joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497280
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x404
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 0x404
sete bl
cmp esi, 0xffffffff
je 0x4972cc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x4972e0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x404
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0xc], 0x404
sete bl
cmp esi, 0xffffffff
je 0x49732c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x497720
Capabilities:
Get geographical location

Disassembly:
push 0x104
push esi
push 0x5a
push 0x400
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [esi], 0
jne 0x49775f
mov eax, 0x6e9d3c
mov edx, esi
sub edx, eax
jmp 0x497750
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x497750
ret

Function at 0x497760
Capabilities:
Get geographical location

Disassembly:
push 0x104
push esi
push 0x59
push 0x400
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [esi], 0
jne 0x49779f
mov eax, 0x6bc238
mov edx, esi
sub edx, eax
jmp 0x497790
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x497790
ret

Function at 0x498e60
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
call fcn.004af5a0
test al, al
jne 0x498ec4
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 4], 6
setae al
test al, al
je 0x498ec4
push esi
push str.UxTheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.SetWindowTheme
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x498ebc
mov ecx, dword [esp + 0x11c]
push 0
push str.explorer
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
add esp, 0x114
ret 4
Function at 0x4990b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x228]
push ebp
mov ebp, dword [esp + 0x228]
push esi
push edi
mov esi, eax
mov edi, ecx
call fcn.004af5a0
test al, al
jne 0x499161
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 0x24], 6
setae al
test al, al
je 0x499161
test esi, esi
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x5001030e
je 0x499144
cmp word [esi], 0
je 0x499144
push esi
push edi
push str._s_n_s
mov esi, 0x104
lea edi, [esp + 0x2c]
call fcn.004af0d0
add esp, 0xc
lea ecx, [esp + 0x14]
mov edx, edi
push ecx
mov esi, ebx
mov edi, ebp
call fcn.00404e70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
lea edx, [esp + 0x14]
push edx
mov edx, edi
mov esi, ebx
mov edi, ebp
call fcn.00404e70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
push 0
push 0x50010409
push str.Button
push ebx
mov edx, edi
mov eax, ebp
call fcn.0051c9e0
test esi, esi
je 0x4991f4
cmp word [esi], 0
je 0x4991f4
lea eax, [ebx + 0x3e8]
push esi
mov ecx, ebp
mov dword [esp + 0x20], eax
call fcn.00404ec0
mov eax, dword [ebp + 4]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push str.OldWndProc
push esi
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4991f4
push 0x51c870
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [sym.imp.USER32.dll_SetPropW]
push ebp
push str.DialogParent
push esi
mov dword [esp + 0x20], eax
call edi
push ebx
push str.ControlId
push esi
call edi
mov ecx, dword [esp + 0x1c]
push ecx
push str.SubControlId
push esi
call edi
mov edx, dword [esp + 0x14]
push edx
push str.OldWndProc
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8

Function at 0x499380
Capabilities:
Write file on windows

Disassembly:
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
ret 4

Function at 0x499420
Capabilities:
Read file on windows

Disassembly:
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
ret 4

Function at 0x4998c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x104
push 0
push 0
push 0x104
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp]
push edx
mov byte [esp + 0x107], 0
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x499925
lea eax, [esp]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x49991f
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x49991f
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esi], edx
mov eax, esi
add esp, 0x104
ret
mov dword [esi], 0
mov eax, esi
add esp, 0x104
ret
Function at 0x499930
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x736519], 0
push ebx
mov ebx, dword [esp + 0x198]
push ebp
push esi
push edi
lea ebp, [ebx + 2]
jne 0x499964
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x736519], 1
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1a8]
push ecx
lea esi, [esp + 0x14]
mov dword [ebp], 0
call fcn.00542840
mov edi, esi
mov esi, ebp
mov word [ebx], ax
call fcn.00542a70
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x190
ret 0xc

Function at 0x4999a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x294
cmp byte [0x736519], 0
push ebx
mov ebx, dword [esp + 0x29c]
push ebp
push esi
push edi
lea ebp, [ebx + 2]
jne 0x4999d7
lea eax, [esp + 0x114]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x736519], 1
mov edx, dword [esp + 0x2ac]
push 0
push 0
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x2b0]
push eax
lea esi, [esp + 0x118]
lea edx, [esp + 0x14]
mov byte [esp + 0x117], 0
call fcn.00542840
mov edi, esi
mov esi, ebp
mov word [ebx], ax
call fcn.00542a70
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x294
ret 0xc

Function at 0x499a40
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x736519], 0
mov dword [esi], 0xffffffff
jne 0x499a6b
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x736519], 1
mov eax, esi
add esp, 0x190
ret
Function at 0x49c6d0
Capabilities:
Check os version

Disassembly:
mov ecx, dword [eax + 4]
sub esp, 0x114
push esi
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call fcn.004af5a0
test al, al
jne 0x49c722
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 8], 6
setae al
test al, al
je 0x49c722
push edi
push 0x10
push 0x48c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x114
ret
push edi
push 2
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop esi
add esp, 0x114
ret

Function at 0x49c740
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push esi
mov esi, eax
call fcn.004af5a0
test al, al
jne 0x49c78b
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 8], 6
setae al
test al, al
je 0x49c78b
mov ecx, dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push ecx
call esi
push eax
call esi
push eax
call esi
pop esi
add esp, 0x114
ret
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
pop esi
add esp, 0x114
ret

Function at 0x49d8e0
Capabilities:
Delete directory
Get common file path

Disassembly:
sub esp, 0x618
push esi
lea eax, [esp + 4]
push eax
call fcn.004c4840
mov edx, 0xbb8
lea ecx, [esp + 4]
call fcn.004ad810
lea esi, [esp + 0x414]
call fcn.004c5390
mov ecx, esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ecx
call esi
lea edx, [esp + 0x20c]
push edx
push 0
push 0
push 0x1a
push 0
mov word [esp + 0x220], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x6bc0cc
push str.NCH_SoftwareProgram_FilesDebut
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x218]
call fcn.004ad3a0
lea ecx, [esp + 4]
call fcn.004ad730
push 0x6bc0cc
push str.NCH_SoftwareProgram_Files
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 0x218]
call fcn.004ad3a0
lea edx, [esp + 4]
push edx
call esi
push 0x6bc0cc
push str.NCH_Software
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x218]
call fcn.004ad3a0
lea ecx, [esp + 4]
push ecx
call esi
pop esi
add esp, 0x618
ret

Function at 0x49d9b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x19
push 0
mov word [esp + 0x18], 0
call edi
push 0x6bc0cc
push str.Debut_Video_Capture_Software.lnk
lea ecx, [esp + 0x214]
push ecx
lea eax, [esp + 0x10]
call fcn.004ad3a0
push esi
lea edx, [esp + 0x210]
push edx
call fcn.004c53e0
test al, al
jne 0x49da3f
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x10
push 0
mov word [esp + 0x18], 0
call edi
push 0x6bc0cc
push str.Debut_Video_Capture_Software.lnk
lea ecx, [esp + 0x214]
push ecx
lea eax, [esp + 0x10]
call fcn.004ad3a0
push esi
lea edx, [esp + 0x210]
push edx
call fcn.004c53e0
pop edi
add esp, 0x410
ret
Function at 0x49da50
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x19
push 0
mov word [esp + 0x1c], 0
call esi
push 0x6bc0cc
push str.Debut_Video_Capture_Software.lnk
lea ecx, [esp + 0x218]
push ecx
lea eax, [esp + 0x14]
call fcn.004ad3a0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x210]
push edx
call edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x10
push 0
mov word [esp + 0x1c], 0
call esi
push 0x6bc0cc
push str.Debut_Video_Capture_Software.lnk
lea ecx, [esp + 0x218]
push ecx
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea edx, [esp + 0x210]
push edx
call edi
pop edi
pop esi
add esp, 0x410
ret

Function at 0x49daf0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x618
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x210]
push eax
push 0
push 0
push 0x19
push 0
mov word [esp + 0x224], 0
call edi
push 0x6bc0cc
push str.NCH_Software.lnk
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x21c]
call fcn.004ad3a0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 8]
push edx
call esi
cmp eax, 0xffffffff
jne 0x49dbeb
push 0x6bc0cc
push str.NCH_Suite.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea ecx, [esp + 8]
push ecx
call esi
cmp eax, 0xffffffff
jne 0x49dbeb
push 0x6bc0cc
push str.debut.exe
lea edx, [esp + 0x420]
push edx
mov eax, 0x735900
call fcn.004ad3a0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x41c]
call fcn.004c54a0
test al, al
jne 0x49dbeb
lea ecx, [esp + 0x210]
push ecx
push 0
push 0
push 0x10
push 0
mov word [esp + 0x224], 0
call edi
push 0x6bc0cc
push str.NCH_Suite.lnk
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x41c]
call fcn.004c54a0
pop edi
pop esi
add esp, 0x618
ret
Function at 0x49dc00
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x618
push ebx
push esi
push 0x6bc0cc
push str.debut.exe
lea eax, [esp + 0x420]
push eax
mov eax, 0x735900
call fcn.004ad3a0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x210]
push ecx
push 0
push 0
push 0x19
push 0
mov word [esp + 0x224], 0
call esi
push 0x6bc0cc
push str.NCH_Suite.lnk
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea eax, [esp + 0x418]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004c55d0
test al, al
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x49dc84
lea edx, [esp + 8]
push edx
call ebx
push 0x6bc0cc
push str.NCH_Software.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea ecx, [esp + 0x418]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.004c55d0
test al, al
je 0x49dcbc
lea eax, [esp + 8]
push eax
call ebx
lea ecx, [esp + 0x210]
push ecx
push 0
push 0
push 0x10
push 0
mov word [esp + 0x224], 0
call esi
push 0x6bc0cc
push str.NCH_Suite.lnk
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea eax, [esp + 0x418]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004c55d0
test al, al
je 0x49dd10
lea edx, [esp + 8]
push edx
call ebx
push 0x6bc0cc
push str.NCH_Software.lnk
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x21c]
call fcn.004ad3a0
lea ecx, [esp + 0x418]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.004c55d0
test al, al
je 0x49dd48
lea eax, [esp + 8]
push eax
call ebx
pop esi
pop ebx
add esp, 0x618
ret

Function at 0x49e0a0
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x49e0e5
mov ecx, dword [esp + 0xc]
push str.UninstallDebut
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x49e114
mov ecx, dword [esp + 0xc]
push str.UninstallDebut
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysReAllocStringLen
call esi
test eax, eax
jne 0x49e143
mov ecx, dword [esp + 0xc]
push str.UninstallDebut
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysReAllocStringLen
call esi
test eax, eax
jne 0x49e172
mov ecx, dword [esp + 0xc]
push str.UninstallDebut
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49e1c0
Capabilities:
Check os version
Copy file
Create process on windows
Get common file path

Disassembly:
sub esp, 0x654
push ebx
mov bl, byte [esp + 0x65c]
push esi
push edi
call fcn.004af5a0
test al, al
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 0x114
jne 0x49e23d
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], edi
call esi
cmp byte [esp + 0x4c], 6
setae al
test al, al
je 0x49e23d
push str._usermode
call fcn.004af5f0
test al, al
je 0x49e23d
call fcn.004af250
test al, al
je 0x49e23d
test bl, bl
mov eax, str._uninstall__quiet
jne 0x49e220
mov eax, str._uninstall
mov ecx, dword [0x735b94]
mov edx, dword [ecx]
push 1
push eax
push edx
call fcn.004c6bd0
pop edi
pop esi
pop ebx
add esp, 0x654
ret 4
lea eax, [esp + 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x6bc0cc
lea ecx, [esp + 0x254]
push str.nchuninst
push ecx
mov eax, ecx
call fcn.004ad3a0
lea ecx, [esp + 0x250]
call fcn.004ad910
lea ecx, [esp + 0x250]
call fcn.004ad6d0
push 0x6bc0cc
push str.uninst.exe
lea edx, [esp + 0x460]
push edx
lea eax, [esp + 0x25c]
call fcn.004ad3a0
mov ecx, dword [0x735b94]
mov edx, dword [ecx]
push 0
lea eax, [esp + 0x45c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x3c
lea eax, [esp + 0x10]
push 0
push eax
call fcn.006a1300
add esp, 0xc
test bl, bl
lea ecx, [esp + 0x458]
lea edx, [esp + 0x250]
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], str._uninstall2__quiet
jne 0x49e303
mov dword [esp + 0x20], str._uninstall2
mov dword [esp + 0x28], 1
call fcn.004af5a0
test al, al
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jne 0x49e362
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], edi
call esi
cmp byte [esp + 0x4c], 6
setae al
test al, al
je 0x49e362
mov ecx, dword [0x735b94]
mov eax, dword [ecx]
lea edi, [esp + 0x48]
call fcn.004ad090
mov edx, edi
push edx
call fcn.004021c0
test al, al
jne 0x49e362
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x1c], str.runas
call ebx
cmp eax, 1
je 0x49e371
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x1c], 0x6bc0b0
call ebx
pop edi
pop esi
pop ebx
add esp, 0x654
ret 4

Function at 0x49e4e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
push str.LQUIET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
neg eax
add esp, 0x208
ret
Function at 0x49e820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49e858
push esi
push str.File_does_not_exist:__s
mov esi, 0x104
call fcn.004af0d0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004c90f0
mov ebx, eax
mov eax, esi
call fcn.00401c60
mov ecx, 0x14
mul ecx
xor ecx, ecx
cmp ecx, edx
ja 0x49e895
jb 0x49e879
cmp ebx, eax
ja 0x49e895
push esi
push str.Not_enough_memory_available_to_load__s
mov esi, 0x104
call fcn.004af0d0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ebx, ebx
lea ecx, [esp + 0xc]
mov eax, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004bb5d0
test al, al
jne 0x49e8d8
push esi
push str.Cannot_open_xml_file:__s
mov esi, 0x104
call fcn.004af0d0
mov edx, dword [esp + 0x14]
push edx
call fcn.0069c8fa
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
cmp esi, ebx
mov eax, esi
jne 0x49e8e7
mov eax, 0x6bc0cc
mov ecx, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
push eax
mov word [edi], bx
call fcn.004c0c00
push esi
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a0f20
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [edi + 0x414]
test esi, esi
jle 0x4a0fb2
push 0
call fcn.0069c84d
add esp, 4
push esi
push eax
call fcn.0069e2ca
fstp qword [esp + 0x10]
add esp, 8
push 0
push str.FirstRunDurationSeconds
mov eax, str.Settings
call fcn.004811b0
test eax, eax
jne 0x4a0f77
fld qword [esp + 8]
call fcn.006b24a0
push str.FirstRunDurationSeconds
push str.Settings
call fcn.00480f20
push 0
push str.MinutesRunSinceLastInstall
mov eax, str.Settings
call fcn.004811b0
fld qword [esp + 8]
fadd qword [0x7237b8]
mov esi, eax
fmul qword [0x723db8]
call fcn.006b24a0
sub esi, eax
push str.MinutesRunSinceLastInstall
push str.Settings
mov eax, esi
call fcn.00480f20
cmp byte [edi + 2], 0
jne 0x4a0fbf
mov eax, edi
call fcn.004a0dd0
pop esi
add esp, 0x10
jmp 0x4a1970
sub esp, 0x418
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str..txt
push str.DebutCounts
lea ecx, [esp + 0x220]
push ecx
lea eax, [esp + 0x1c]
call fcn.004ad3a0
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x18]
mov esi, eax
mov eax, dword [0x736c1c]
push edx
push esi
mov dword [esp + 0x20], eax
call edi
mov ecx, dword [0x736c1c]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x736c18]
lea edx, [ecx*8]
push edx
push eax
push esi
call edi
cmp esi, 0xffffffff
je 0x4a1a0f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x418
ret

Function at 0x4a1a20
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x410
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str..txt
push str.DebutCounts
lea ecx, [esp + 0x210]
push ecx
lea eax, [esp + 0xc]
call fcn.004ad3a0
lea edx, [esp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x410
ret

Function at 0x4a1d40
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x208
push esi
push edi
push str.SuiteUsage
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x10]
call fcn.004af0d0
add esp, 8
cmp word [esp + 8], 0
pop edi
pop esi
je 0x4a1d7c
lea eax, [esp]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x208
ret
Function at 0x4a1f80
Capabilities:
Check os version

Disassembly:
sub esp, 0xa38
push ebx
mov bl, byte [esp + 0xa40]
push ebp
push esi
push edi
call fcn.004af5a0
test al, al
jne 0x4a2099
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 0x1c], 6
setae al
test al, al
je 0x4a2099
lea ecx, [esp + 0x840]
push ecx
call fcn.004a1f30
test al, al
je 0x4a2099
xor ebp, ebp
push ebp
call fcn.0069c84d
mov dl, bl
add esp, 4
neg dl
sbb edx, edx
and edx, 0xfffd5d2d
add edx, 0x2a300
mov ecx, edx
add ecx, eax
test bl, bl
mov dword [esp + 0x14], ecx
je 0x4a203e
push str.Software
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x640]
mov word [esp + 0x20], 0x31
mov word [esp + 0x22], bp
call fcn.004af0d0
add esp, 8
push str.ShowSurveyNow
push SysReAllocStringLen
lea esi, [esp + 0x20]
mov edx, edi
call fcn.004af710
lea eax, [esp + 0x14]
push eax
push str._surveysched
lea ecx, [esp + 0x848]
push ecx
push str.LikeSurvey
lea edx, [esp + 0x230]
push edx
mov byte [esp + 0x23b], 0
mov word [esp + 0x23c], bp
mov word [esp + 0x444], bp
mov byte [esp + 0x234], 0
mov byte [esp + 0x235], 0
mov byte [esp + 0x236], 0
mov dword [esp + 0x237], ebp
call fcn.004b98b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa38
ret 4

Function at 0x4a2c30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 8]
push eax
push 1
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x18], 0
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x18], 0
call edi
pop edi
pop ecx
ret 0xc

Function at 0x4a35c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x4a35e6
mov eax, dword [edi + 0xdb]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0xdb]
push ebx
push esi
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
call ebx
push 0x15
mov esi, eax
call ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [edx]
mov edx, dword [esp + 0xc]
push 0x104
push eax
sub ecx, eax
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [edi + 0xdb]
sub eax, esi
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
pop ebx
ret 8