp - 0x108c], di
mov word [ebp - 0x86c], di
je 0x4a5daa
lea eax, [ebp - 0x108c]
mov ecx, 0x5b086c
lea esi, [ebp - 0x254]
call fcn.00401d9a
jmp 0x4a5d8c
lea eax, [ebp - 0x254]
call fcn.00401df8
test al, al
jne 0x4a5d81
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x4a5d81
mov ecx, str.Components
lea eax, [ebp - 0x224]
call fcn.0040106a
test eax, eax
jne 0x4a5db1
lea esi, [ebp - 0x254]
call fcn.00401dd7
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4a5d51
inc ebx
mov eax, ebx
imul eax, eax, 0x208
lea eax, [ebp + eax - 0x108c]
cmp word [eax], di
jne 0x4a5d3f
xor al, al
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x254], 0xffffffff
je 0x4a5dc6
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x4a5dac
Function at 0x4a6261
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
cmp word [0x6235e8], 0
je 0x4a6286
push dword [ebp + 8]
mov eax, 0x6235e8
call fcn.00401016
jmp 0x4a63b8
push ebx
push esi
push edi
lea eax, [ebp - 0x618]
push eax
call fcn.004a63be
mov edi, 0x5b07d8
push edi
mov ebx, 0x5b0844
push ebx
lea eax, [ebp - 0x618]
push eax
mov esi, 0x6235e8
push esi
call fcn.004a2dab
push dword [ebp + 8]
mov eax, esi
call fcn.00401016
push str.InstalledByAdmin
push 0x5bbe1c
call fcn.00457bdd
lea eax, [ebp - 0x208]
call fcn.004a20d8
push edi
push 0x5b0828
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xa28]
push eax
call fcn.004a2dab
push edi
push str.Program_Files
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.004a2dab
push edi
push ebx
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0xc30]
push eax
call fcn.004a2dab
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call ebx
push edi
push str.testfolder
push esi
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
push 0
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
je 0x4a6381
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and word [ebp - 0x206], 0
lea eax, [ebp - 0x208]
push eax
push str.InstalledByAdmin
push 0x5bbe1c
mov word [ebp - 0x208], 0x31
call fcn.00457b57
jmp 0x4a63b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4a6391
cmp eax, 5
jne 0x4a63b5
push esi
lea eax, [ebp - 0xc30]
call fcn.00401016
mov ecx, esi
call fcn.004a311d
push dword [ebp + 8]
mov eax, esi
call fcn.00401016
mov byte [0x623aed], 1
pop edi
pop esi
pop ebx
mov al, 1
leave
ret 4

Function at 0x4a63be
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
xor eax, eax
lea ecx, [ebp - 0x208]
push ecx
push eax
push eax
push 0x26
push eax
mov word [ebp - 0x208], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x5b0828
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00401f2d
push dword [ebp + 8]
call fcn.00401b98
test al, al
jne 0x4a640a
push dword [ebp + 8]
call fcn.00401b83
leave
ret 4

Function at 0x4a66d7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
call fcn.004a219a
cmp word [ebp - 0x208], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, str..lnk
mov edi, 0x5bc6b8
je 0x4a6726
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
lea eax, [ebp - 0x410]
push eax
call esi
lea eax, [ebp - 0x208]
call fcn.004a21ac
cmp word [ebp - 0x208], 0
je 0x4a6759
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004a2dab
lea eax, [ebp - 0x410]
push eax
call esi
pop edi
pop esi
pop ebx
leave
ret