joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc2a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
je 0x40cdb1
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call edi
mov ebp, 0x8000
and ax, bp
cmp ax, bp
je 0x40cc6a
push 0xa1
call edi
and ax, bp
cmp ax, bp
je 0x40cc6a
xor cl, cl
jmp 0x40cc6c
mov cl, 1
mov eax, dword [esp + 0x18]
pop edi
sub eax, 8
mov dword [esi + 0x1c], ebx
pop ebp
je 0x40cd43
sub eax, 0x1b
je 0x40cd29
dec eax
je 0x40cd15
dec eax
je 0x40ccee
dec eax
dec eax
je 0x40ccc3
sub eax, 7
jne 0x40cd99
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
cmp ecx, eax
jne 0x40cd4d
mov edx, dword [esi + 8]
lea ecx, [esi + 8]
cmp eax, dword [edx - 8]
jge 0x40cd8d
push 1
push eax
jmp 0x40cd7b
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x10]
cmp eax, dword [edx - 8]
jge 0x40ccd9
inc eax
cmp cl, bl
mov dword [esi + 0x10], eax
jne 0x40ccd9
mov dword [esi + 0x14], eax
cmp dword [esi + 0x64], ebx
je 0x40cd99
mov dword [esi + 0x1c], 3
jmp 0x40cd99
mov eax, dword [esi + 0x10]
cmp eax, ebx
jle 0x40cd00
dec eax
cmp cl, bl
mov dword [esi + 0x10], eax
jne 0x40cd00
mov dword [esi + 0x14], eax
cmp dword [esi + 0x64], ebx
je 0x40cd99
mov dword [esi + 0x1c], 2
jmp 0x40cd99
cmp dword [esi + 0x64], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
je 0x40cd99
mov dword [esi + 0x1c], 4
jmp 0x40cd99
mov eax, dword [esi + 8]
cmp dword [esi + 0x64], ebx
mov eax, dword [eax - 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
je 0x40cd99
mov dword [esi + 0x1c], 5
jmp 0x40cd99
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
cmp ecx, eax
je 0x40cd6a
push ecx
push eax
mov ecx, esi
call fcn.0040cdb8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jle 0x40cd65
mov dword [esi + 0x14], ecx
jmp 0x40cd8d
mov dword [esi + 0x10], eax
jmp 0x40cd8d
cmp eax, ebx
jle 0x40cd8d
dec eax
push 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push eax
lea ecx, [esi + 8]
call fcn.004cedff
push 1
lea ecx, [esi + 0xc]
push dword [esi + 0x10]
call fcn.004cedff
cmp dword [esi + 0x64], ebx
je 0x40cd99
mov dword [esi + 0x1c], 6
mov eax, dword [esp + 0xc]
add esi, 0x38
push 1
push esi
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
pop eax
jmp 0x40cdb3
xor eax, eax
pop esi
pop ebx
ret 8
Function at 0x40f550
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x4e02c3
call fcn.004b8e80
sub esp, 0x1a0
cmp byte [0x52c015], 0
push ebx
je 0x40f574
mov al, byte [0x52c014]
jmp 0x40f672
mov eax, dword [0x52933c]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x1ac]
push eax
push 0xff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
je 0x40f5a5
lea eax, [ebp - 0x1ac]
lea ecx, [ebp - 0x10]
push eax
call fcn.004d5325
push str.swflash.cab
lea ecx, [ebp - 0x10]
call fcn.004d5578
call fcn.0040a2ca
push 0
push dword [ebp - 0x10]
push str.http:__download.macromedia.com_pub_shockwave_cabs_flash_swflash.cab
call fcn.0040f6a6
add esp, 0xc
call fcn.0040f67f
test eax, eax
je 0x40f5fd
push 0
lea ecx, [ebp - 0xac]
call fcn.0040a033
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 1
call fcn.004d5cd8
and byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.0040a095
call fcn.0040f6f3
call fcn.0040a44d
lea ecx, [ebp - 0x14]
call fcn.00405794
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 2
call fcn.004d4f11
lea ecx, [ebp - 0x14]
call fcn.004057c0
test eax, eax
je 0x40f642
call fcn.0040f985
test eax, eax
mov dword [0x50efd8], eax
setg al
mov byte [0x52c014], al
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov bl, byte [0x52c014]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov byte [0x52c015], 1
call fcn.004057b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d519c
mov al, bl
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f725
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4e02e0
call fcn.004b8e80
sub esp, 0x5c
push ebx
xor ebx, ebx
cmp byte [0x52c016], bl
push edi
mov edi, ecx
je 0x40f74a
mov al, byte [0x52c014]
jmp 0x40f897
call fcn.0040f985
push dword [ebp + 8]
mov ecx, edi
mov dword [0x50efd8], eax
call fcn.0040fdfc
mov ecx, dword [0x50efd8]
mov edx, eax
cmp ecx, ebx
setg al
cmp edx, ebx
mov byte [0x52c014], al
jle 0x40f77c
cmp ecx, edx
jge 0x40f897
cmp al, bl
jne 0x40f897
mov eax, dword [0x52933c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040fc2c
test eax, eax
je 0x40f87c
cmp byte [edi + 0x49], bl
je 0x40f7b7
push str.__Q:A__R:N
lea ecx, [ebp - 0x10]
call fcn.004d5578
push esi
push 0x44
pop esi
lea eax, [ebp - 0x68]
push esi
push ebx
push eax
call fcn.004b8ea0
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [ebp - 0x68], esi
call fcn.004b8ea0
add esp, 0x18
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d55cc
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
call fcn.0040f985
cmp eax, ebx
mov dword [0x50efd8], eax
setg byte [0x52c014]
cmp eax, ebx
pop esi
jge 0x40f87c
mov eax, dword [0x52933c]
mov dword [ebp + 8], eax
push 0x65be
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004d626d
push str.Flash_Player_installation
lea ecx, [ebp - 0x14]
call fcn.004d520a
push 0x2030
mov ecx, edi
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0040e8c4
lea ecx, [ebp - 0x14]
mov byte [0x52c015], 1
call fcn.004d519c
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.004d519c
mov bl, byte [0x52c014]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov byte [0x52c016], 1
call fcn.004d519c
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40f985
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
mov eax, 0x4e0324
call fcn.004b8e80
sub esp, 0x128
or dword [ebp - 0x28], 0xffffffff
lea eax, [ebp - 0x18]
push ebx
push eax
xor ebx, ebx
push 1
push ebx
push str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11CF_96B8_444553540000InprocServer32
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f9bf
or eax, 0xffffffff
jmp 0x40fb32
mov eax, dword [0x52933c]
push esi
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
mov edi, 0x52be40
push ebx
push edi
push dword [ebp - 0x18]
mov dword [ebp - 4], ebx
call esi
cmp eax, ebx
je 0x40f9f0
or esi, 0xffffffff
jmp 0x40fb22
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call fcn.004d55cc
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x40f9e8
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.004d55cc
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push 1
push esi
call fcn.004bb051
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40f9e8
push edi
push esi
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.004d55cc
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
jne 0x40fa68
or esi, 0xffffffff
jmp 0x40fb1b
xor esi, esi
test dword [ebp - 0x24], 0xfffffffc
jbe 0x40fb18
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax + esi*4 + 2]
lea eax, [eax + esi*4]
push ecx
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x134]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x134]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
je 0x40fb18
push dword [ebp - 0x30]
lea ecx, [ebp - 0x14]
call fcn.004d520a
push ebx
push 0x2c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d5698
cmp eax, 0xffffffff
jg 0x40faec
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d519c
mov eax, dword [ebp - 0x24]
inc esi
shr eax, 2
cmp esi, eax
jb 0x40fa77
jmp 0x40fb18
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.004cf228
push dword [ebp - 0x1c]
call fcn.004bb046
pop ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c]
call fcn.004d519c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d519c
mov esi, dword [ebp - 0x28]
push edi
call fcn.004b9a55
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d519c
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41ccb3
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4e1400
call fcn.004b8e80
sub esp, 0x58
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x68], ebx
mov dword [ebp - 4], ebx
je 0x41cd6a
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.004b1fac
mov word [ebp - 0x64], bx
push 8
lea ecx, [ebp - 0x4c]
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004b1cf9
mov esi, 0x52be40
push 8
push esi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.004b1cf9
push 8
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004b1cf9
push 3
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004b1daa
lea eax, [ebp - 0x3c]
mov ecx, dword [edi + 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 5
call fcn.0044c480
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x3c]
push eax
call esi
lea eax, [ebp - 0x4c]
push eax
call esi
lea eax, [ebp - 0x64]
push eax
call esi
pop esi
jmp 0x41cd8d
call fcn.0041344a
cmp eax, ebx
jne 0x41cd77
xor eax, eax
jmp 0x41cd7a
mov eax, dword [eax + 0x1c]
push 5
push ebx
push ebx
push dword [ebp + 8]
push 0x50fd7c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004d519c
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x429455
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xor ebx, ebx
push str.DDRAW.DLL
mov dword [ebp - 0xc], ebx
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x42947e
push str.Couldnt_LoadLibrary_DDraw_r_n
jmp 0x4294ba
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.DirectDrawCreate
push eax
call esi
cmp eax, ebx
jne 0x4294a0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreate_r_n
jmp 0x4294ba
lea ecx, [ebp - 0xc]
push ebx
push ecx
push ebx
call eax
test eax, eax
jge 0x4294c7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_create_DDraw_r_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
xor eax, eax
jmp 0x4295ce
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 8]
push eax
push 0x4ea6f0
push 1
push ebx
push 0x4ea700
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x42950a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_create_CLSID_DirectMusic_r_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, 0x600
jmp 0x4295ce
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.DirectDrawCreateEx
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x429537
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreateEx_r_n
jmp 0x429556
push ebx
lea ecx, [ebp - 0x10]
push 0x4ea730
push ecx
push ebx
call eax
test eax, eax
jge 0x429563
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_DirectDrawCreateEx_r_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, 0x601
jmp 0x4295ce
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push str.D3D8.DLL
call edi
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x429595
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D8.DLL_r_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, 0x700
jmp 0x4295ce
push str.dpnhpast.dll
call edi
cmp eax, ebx
jne 0x4295b9
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.Couldnt_LoadLibrary_dpnhpast.dll_r_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, 0x800
jmp 0x4295ce
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
call esi
push dword [ebp - 0x14]
call esi
mov eax, 0x801
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430b68
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4e28d7
call fcn.004b8e80
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [0x52933c]
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [0x52933c]
mov dword [esi + 0x10], eax
mov eax, dword [0x52933c]
lea ebx, [esi + 0x14]
mov dword [ebx], eax
mov eax, dword [0x52933c]
mov dword [esi + 0x18], eax
mov eax, dword [0x52933c]
mov dword [esi + 0x30], eax
and dword [esi + 4], 0
mov edi, 0x52be40
push edi
mov byte [ebp - 4], 5
mov dword [esi], 0x4e9268
call fcn.004d5325
push edi
mov ecx, ebx
call fcn.004d5325
push edi
lea ecx, [esi + 0x18]
call fcn.004d5325
and dword [esi + 0x1c], 0
and dword [esi + 0x20], 0
fldz
push edi
lea ecx, [esi + 0x30]
fstp qword [esi + 0x28]
call fcn.004d5325
and byte [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430c1c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4e2918
call fcn.004b8e80
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4e9268
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 4
call fcn.004d519c
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.004d519c
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.004d519c
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.004d519c
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004d519c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x433ad7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.004b8ea0
add esp, 0xc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
push dword [ebp + 0xc]
mov word [ebp - 0x14], 0xa
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop esi
leave
ret
Function at 0x446b66
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x446b7f
test al, 0x10
je 0x446b7f
push 1
pop esi
jmp 0x446b81
xor esi, esi
lea ecx, [esp + 8]
call fcn.004d519c
mov eax, esi
pop esi
ret 4
Function at 0x452667
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x517c4c]
cmp dword [eax + 4], 0xc
jne 0x45267a
push 1
pop eax
pop ebp
ret
lea eax, [ebp + 0xc]
push edi
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x4526b5
test eax, eax
je 0x4526b1
cmp eax, 1
je 0x4526ad
cmp eax, 2
jne 0x4526be
push 0xf
jmp 0x4526b7
push 2
jmp 0x4526b7
push 0
jmp 0x4526b7
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov eax, edi
pop edi
pop ebp
ret

Function at 0x4526c3
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x517c4c]
cmp dword [eax + 4], 0xc
je 0x4526da
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
ret

Function at 0x4580e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push 1
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionMultimediaMIDIMap
push SysReAllocString
mov dword [ebp - 0xc], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x458226
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push str.CurrentInstrument
push dword [ebp - 4]
call esi
cmp eax, edi
je 0x45815a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push str.szPname
push dword [ebp - 4]
call esi
cmp eax, edi
jne 0x458226
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], edi
mov esi, 0x134
push esi
lea eax, [ebp - 0x140]
push edi
push eax
call fcn.004b8ea0
mov eax, dword [0x542664]
add esp, 0xc
lea edx, [ebp - 0x140]
mov dword [ebp - 0x140], esi
mov ecx, dword [eax]
push edx
push dword [ebp - 8]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp ebx, edi
jne 0x4581ec
cmp dword [ebp - 0x128], 1
jne 0x4581ec
push edi
push edi
lea eax, [ebp - 0x340]
push 0x100
push eax
lea eax, [ebp - 0x10c]
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x240]
push eax
call fcn.004baf40
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.004bcb40
add esp, 0x10
test eax, eax
je 0x4581f9
inc dword [ebp - 8]
cmp ebx, 1
je 0x458218
jmp 0x45816b
lea eax, [ebp - 0x138]
push 0x10
push eax
push dword [ebp + 8]
call fcn.004b9460
mov eax, dword [0x517c4c]
add esp, 0xc
test byte [eax + 8], 1
je 0x458226
mov eax, dword [0x542664]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46ac70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [0x55b3c4], ebx
jne 0x46ada3
mov eax, dword [0x55b3c0]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
jne 0x46aca5
push str.dsound.dll
call edi
mov dword [0x55b3c0], eax
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.DirectSoundCreate8
push eax
call esi
cmp eax, ebx
mov dword [0x55b3e4], eax
jne 0x46acce
push str.DirectSoundCreate
push dword [0x55b3c0]
call esi
mov dword [0x55b3dc], eax
push str.DirectSoundEnumerateA
push dword [0x55b3c0]
call esi
cmp dword [0x55b3e4], ebx
mov dword [0x55b3e0], eax
setne al
push eax
push dword [0x55b3c0]
call fcn.004719d8
cmp dword [0x55b3e4], ebx
pop ecx
pop ecx
je 0x46ad6d
lea eax, [ebp - 0x400]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x46ad61
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004ba5a0
lea eax, [ebp - 0x200]
push str.d3d9.dll
push eax
call fcn.004ba5b0
push ebx
lea eax, [ebp - 0x200]
push ebx
push eax
call fcn.0045797a
add esp, 0x1c
cmp eax, ebx
je 0x46ad97
push eax
call fcn.00457afd
pop ecx
mov dword [0x51e36c], 9
jmp 0x46ad97
mov dword [0x51e36c], 8
jmp 0x46ad97
push str.ddraw.dll
call edi
mov edi, eax
cmp edi, ebx
je 0x46ad97
push str.DirectDrawCreateEx
push edi
call esi
test eax, eax
je 0x46ad90
mov dword [0x51e36c], 7
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
mov dword [0x55b3c4], 1
pop esi
pop ebx
leave
ret

Function at 0x46c671
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x46c708
mov edx, dword [eax]
push ebx
push esi
push edi
mov byte [edx + 0x16], cl
mov edx, dword [eax]
mov byte [edx + 0x17], cl
mov edx, dword [eax]
mov byte [edx + 0x18], cl
mov edx, dword [eax]
mov byte [edx + 0x19], cl
mov esi, dword [eax + 4]
xor edx, edx
cmp esi, ecx
jle 0x46c6bd
mov edi, dword [eax]
mov ebx, ecx
shr ebx, 0x18
movzx edi, byte [edi + edx]
xor edi, ebx
shl ecx, 8
mov edi, dword [edi*4 + 0x51e9ac]
xor ecx, edi
inc edx
cmp edx, esi
jl 0x46c69f
xor edx, edx
cmp dword [eax + 0xc], edx
jle 0x46c6e4
mov esi, dword [eax + 8]
movzx edi, byte [esi + edx]
mov ebx, ecx
shr ebx, 0x18
xor edi, ebx
shl ecx, 8
mov edi, dword [edi*4 + 0x51e9ac]
xor ecx, edi
inc edx
cmp edx, dword [eax + 0xc]
jl 0x46c6c7
mov edx, dword [eax]
pop edi
mov byte [edx + 0x16], cl
mov esi, dword [eax]
mov edx, ecx
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [eax]
mov edx, ecx
shr edx, 0x10
mov byte [esi + 0x18], dl
mov eax, dword [eax]
shr ecx, 0x18
pop esi
mov byte [eax + 0x19], cl
pop ebx
ret
Function at 0x47802c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x478073
cmp edx, 0x10
jl 0x47805f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x47804c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x478073
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x47806b
and edx, 3
cmp edx, 3
jne 0x478087
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x47808c
cmp edx, 2
jne 0x478098
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x47809d
cmp edx, 1
jne 0x4780a3
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret