joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412060
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x45e706
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47c944]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0xa8]
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x4120a7
cmp eax, 0x104
jne 0x412116
cmp dword [esi + 0xc], 0x112f
je 0x412116
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor edi, edi
call ebx
shr eax, 8
test al, al
je 0x4120c8
mov edi, 2
push 0x10
call ebx
shr eax, 8
test al, al
je 0x4120d6
or edi, 4
push 0x12
call ebx
shr eax, 8
test al, al
je 0x4120e4
or edi, 1
mov eax, dword [esi + 8]
cmp eax, dword [0x47dd30]
jne 0x412116
cmp edi, dword [0x47dd34]
jne 0x412116
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push ecx
push eax
mov eax, dword [0x4810ec]
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
jmp 0x41225c
mov eax, dword [esi + 4]
cmp eax, 0x102
jne 0x4121d3
movzx ecx, word [esi + 8]
cmp ecx, 4
jne 0x4121d3
mov edx, dword [esi + 0xc]
and edx, 0xffff0000
cmp edx, 0x200000
jne 0x4121d3
mov eax, dword [0x4810ec]
push eax
call fcn.0041ddd7
push eax
mov eax, dword [0x482114]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00403da0
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0xac], 0
mov eax, dword [0x482110]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00403da0
add eax, 0x10
mov dword [esi], eax
add esp, 4
lea ecx, [esp + 0x28]
or esi, 0xffffffff
push ecx
mov dword [esp + 0xb0], esi
call fcn.00418090
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], 1
call fcn.00421857
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], esi
call fcn.00418220
lea eax, [esi + 2]
jmp 0x41225c
cmp eax, 0x100
jne 0x412231
mov ecx, 0x74
cmp dword [esi + 8], ecx
jne 0x412231
cmp dword [0x47dd28], ecx
jne 0x4121f5
cmp dword [0x47dd2c], 0
je 0x412206
cmp dword [0x47dd38], ecx
jne 0x412213
cmp dword [0x47dd3c], 0
jne 0x412213
cmp dword [esi + 0xc], 0x112f
jne 0x41210c
mov eax, dword [0x4810e4]
test eax, eax
je 0x41222a
mov eax, dword [eax + 0xf0]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x30]
call eax
mov eax, 1
jmp 0x41225c
cmp eax, 0x112
jne 0x412254
cmp dword [esi + 8], 0xf060
jne 0x412254
mov ecx, dword [ebp + 0x20]
push 0
push 0x82
push 5
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push esi
mov ecx, ebp
call fcn.004341b7
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 4
Function at 0x412690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
call fcn.00425b76
mov esi, dword [eax + 0xc]
push 0x46acf0
push 0x81
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4126b8
pop edi
pop esi
pop ecx
ret 4
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412700
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.0044a1c0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x412709
pop ebx
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004123d0
mov edx, dword [esp + 0x18]
add esp, 4
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x413a40
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x128
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x124], eax
push esi
push 0x114
xor esi, esi
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00447b40
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x413af7
cmp dword [esp + 0x18], 5
jbe 0x413af7
lea edx, [esp + 4]
push edx
push 0x20019
push esi
mov eax, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413af7
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
push str.EnableLUA
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413aec
xor ecx, ecx
cmp dword [esp + 8], 1
sete cl
mov esi, ecx
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x128]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00445369
add esp, 0x128
ret
Function at 0x414e60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1b0
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x1ac], eax
xor eax, eax
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call ebp
mov esi, eax
test esi, esi
je 0x414f84
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 0x10], eax
push 0x40
lea ecx, [esp + 0x40]
push ecx
push esi
call edi
push 0x80
lea edx, [esp + 0xc0]
push edx
push esi
call ebx
mov ecx, 0x46a4fc
lea eax, [esp + 0xbc]
jmp 0x414f00
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x414f26
test dx, dx
je 0x414f22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x414f26
add eax, 4
add ecx, 4
test dx, dx
jne 0x414f00
xor eax, eax
jmp 0x414f2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414f74
mov ecx, str.32770
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x414f5e
test dx, dx
je 0x414f5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x414f5e
add eax, 4
add ecx, 4
test dx, dx
jne 0x414f38
xor eax, eax
jmp 0x414f63
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414f74
mov eax, dword [esp + 0x10]
mov dword [eax], esi
add eax, 4
mov dword [esp + 0x10], eax
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x414ed5
pop ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea esp, [esp]
mov eax, dword [esp + esi*4 + 0x10]
test eax, eax
je 0x414faa
push 0
push 0
push 0x404
push eax
call edi
inc esi
cmp esi, 0xa
jl 0x414f90
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00445369
add esp, 0x1b0
ret
Function at 0x414fd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x29c]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9a]
push ecx
mov word [esp + 0x9c], ax
call fcn.00447b40
mov ebx, str.Statistic.ini
lea edi, [esp + 0x9c]
call fcn.00409630
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x66]
push eax
mov word [esp + 0x68], dx
call fcn.00447b40
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call fcn.00447b40
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x18]
push ecx
push str.0_121
push str.ShortKey
push 0x46a9e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00404410
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jle 0x4150b3
push 0x2c
push eax
call fcn.004460f0
add esp, 8
test eax, eax
je 0x4150b3
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
je 0x4150b3
lea edx, [esp + eax*2 + 0x12]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x14], cx
lea eax, [esp + 0x54]
push 0x20
push eax
call fcn.004454a7
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call fcn.00445cfc
lea edx, [esp + 0x54]
push edx
mov dword [esi], eax
call fcn.00445cfc
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop ebp
pop ebx
test edx, edx
jg 0x4150f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.00445369
add esp, 0x290
ret 4
Function at 0x415110
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x29c]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9a]
push ecx
mov word [esp + 0x9c], ax
call fcn.00447b40
mov ebx, str.Statistic.ini
lea edi, [esp + 0x9c]
call fcn.00409630
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x66]
push eax
mov word [esp + 0x68], dx
call fcn.00447b40
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call fcn.00447b40
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x18]
push ecx
push 0x46d914
push str.AltWndKey
push 0x46a9e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00404410
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jle 0x4151f3
push 0x2c
push eax
call fcn.004460f0
add esp, 8
test eax, eax
je 0x4151f3
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
je 0x4151f3
lea edx, [esp + eax*2 + 0x12]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x14], cx
lea eax, [esp + 0x54]
push 0x20
push eax
call fcn.004454a7
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call fcn.00445cfc
lea edx, [esp + 0x54]
push edx
mov dword [esi], eax
call fcn.00445cfc
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop ebp
pop ebx
test edx, edx
jg 0x415232
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.00445369
add esp, 0x290
ret 4
Function at 0x415250
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x29c]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9a]
push ecx
mov word [esp + 0x9c], ax
call fcn.00447b40
mov ebx, str.Statistic.ini
lea edi, [esp + 0x9c]
call fcn.00409630
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x66]
push eax
mov word [esp + 0x68], dx
call fcn.00447b40
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call fcn.00447b40
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x18]
push ecx
push str.2_81
push str.SndKey
push 0x46a9e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00404410
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jle 0x415333
push 0x2c
push eax
call fcn.004460f0
add esp, 8
test eax, eax
je 0x415333
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
je 0x415333
lea edx, [esp + eax*2 + 0x12]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x14], cx
lea eax, [esp + 0x54]
push 0x20
push eax
call fcn.004454a7
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call fcn.00445cfc
lea edx, [esp + 0x54]
push edx
mov dword [esi], eax
call fcn.00445cfc
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop ebp
pop ebx
test edx, edx
jg 0x415372
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.00445369
add esp, 0x290
ret 4
Function at 0x416740
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa1c
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0xa18], eax
push ebp
mov ebp, dword [esp + 0xa24]
xor eax, eax
cmp ax, word [ebp]
jne 0x41677c
pop ebp
mov ecx, dword [esp + 0xa18]
xor ecx, esp
call fcn.00445369
add esp, 0xa1c
ret 4
push ebx
push esi
push edi
mov ebx, str.Statistic.ini
lea edi, [esp + 0x20]
call fcn.00409630
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, edi
push ecx
push 0x400
lea edx, [esp + 0x230]
push edx
push 0x46adb4
push str.PopInfo
push 0x46a9e0
call esi
lea eax, [esp + 0x228]
push eax
push ebp
call fcn.00445446
add esp, 8
test eax, eax
je 0x41683f
xor ecx, ecx
cmp cx, word [esp + 0x228]
je 0x41683f
mov edx, edi
push edx
push 8
lea eax, [esp + 0x18]
push eax
push 0x46adb4
push str.PopEnable
push 0x46a9e0
call esi
lea ecx, [esp + 0x10]
mov eax, 0x46a9dc
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41682f
test dx, dx
je 0x416822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41682f
add eax, 4
add ecx, 4
test dx, dx
jne 0x416800
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x416844
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x416844
mov eax, 1
mov ecx, dword [esp + 0xa28]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.00445369
add esp, 0xa1c
ret 4
Function at 0x4172e0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040cff0
push 0x46e020
mov dword [esi + 0x78], 0x1e
mov dword [esi + 0x88], 4
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
call fcn.0040ce60
push 0
push 0
push 0
push ecx
mov ecx, dword [0x48139c]
push 0x84
call fcn.0040bf10
mov ecx, dword [0x48139c]
add esp, 8
push eax
push 1
push 0
push 0x83
call fcn.0040bf10
add esp, 4
push eax
call fcn.0040d100
mov eax, dword [esi + 0x260]
cmp dword [eax - 0xc], 0
jle 0x4174a2
push 0x2f
lea edi, [esi + 0x264]
push str.http:__client.5054399.com_update_ConfigHjsg.htm
mov ecx, edi
call fcn.004042e0
mov ecx, dword [esi + 0x260]
push ecx
push 0x46a9e0
push edi
call fcn.00403810
lea edi, [esi + 0x26c]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [esi + 0x260]
push edx
push 0x104
push edi
call fcn.00445516
add esp, 0xc
push str..exe
push 0x104
push edi
call fcn.00445516
add esp, 0xc
push 0
push 0
push esi
push 0x4175a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ebx, [esi + 0x50c]
push 0
mov ecx, ebx
mov dword [esi + 0x484], eax
call fcn.004225ad
push 1
push ecx
mov ecx, dword [0x48139c]
push 0x85
call fcn.0040bf10
add esp, 8
push eax
call fcn.0040c5a0
push 1
push ecx
mov ecx, dword [0x48139c]
push 0x85
call fcn.0040bf10
add esp, 8
push eax
lea ebx, [esi + 0x58c]
call fcn.0040c5a0
push 0
push 0x46adb4
lea ecx, [esi + 0x660]
call fcn.004042e0
mov eax, dword [esi + 0x62c]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [esi + 0x680], 0x565148
mov dword [esi + 0x66c], 0x10
mov ecx, dword [0x48139c]
push 0x99
call fcn.0040bf10
mov ecx, dword [0x48139c]
add esp, 4
push 0x98
mov edi, eax
call fcn.0040bf10
add esp, 4
add esi, 0x488
mov ecx, edi
call fcn.0040ebc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4182a0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x910
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x90c], eax
push esi
mov esi, ecx
call fcn.00421217
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x112]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x114], ax
call fcn.00447b40
xor edx, edx
push 0xfe
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call fcn.00447b40
mov ecx, dword [esi + 0x78]
push ecx
mov edx, ecx
push edx
push str._DEFAULT__r_nBASEURL_s_r_n_000214A0_0000_0000_C000_000000000046__r_n19_2_r_n_InternetShortcut__r_nURL_s_r_nIDList_r_n
lea eax, [esp + 0x534]
push 0x200
push eax
call fcn.0044575a
add esp, 0x2c
push 0
push 0
push 0x200
lea ecx, [esp + 0x31c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x524]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x108]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x80
lea ecx, [esp + 0xc]
push ecx
push 0x3fa
mov ecx, esi
call fcn.00422389
push 0x46b8e4
lea edx, [esp + 0x10c]
push 0x104
push edx
call fcn.00445516
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.00445516
push str..url
lea edx, [esp + 0x124]
push 0x104
push edx
call fcn.00445516
push 0x46ac88
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.004461dc
add esp, 0x30
lea eax, [esp + 0x310]
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4183d4
sub eax, edx
mov edx, dword [esp]
push edx
push 1
push eax
lea eax, [esp + 0x318]
push eax
call fcn.00446391
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044648a
mov ecx, dword [esp + 0x920]
add esp, 0x14
xor ecx, esp
call fcn.00445369
add esp, 0x910
ret

Function at 0x41a5a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41a5ed
call fcn.00425b76
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41a5ed
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41a630
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41a619
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41a619
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41a62d
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x421078
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4210bf
call fcn.00425b76
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4210bf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4210db
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00420bf0
mov esi, eax
test edi, edi
je 0x4210d9
test ebx, ebx
je 0x4210d9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x421a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00425b76
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x421a89
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0042169c
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x422b2e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x45dc9a
call fcn.00447928
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x422b53
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x422b99
lea ecx, [ebp - 0x10]
call fcn.00403d70
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043463e
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404140
mov eax, esi
call fcn.00447a00
ret 8

Function at 0x4379ff
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x45d6f6
call fcn.00447928
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00404410
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x437a61
call fcn.00425450
cmp eax, 1
jne 0x437a61
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x462050
push eax
call fcn.00407780
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403e10
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404140
mov dword [ebp + 8], reloc.DSOUND.dll_DirectSoundCreate
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404140
mov eax, esi
call fcn.00447a00
ret 0x10
Function at 0x437a8a
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x45d6f6
call fcn.00447928
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00404410
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x437aec
call fcn.00425450
cmp eax, 1
jne 0x437aec
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x462050
push eax
call fcn.00407780
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403e10
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404140
mov dword [ebp + 8], reloc.DSOUND.dll_DirectSoundCreate
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404140
mov eax, esi
call fcn.00447a00
ret 0x14