joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fe0
Capabilities:
Get common file path

Disassembly:
push esi
lea esi, [ecx + 8]
push edi
mov ecx, 0x82
xor eax, eax
mov edi, esi
push esi
push 0x208
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
ja 0x402005
pop edi
xor eax, eax
pop esi
ret
push 0x5c
push esi
call fcn.00409cf6
mov cl, byte [eax]
add esp, 8
test cl, cl
je 0x40201a
mov byte [eax + 1], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x402030
Capabilities:
Connect to http server
Create http request
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x411d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18c
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00403200
xor edi, edi
mov dword [ebx + 0x224], eax
push edi
push edi
push edi
push edi
push str.upload_files
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x14], esi
jne 0x40207e
xor eax, eax
jmp 0x4021c6
push edi
push edi
push 3
push 0x4183cc
push 0x4183cc
push 0x50
push str.p3p.sogou.com
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebp, eax
cmp ebp, edi
jne 0x4020ae
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x4021c6
mov al, byte [esp + 0x13]
mov dword [esp + 0x28], edi
mov byte [esp + 0x24], al
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x1a4], edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x99]
mov byte [esp + 0x98], 0
lea edx, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push str.Version
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [esp + 0x34], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x402134
lea ecx, [esp + 0x98]
push str.1.0.0.0
push ecx
call esi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x34]
push str.recv_p2pcrash.php_software
push edx
stosb byte es:[edi], al
call esi
lea eax, [esp + 0x34]
push str.ietool
push eax
call esi
lea ecx, [esp + 0x34]
push str.ver
push ecx
call esi
lea edx, [esp + 0x98]
lea eax, [esp + 0x34]
push edx
push eax
call esi
lea ecx, [esp + 0x34]
lea edx, [ebx + 0x220]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00404400
push ebp
mov ecx, ebx
call fcn.004021e0
test eax, eax
jne 0x4021b1
push str.error_UseHttpSendReqEx_n
call fcn.00409d68
add esp, 4
xor eax, eax
jmp 0x4021c6
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x198
ret
Function at 0x406c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x406c5b
cmp ebx, 8
jg 0x406c5b
mov eax, 1
jmp 0x406c5d
xor eax, eax
mov esi, dword [esp + 0x14]
push str.bad_pack_level
push eax
push esi
call fcn.004054b0
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x406c94
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x4132fa]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x4132f8]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x4132fc]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x4132fe]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x406cf5
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x406d01
cmp ebx, 8
jl 0x406d01
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x406d7a
cmp eax, 0xffffffff
je 0x406d7a
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x406d45
push esi
call fcn.00406f90
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x406d4d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x408010
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40801b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x40811e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x413348]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x413348]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x413348]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x413348]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x413348]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x413348]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x413348]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x413348]
xor eax, edx
inc ecx
dec edi
jne 0x408036
pop edi
test esi, esi
je 0x408140
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x413348]
xor eax, edx
inc ecx
dec esi
jne 0x408122
pop esi
pop ebx
not eax
ret
Function at 0x408300
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x40831e
mov eax, 0x1000000
pop esi
add esp, 0x44
ret
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x408338
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x40834b
mov ebp, 1
test al, 2
je 0x408352
or ebp, 2
test al, 4
je 0x408359
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x408363
or ebp, 0x10
test al, 0x20
je 0x40836a
or ebp, 0x20
test ecx, ecx
je 0x408376
or ebp, 0x40000000
jmp 0x40837c
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x40838c
or ebp, 0x800000
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x40843b
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x40843b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x40843b
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x408435
cmp eax, 0x454e
je 0x408435
cmp eax, 0x454c
je 0x408435
cmp eax, 0x4550
jne 0x40843b
or ebp, 0x400000
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x408447
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x408456
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x408496
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.00408240
mov edx, dword [esp + 0x34]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.00408240
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.00408240
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x4084cd
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4086b0
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x408700
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x4086dc
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x408728
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x408b50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x408bba
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x408c0b
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x408b76
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.00408010
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x408c04
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408c0b
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.00408010
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x40966b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40968b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040a938
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4096ae
test byte [esp + 8], 2
je 0x4096ae
call fcn.0040a9ab
mov dword [eax], 0xd
call fcn.0040a9b4
mov dword [eax], 5
jmp 0x409687
xor eax, eax
ret
Function at 0x402440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xafcc4
call fcn.0040cc50
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xafca0], 0
push eax
push eax
push eax
mov word [ebp - 0xafc8c], ax
lea eax, [ebp - 0xafc9c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xafca0]
mov dword [ebp - 0xafc9c], 0x10001
push eax
mov dword [ebp - 0xafc98], 0x5dc0
mov dword [ebp - 0xafc94], 0x5dc0
mov dword [ebp - 0xafc90], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xafc80
lea eax, [ebp - 0xafc88]
push 0
push eax
call fcn.00404340
add esp, 0xc
xor eax, eax
mov ebx, eax
movsx ecx, al
shr ebx, 3
mov edx, eax
and ebx, 1
shr edx, 0xb
imul ebx, eax
movsx edx, dl
imul edx, ecx
shr ebx, 3
xor bl, dl
mov byte [ebp + eax - 0xafc88], bl
inc eax
cmp eax, 0xafc80
jb 0x4024c4
lea eax, [ebp - 0xafc88]
mov dword [ebp - 0xafcbc], 0xafc80
mov dword [ebp - 0xafcc0], eax
lea eax, [ebp - 0xafcc0]
push 0x20
push eax
push dword [ebp - 0xafca0]
mov dword [ebp - 0xafcb8], 0
mov dword [ebp - 0xafcb4], 0
mov dword [ebp - 0xafcb0], 0
mov dword [ebp - 0xafcac], 0
mov dword [ebp - 0xafca8], 0
mov dword [ebp - 0xafca4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xafcc0]
push eax
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xafcc0]
push eax
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403657
mov esp, ebp
pop ebp
ret
Function at 0x4025a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.0040cc50
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call fcn.00404340
add esp, 0xc
xor eax, eax
mov ebx, eax
movsx ecx, al
shr ebx, 3
mov edx, eax
and ebx, 1
shr edx, 9
imul ebx, eax
movsx edx, dl
imul edx, ecx
shr ebx, 3
xor bl, dl
mov byte [ebp + eax - 0x50c08], bl
inc eax
cmp eax, 0x50bfe
jb 0x402624
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403657
mov esp, ebp
pop ebp
ret
Function at 0x402700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.0040cc50
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call fcn.00404340
add esp, 0xc
xor eax, eax
mov ebx, eax
movsx ecx, al
shr ebx, 3
mov edx, eax
and ebx, 0xe
shr edx, 8
imul ebx, eax
movsx edx, dl
imul edx, ecx
shr ebx, 3
xor bl, dl
mov byte [ebp + eax - 0x50c08], bl
inc eax
cmp eax, 0x50bfe
jb 0x402784
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403657
mov esp, ebp
pop ebp
ret
Function at 0x405f30
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], str.hid.dll
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
push str.HidD_GetHidGuid
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], eax
push str.HidD_GetPreparsedData
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
push str.HidD_FreePreparsedData
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
push str.HidD_GetAttributes
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
push str.HidD_GetProductString
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], eax
push str.HidD_SetFeature
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
jmp 0x40614c
pop edx
push eax
push eax
add esp, 4
add eax, 0x3632
pop eax
mov dword [ebp - 0x10], 1
push edi
push ecx
add esp, 4
add edi, 0x1100f
add edi, 0x8905
sub edi, 0x6f11
pop edi
push edx
or edx, 0xa993
xor edx, 0x182ce
add edx, 0xf5c7
sub edx, 0x46f2
pop edx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edi
add esp, 4
call fcn.004061cf
add byte [edi + 0x4b], al
aas
dec ecx
inc edi
cmp dword [ebx + 0x9e804c4], eax
add esp, 4
call 0x4061e0
add byte [eax + 0x3e], cl
cmp eax, dword [edi + 0x45]
Function at 0x40b79c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0xd78], 0
jne 0x40b7b8
mov dword [ebp - 0x33c], 0
jmp 0x40ba03
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0x554], ecx
push edx
push edx
add esp, 4
and edx, 0x70f2
pop edx
push edx
push eax
add esp, 4
jmp 0x40b7db
pop edx
push edi
add edi, 0xe891
xor edi, 0x1b07
or edi, 0x10221
and edi, 0x16caa
pop edi
lea edx, [ebp - 0x1844]
mov dword [ebp - 0xd74], edx
mov eax, dword [ebp - 0x554]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd70], ecx
xor edx, edx
mov word [ebp - 0x234], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
push edi
add esp, 4
and eax, 0xeea6
and eax, 0xb9dd
jmp 0x40b837
add eax, 0x7ae4
pop eax
push ebx
and ebx, 0xece6
add ebx, 0x8802
add ebx, 0x11684
pop ebx
mov ecx, dword [ebp - 0xd70]
mov dx, word [ecx]
mov word [ebp - 0x111e], dx
mov eax, dword [ebp - 0xd70]
add eax, 2
mov dword [ebp - 0xd70], eax
jmp dword [esi - 0x75]
invalid
loop 0x40b864
invalid
jmp dword [esi - 0x77]
invalid
int3
std
invalid
dec dword [ebx - 0xd736b]
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test eax, esp
out dx, al
invalid
dec dword [ebx - 0xd7373]
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
loopne 0x40b891
invalid
jmp dword [esi - 0x77]
push ebp
enter 0x5357, 0xffffffffffffff83
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x40], al
inc ebx
aaa
dec ebx
xor dh, byte [ebx]
push eax
add esp, 4
jmp 0x40b8c8
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x74c8
sub ebx, 0x63fb
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40b8f8
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1718], ecx
jmp 0x40b952
movzx eax, word [ebp - 0x234]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40b820
movzx edx, word [ebp - 0x234]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
invalid
test bh, bh
invalid
invalid
Function at 0x40b8bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0xd78], 0
jne 0x40b7b8
mov dword [ebp - 0x33c], 0
jmp 0x40ba03
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0x554], ecx
push edx
push edx
add esp, 4
and edx, 0x70f2
pop edx
push edx
push eax
add esp, 4
jmp 0x40b7db
pop edx
push edi
add edi, 0xe891
xor edi, 0x1b07
or edi, 0x10221
and edi, 0x16caa
pop edi
lea edx, [ebp - 0x1844]
mov dword [ebp - 0xd74], edx
mov eax, dword [ebp - 0x554]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd70], ecx
xor edx, edx
mov word [ebp - 0x234], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
push edi
add esp, 4
and eax, 0xeea6
and eax, 0xb9dd
jmp 0x40b837
add eax, 0x7ae4
pop eax
push ebx
and ebx, 0xece6
add ebx, 0x8802
add ebx, 0x11684
pop ebx
mov ecx, dword [ebp - 0xd70]
mov dx, word [ecx]
mov word [ebp - 0x111e], dx
mov eax, dword [ebp - 0xd70]
add eax, 2
mov dword [ebp - 0xd70], eax
jmp dword [esi - 0x75]
invalid
loop 0x40b864
invalid
jmp dword [esi - 0x77]
invalid
int3
std
invalid
dec dword [ebx - 0xd736b]
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test eax, esp
out dx, al
invalid
dec dword [ebx - 0xd7373]
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
loopne 0x40b891
invalid
jmp dword [esi - 0x77]
push ebp
enter 0x5357, 0xffffffffffffff83
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x40], al
inc ebx
aaa
dec ebx
xor dh, byte [ebx]
push eax
add esp, 4
jmp 0x40b8c8
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x74c8
sub ebx, 0x63fb
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40b8f8
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1718], ecx
jmp 0x40b952
movzx eax, word [ebp - 0x234]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40b820
movzx edx, word [ebp - 0x234]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
invalid
test bh, bh
invalid
invalid