joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
mov eax, 3
mov ecx, 6
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov ecx, 7
push esi
mov esi, 1
mov edx, 5
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 4], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0xa
mov dword [esp + 0x24], 0x26
mov dword [esp + 0x2c], 9
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x44], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], 9
mov dword [esp + 0x60], 0xb
mov dword [esp + 0x64], 0x26
mov dword [esp + 0x6c], 0xa
mov dword [esp + 0x80], 0xf
xor eax, eax
cmp byte [eax + ecx], 0xe
jbe 0x55203e
mov byte [eax + ecx], 0xe
inc eax
cmp eax, 0x21
jl 0x552034
mov al, byte [ecx + 0x2f]
test al, al
lea eax, [esp + 4]
je 0x552053
lea eax, [esp + 0x44]
add ecx, 0x22
add eax, 8
mov esi, 4
mov edi, edi
movzx edx, byte [ecx - 1]
cmp edx, dword [eax - 8]
jle 0x55206f
mov dl, byte [eax - 8]
mov byte [ecx - 1], dl
movzx edx, byte [ecx]
cmp edx, dword [eax - 4]
jle 0x55207c
mov dl, byte [eax - 4]
mov byte [ecx], dl
movzx edx, byte [ecx + 1]
cmp edx, dword [eax]
jle 0x552089
mov dl, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [ecx + 2]
cmp edx, dword [eax + 4]
jle 0x552098
mov dl, byte [eax + 4]
mov byte [ecx + 2], dl
add eax, 0x10
add ecx, 4
dec esi
jne 0x552060
pop esi
add esp, 0x80
ret 4
Function at 0x570860
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [str.asset_id]
sub esp, 0x48
push ebx
push esi
push eax
lea ecx, [esp + 0x14]
call fcn.00418c70
mov ebx, dword [esp + 0x58]
mov edx, dword [ebx + 8]
lea ecx, [esp + 8]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.005b7360
mov edx, dword [str.rtsg]
add esp, 0xc
push eax
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004908b0
mov ecx, eax
call fcn.005b8270
mov ecx, eax
call fcn.005b89b0
mov ecx, eax
call fcn.005bdc80
lea ecx, [esp + 0xc]
call fcn.005bdce0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x5708de
mov edx, dword [0x9d9dcc]
mov ecx, dword [edx + 4]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
cmp eax, ecx
mov dword [esp + 0x2c], 0x84760c
je 0x570901
mov edx, dword [0x9d9dcc]
mov ecx, dword [edx + 4]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov ecx, dword [esp + 8]
push 0
lea eax, [esp + 0x14]
push eax
call fcn.005b6e00
mov ecx, dword [str.country_id]
push ecx
lea ecx, [esp + 0x14]
call fcn.00419060
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x570949
dec dword [eax]
cmp dword [eax], 0
mov esi, eax
jne 0x570949
test esi, esi
je 0x570949
mov ecx, esi
call fcn.005b0ba0
push esi
call fcn.005b3b10
add esp, 4
mov ecx, dword [esp + 8]
push 0
lea edx, [esp + 0x14]
push edx
call fcn.005b6e00
mov eax, dword [str.rtsg]
push eax
lea ecx, [esp + 0x14]
call fcn.00419060
mov esi, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x570991
dec dword [eax]
cmp dword [eax], 0
push edi
mov edi, eax
jne 0x570990
test edi, edi
je 0x570990
mov ecx, edi
call fcn.005b0ba0
push edi
call fcn.005b3b10
add esp, 4
pop edi
mov ecx, esi
shr ecx, 0x18
shl ecx, 0x18
and esi, 0xf00000
or ecx, esi
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 8]
test ecx, ecx
pop esi
pop ebx
je 0x5709b4
push ecx
call fcn.00418f80
add esp, 0x48
ret
Function at 0x587d00
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, edx
shl eax, 4
test ebx, ebx
push edi
lea esi, [eax + 0x9e0cb0]
mov ecx, ebx
mov edi, 0x1505
je 0x587dc2
movzx eax, byte [ebx]
test eax, eax
je 0x587d3d
lea esp, [esp]
imul edi, edi, 0x21
inc ecx
add edi, eax
movzx eax, byte [ecx]
test eax, eax
jne 0x587d30
cmp dword [esi + 4], edi
je 0x587da2
mov eax, dword [esi + 0xc]
test eax, eax
je 0x587d52
push edx
call fcn.00587a00
add esp, 4
push 0
push 0x10
push 0
push 0x400
push ebx
push 0x865cfc
mov dword [esi + 4], edi
call fcn.005f1aa0
mov dword [esi + 0xc], eax
call fcn.005cd500
mov edx, dword [esi + 0xc]
push edx
call fcn.0079f7f3
add esp, 0x1c
test eax, eax
mov dword [esi], eax
je 0x587d8c
mov dword [eax + 0x20], 0xffffffff
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov dword [eax + 0x28], 0
mov ecx, dword [esi]
mov dword [ecx + 0x2c], 0x3f800000
mov ecx, dword [esi]
mov eax, 0x3f000000
mov dword [ecx + 0x30], eax
mov ecx, dword [esi]
mov dword [ecx + 0x34], eax
pop edi
mov dword [esi + 8], 1
pop esi
mov dword [0x9e0de0], edx
pop ebx
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x587dd5
mov dword [esi], eax
mov dword [esi + 0xc], 0
jmp 0x587da2
mov ecx, dword [0x9e0dc0]
mov dword [esi], ecx
mov dword [esi + 0xc], 0
jmp 0x587da2
Function at 0x5b41d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov cl, byte [esi]
movsx edx, cl
shl edx, 7
add edx, eax
xor eax, eax
test cl, cl
je 0x5b4204
lea esp, [esp]
imul edx, edx, 0xf4243
movsx ecx, cl
xor edx, ecx
mov cl, byte [esi + 1]
inc esi
inc eax
test cl, cl
jne 0x5b41f0
xor eax, edx
xor edx, edx
div dword [esp + 0x10]
pop esi
mov eax, edx
ret
Function at 0x5c5f90
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x48
push esi
push edi
push str.team_id
lea ecx, [esp + 0x14]
call fcn.00418c70
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov esi, dword [eax]
lea ecx, [esp + 8]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.005b7360
add esp, 0xc
push eax
push str.team_country
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.005b8270
mov ecx, eax
call fcn.005b89b0
mov ecx, eax
call fcn.005bdc80
lea ecx, [esp + 0xc]
call fcn.005bdce0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x5c6003
push eax
call fcn.004186c0
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x18]
cmp eax, edx
mov dword [esp + 0x2c], 0x84760c
je 0x5c6020
push eax
call fcn.004186c0
add esp, 4
mov ecx, dword [esp + 8]
mov edi, 0x270f
call fcn.005b6c70
test eax, eax
jle 0x5c6077
mov ecx, dword [esp + 8]
push 0
lea eax, [esp + 0x14]
push eax
call fcn.005b6e00
push str.country_id
lea ecx, [esp + 0x14]
call fcn.00419060
mov edi, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5c6077
dec dword [eax]
cmp dword [eax], 0
mov esi, eax
jne 0x5c6077
test esi, esi
je 0x5c6077
mov ecx, esi
call fcn.005b0ba0
push esi
call fcn.005b3b10
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x5c6085
push ecx
call fcn.00418f80
mov eax, edi
pop edi
pop esi
add esp, 0x48
ret
Function at 0x5e2e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebp
push esi
lea eax, [esp + 0x10]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
xor ebp, ebp
push edx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x5e2f45
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x17]
push ecx
push esi
push esi
push edi
push edx
mov dword [esp + 0x2c], esi
call ebx
cmp eax, 0xea
jne 0x5e2eba
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x714]
mov edx, dword [esp + 0x14]
push ecx
push 0x6561736f
push edx
call fcn.007e5323
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push ebp
push edi
push ecx
call ebx
test eax, eax
jne 0x5e2f17
push 4
push str.pass
push edi
call fcn.0081e1e0
mov edx, dword [esp + 0x44]
add esp, 0xc
test eax, eax
push edx
jne 0x5e2eef
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
push eax
shr ecx, 2
push ecx
push esi
call fcn.005e2dc0
add esp, 0x10
jmp 0x5e2f19
mov ebx, dword [esp + 0x38]
mov ecx, edx
mov ebp, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
push esi
push ebx
rep stosb byte es:[edi], al
call fcn.0081d420
mov ebp, dword [esp + 0x28]
add esp, 0xc
jmp 0x5e2f19
mov ebp, eax
test esi, esi
pop edi
pop ebx
je 0x5e2f38
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x714]
push eax
push 0x6561736f
push esi
call fcn.007e537d
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x5e46d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
push esi
push 0x847a97
call fcn.005e4630
add esp, 8
test al, al
je 0x5e46fa
mov al, 1
pop esi
add esp, 0x100
ret
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push esi
push ecx
call fcn.005e4630
add esp, 8
test al, al
jne 0x5e46f0
push 0x100
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 4]
push esi
push eax
call fcn.005e4630
add esp, 8
test al, al
setne al
pop esi
add esp, 0x100
ret
Function at 0x5e4790
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0xa726dc]
test eax, eax
jne 0x5e482a
push str.xinput9_1_0.dll
call fcn.005e46d0
add esp, 4
test al, al
jne 0x5e4820
mov dword [0xa726dc], 2
mov eax, dword [0xa726e0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetInput
push eax
call esi
mov ecx, dword [0xa726e0]
push str.IsConnected
push ecx
mov dword [0xa726e4], eax
call esi
mov edx, dword [0xa726e0]
push str.ResetVibration
push edx
mov dword [0xa726e8], eax
call esi
mov dword [0xa726ec], eax
mov eax, dword [0xa726e0]
push str.SetVibration
push eax
call esi
mov ecx, dword [0xa726e0]
push str.GetVibration
push ecx
mov dword [0xa726f0], eax
call esi
mov dword [0xa726f4], eax
mov al, 1
pop esi
ret
mov eax, 1
mov dword [0xa726dc], eax
cmp eax, 1
sete al
test al, al
je 0x5e47b8
push str.data_input_XPadLib.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0xa726e0], eax
jne 0x5e47b8
mov dword [0xa726dc], 2
xor al, al
ret

Function at 0x5e4e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov edx, 0x20
mov eax, 0x500
mov ecx, 0x400
push esi
mov esi, dword [esp + 0x78]
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], eax
mov eax, 6
mov dword [esp + 0x24], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 4], 0x280
mov dword [esp + 8], 0x1e0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x320
mov dword [esp + 0x18], 0x258
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], 0x300
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], 0x2d0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 3
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], 4
mov dword [esp + 0x54], 0x640
mov dword [esp + 0x58], 0x4b0
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], 5
mov dword [esp + 0x64], 0x780
mov dword [esp + 0x68], 0x438
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], eax
xor ecx, ecx
mov edi, edi
cmp dword [esp + ecx + 0x6c], edx
jne 0x5e4f35
cmp dword [esp + ecx + 0x68], esi
jg 0x5e4f35
cmp byte [ecx + 0x8c2344], 1
je 0x5e4f45
sub ecx, 0x10
dec eax
cmp ecx, 0xffffffa0
jge 0x5e4f20
xor eax, eax
pop esi
add esp, 0x70
ret
cmp eax, 0xffffffff
jne 0x5e4f4c
xor eax, eax
pop esi
add esp, 0x70
ret
Function at 0x5e5010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 1
xor ebx, ebx
mov ecx, 7
mov esi, str.Control_PanelInternational
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x30]
push ecx
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x20], 0x100
mov byte [0xa72918], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5e50d0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 0xa72918
push ebx
push ebx
push str.Locale
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5e50c5
mov ecx, dword [esp + 0xc]
cmp ecx, 9
jae 0x5e50c0
mov edx, dword [str.00000000]
mov eax, dword [0x86e324]
mov dword [esp + 0x14], edx
mov dl, byte [0x86e328]
mov byte [esp + 0x1c], dl
lea edx, [esp + 0x1d]
mov dword [esp + 0x18], eax
mov eax, 0xa72918
sub edx, ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x5e50a5
xor eax, eax
mov cl, byte [esp + eax + 0x14]
mov byte [eax + 0xa72918], cl
inc eax
cmp cl, bl
jne 0x5e50b1
mov ebx, 0xa72918
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x34
ret

Function at 0x5e5630
Capabilities:
Get common file path

Disassembly:
mov al, byte [0xa726f8]
sub esp, 0x104
test al, al
jne 0x5e56b1
call fcn.0079d3a3
push 1
push 5
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne 0x5e5676
call fcn.005e5bc0
push eax
lea edx, [esp + 4]
push edx
push 0x84bb04
push 0xa726f8
call fcn.0081cf4d
add esp, 0x10
push 1
push str.DO_NOT_CREATE_SAVE_FOLDER
call fcn.00704c0b
mov ecx, eax
call fcn.00704db9
test eax, eax
jne 0x5e569a
push 0xa726f8
call fcn.005efe70
add esp, 4
push 0x104
push 0xa726f8
push 0xa726f8
call fcn.005efa10
add esp, 0xc
mov eax, 0xa726f8
add esp, 0x104
ret
Function at 0x5e59e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0xa72c0c]
sub esp, 0x7c
cmp eax, 0x514
push ebx
push esi
mov bl, 1
mov esi, 0x20
jle 0x5e5409
cmp dword [0x8c22d8], esi
jle 0x5e5409
mov al, byte [0x8c22de]
test al, al
je 0x5e540b
xor bl, bl
mov al, byte [0x8c22c9]
test al, al
jne 0x5e541b
cmp bl, 2
jne 0x5e541b
mov bl, 1
push str.RENDER_QUALITY
call fcn.00704c0b
mov ecx, eax
call fcn.00704d5b
test al, al
je 0x5e5445
push 1
push str.RENDER_QUALITY
call fcn.00704c0b
mov ecx, eax
call fcn.00704db9
mov bl, al
push str.RESOLUTION
call fcn.00704c0b
mov ecx, eax
call fcn.00704d5b
test al, al
je 0x5e55b3
push str.RESOLUTION
call fcn.00704c0b
mov ecx, eax
call fcn.00704d74
test eax, eax
je 0x5e55b3
mov ecx, 0x500
push edi
mov edx, 0x400
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x60], edx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push ecx
push str._dx_dx_d
push eax
mov dword [esp + 0x2c], 0x280
mov dword [esp + 0x30], 0x1e0
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x320
mov dword [esp + 0x40], 0x258
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 1
mov dword [esp + 0x50], 0x300
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 2
mov dword [esp + 0x60], 0x2d0
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 3
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x7c], 0x640
mov dword [esp + 0x80], 0x4b0
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 5
mov dword [esp + 0x8c], 0x780
mov dword [esp + 0x90], 0x438
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 6
call fcn.0081ddf3
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x14
xor ecx, ecx
lea eax, [esp + 0x1c]
lea ebx, [ebx]
cmp edi, dword [eax - 4]
jne 0x5e558e
cmp esi, dword [eax]
jne 0x5e558e
cmp edx, dword [eax + 4]
je 0x5e5599
inc ecx
add eax, 0x10
cmp ecx, 7
jl 0x5e5580
jmp 0x5e55b2
shl ecx, 4
mov edx, dword [esp + ecx + 0x24]
push edx
push str.OPTIONS_RESOLUTION
call fcn.00704c0b
mov ecx, eax
call fcn.007053db
pop edi
movzx eax, bl
push eax
push str.OPTIONS_QUALITY
call fcn.00704c0b
mov ecx, eax
call fcn.007053db
pop esi
pop ebx
add esp, 0x7c
ret
push 0x5e5850
call fcn.0079b280
call fcn.005d3040
call fcn.005e5bc0
push eax
call fcn.005d2ed0
add esp, 8
call fcn.005e56c0
cmp dword [0x8c22d8], 0x10
jl 0x5e5a2b
mov al, byte [0x8c22e0]
test al, al
jne 0x5e5a2b
push 1
push str.HALFSIZE_TEXTURES
call fcn.00704c0b
mov ecx, eax
call fcn.00704db9
test eax, eax
je 0x5e5a35
push 1
call fcn.005dd070
add esp, 4
push fcn.005ae440
call fcn.005d2fd0
add esp, 4
call fcn.005e5740
push 1
push str.LIGHTS_FORCE_DIRECTIONAL
call fcn.00704c0b
mov ecx, eax
call fcn.00704db9
test eax, eax
je 0x5e5a68
push 1
call fcn.005d3000
add esp, 4
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
test eax, eax
jne 0x5e5a84
push eax
push str.AUDIO
call fcn.00704c0b
mov ecx, eax
call fcn.007053db
push 0
push 0xffffffffffffffff
push 0x5f0460
call fcn.0079b04c
push 0x5e4c20
call fcn.005efa90
add esp, 0x10
jmp 0x5e53e0
Function at 0x5e6300
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 5
jb 0x5e632e
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [0xad0418]
cmp esi, dword [0xad041c]
mov dword [0x8c67e0], 0
jae 0x5e6367
nop
mov eax, dword [esi]
test eax, eax
je 0x5e635b
push 1
call dword [eax + 0x20]
mov eax, dword [0xad041c]
add esi, 4
cmp esi, eax
jb 0x5e6350
mov ecx, dword [0xad0414]
push 0
push ecx
call fcn.005e6230
mov eax, dword [0xacfefc]
mov ecx, dword [0xacfef8]
mov edx, dword [esp + 0x9c]
push eax
push ecx
mov dword [0xa72a28], edx
call fcn.005e48b0
add esp, 8
mov ecx, 0x8c67b4
call fcn.005e5da0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
add esp, 0x94
ret 0x10
Function at 0x5e6d30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
mov esi, ecx
call dword [0x8ab9f8]
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x410], ebx
je 0x5e6dcf
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
cmp edi, 0x400
jg 0x5e6d8d
push edi
call fcn.005e5c00
add esp, 4
test al, al
je 0x5e6d8d
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0081cf10
mov esi, esp
jmp 0x5e6da8
lea eax, [edi + 8]
push eax
call fcn.0081ed28
add esp, 4
test eax, eax
je 0x5e6dcf
mov dword [eax], 0
mov ebx, eax
lea esi, [eax + 8]
test esi, esi
je 0x5e6dcf
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push edx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x5e6dd1
xor eax, eax
test eax, eax
jne 0x5e6e19
mov ecx, dword [ebp - 0x410]
lea eax, [ebp - 0x40c]
cmp ecx, eax
je 0x5e6df0
lea ecx, [ebp - 0x410]
call fcn.005e6f40
test ebx, ebx
je 0x5e6e05
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.0081d7ea
add esp, 4
test ebx, ebx
jne 0x5e6df4
mov eax, 0x8007000e
lea esp, [ebp - 0x41c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
jne 0x5e6e39
call fcn.005e5cd0
mov edi, eax
jmp 0x5e6eef
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x5e6e58
call fcn.005e5cd0
jmp 0x5e6ee6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 8], eax
jne 0x5e6e6e
call fcn.005e5cd0
jmp 0x5e6ee6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, 0x400
mov dword [ebp + 0x10], edi
jbe 0x5e6ea2
push eax
lea ecx, [ebp - 0x410]
call fcn.005e6f50
mov eax, dword [ebp - 0x410]
test eax, eax
jne 0x5e6eae
mov edi, 0x8007000e
jmp 0x5e6ee8
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x410], eax
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x410]
mov byte [edx + ecx], 0
mov ecx, dword [ebp - 0x410]
push eax
push ecx
lea ecx, [ebp - 0xc]
call fcn.005e6f80
mov esi, dword [ebp - 4]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x410]
lea edx, [ebp - 0x40c]
cmp eax, edx
je 0x5e6f0a
lea ecx, [ebp - 0x410]
call fcn.005e6f40
test ebx, ebx
je 0x5e6f21
mov edi, edi
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.0081d7ea
add esp, 4
test ebx, ebx
jne 0x5e6f10
mov eax, edi
lea esp, [ebp - 0x41c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5e7dd0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [ecx]
mov edx, dword [esp + 0x11c]
push esi
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x5e7e25
lea ecx, [esp + 4]
call fcn.005e7cd0
mov esi, eax
test esi, esi
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
je 0x5e7e3a
lea ecx, [esp + 4]
call fcn.005e7cd0
mov eax, esi
pop esi
add esp, 0x118
ret 4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x34]
push ecx
push 0
push eax
mov dword [esp + 0x2c], 0x100
call edi
test eax, eax
jne 0x5e7ea1
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0xc]
call fcn.005e7dd0
mov esi, eax
test esi, esi
jne 0x5e7ecf
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0xc]
push esi
push esi
push esi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push eax
mov dword [esp + 0x2c], 0x100
call edi
test eax, eax
je 0x5e7e67
mov eax, dword [esp + 8]
test eax, eax
je 0x5e7eb8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 8]
call fcn.005e7cd0
pop edi
mov eax, esi
pop esi
add esp, 0x118
ret 4
Function at 0x5e82d0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x5e82e2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8