joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cc80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f0f78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
test edi, edi
je 0x48cd3a
mov dword [esp + 0xc], 0
mov esi, ecx
lea ebx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0048cdf0
lea eax, [esp + 0x14]
push eax
push 2
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ccf3
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], esi
jmp 0x48cd52
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0x14]
call fcn.0043d980
test eax, eax
je 0x48cd4e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cd2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48cd3a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push eax
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x10]
je 0x48cdb4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cd95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x48cda0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cdcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x48cdd8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48cfa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
xor esi, esi
cmp edx, esi
mov ebx, eax
jne 0x48cfd5
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cfcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
cmp ebx, esi
je 0x48cfad
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [esp + 0x10]
push eax
or ecx, 1
push ecx
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x48cfad
push edi
mov edi, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48d048
cmp edi, esi
je 0x48d035
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
call fcn.00401fb0
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x48d0e9
sub eax, 2
je 0x48d095
sub eax, 1
je 0x48d07b
lea ecx, [esp + 0x10]
call fcn.0042c0e0
lea ecx, [esp + 0x2c]
call fcn.00401fb0
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
push ebp
lea edx, [esp + 0x14]
lea ecx, [ebx + 8]
push edx
mov word [ebx], 0x13
call fcn.0043d940
mov edi, eax
jmp 0x48d13d
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x1c], esi
call fcn.0044a3f0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 1
push 0x11
mov edi, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ecx
mov word [ebx], 0x2011
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov ecx, eax
cmp ecx, esi
mov dword [ebx + 8], ecx
je 0x48d13d
mov ecx, dword [ecx + 0xc]
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
call fcn.0044a3f0
jmp 0x48d13d
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], esi
push ecx
lea edi, [esp + 0x1c]
xor esi, esi
mov word [ebx], 0x1f
call fcn.00438da0
mov esi, dword [esp + 0x14]
add esi, esi
push esi
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push esi
push 0
push eax
mov dword [ebx + 8], eax
call fcn.004d1c40
mov ebx, dword [ebx + 8]
add esp, 0xc
test ebx, ebx
je 0x48d13b
push ebp
lea edx, [esp + 0x14]
push edx
lea edi, [esp + 0x1c]
mov esi, ebx
call fcn.00438da0
mov edi, eax
xor esi, esi
xor eax, eax
cmp edi, esi
sete al
mov edi, eax
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x48d155
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
call fcn.00401fb0
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48d170
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4f4f68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x24]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
push esi
call fcn.00401850
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x30]
add esp, 4
call fcn.0048cfa0
mov edi, eax
add esp, 4
mov dword [esp + 0x18], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x48d1ee
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x48d5b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
cmp dword [edi], ebp
push esi
mov esi, eax
mov dword [esp + 8], ebp
jne 0x48d5c9
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
push ebx
lea ebx, [esp + 0xc]
call fcn.0048c250
test eax, eax
pop ebx
jl 0x48d61e
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov edx, dword [edi]
lea eax, [esp + 0xc]
push eax
push esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push ebp
push esi
push edx
mov dword [esp + 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x48d617
cmp dword [esp + 8], 3
jne 0x48d617
mov ebp, 1
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x48d6e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4eea58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x1c], ebp
cmp dword [edi], ebp
mov dword [esp + 0x10], ebp
jne 0x48d74f
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d73a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x24]
lea ebx, [esp + 0x10]
call fcn.0048c250
test eax, eax
mov esi, dword [esp + 0x28]
jl 0x48d7a7
xor eax, eax
cmp esi, ebp
setne al
cmp eax, ebp
jne 0x48d779
push 0x80004005
call fcn.00401730
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [esp + 0x10]
mov edx, dword [edi]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebp
jne 0x48d7a0
mov ebp, 1
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d7cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48e960
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, eax
mov eax, dword [ebp]
test eax, eax
mov dword [esp + 0xc], 0
jne 0x48e981
pop esi
mov eax, 0xc0000008
pop ebp
ret 0xc
test esi, esi
je 0x48ea34
cmp dword [esp + 0x10], 0
je 0x48ea34
cmp dword [esp + 0x14], 0
je 0x48ea34
push 2
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push eax
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jl 0x48e9f3
mov edx, dword [esp + 0xc]
push edi
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x48e9f8
mov esi, 0xc0000017
test edi, edi
je 0x48e9f0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp]
push 2
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push 0
push 0
push 0
push ebx
push esi
push edx
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
test esi, esi
jl 0x48e9dc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebp
ret 0xc
pop esi
mov eax, 0xc000000d
pop ebp
ret 0xc
Function at 0x48fc30
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4f0e64
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
mov ecx, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.004c2c8e
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esi], vtable.CSilencePlayer.0
mov dword [esi + 0x20], vtable.CSilencePlayer::XNotifyClient.0
call fcn.004bb047
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x48fcc1
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x24], eax
lea ebp, [esi + 0x38]
mov dword [ebp], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov byte [esp + 0x34], 4
mov dword [esi + 0x44], edi
lea edi, [esi + 0x48]
mov ebx, 4
lea esp, [esp]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x48fcf0
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x48fd14
xor eax, eax
jmp 0x48fd2f
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48fd20
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x24]
call fcn.00401e60
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push ebp
push 0x50dd4c
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push 1
mov dword [esi + 0x2c], edx
push 0
mov dword [esi + 0x30], eax
push 0x50dd3c
mov dword [esi + 0x34], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x48fde9
mov ebp, dword [ebp]
mov edx, dword [ebp]
lea eax, [esi + 0x20]
push eax
mov eax, dword [edx + 0x18]
push ebp
call eax
test eax, eax
jl 0x48fde9
push 0
push 4
push 0
push 0
push esi
push 0x490310
call fcn.004c3db0
mov edi, eax
test edi, edi
je 0x48fde9
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea eax, [esi + 0x44]
push eax
call ebx
mov ecx, dword [edi + 0x2c]
push eax
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
call fcn.00490250
test eax, eax
je 0x48fde9
mov eax, esi
call fcn.00490250
test eax, eax
je 0x48fde9
mov eax, dword [esi + 0x48]
test eax, eax
je 0x48fde9
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004cf0b8
add esp, 0x28
ret 0x14
Function at 0x495bb0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4ef820
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
cmp dword [ecx + 0x1c], 0
jne 0x495c05
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x495cdb
test eax, eax
jne 0x495c1d
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
jmp 0x495cce
cmp dword [esp + 0x1c], 0
mov edi, dword [esp + 0x20]
jne 0x495cc3
push eax
call dword [sym.imp.SECOMN32.dll_SEAPOCOMAPI_GetLastError]
add esp, 4
mov esi, eax
call fcn.004bb047
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x495c52
push 0x80004005
call fcn.00401730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
cmp esi, 0xffffff00
mov byte [esp + 0x14], 1
jne 0x495c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_WinError___d_n
lea ecx, [esp + 0x30]
push ecx
jmp 0x495c8f
push esi
push edi
push str._s_Error___d_n
lea edx, [esp + 0x30]
push edx
call fcn.00401af0
mov esi, dword [esp + 0x34]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov byte [esp + 0x14], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495cc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x14], 0xffffffff
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495ce7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x498220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0x80], eax
push ebp
xor eax, eax
cmp dword [ebx + 0x10], eax
push esi
push edi
jne 0x498256
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.004cf0b8
add esp, 0x88
ret
mov dword [esp + 0xc], eax
mov word [esp + 0x14], ax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
mov word [esp + 0x3c], ax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea ebp, [ebx + 0x1c]
lea esp, [esp]
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x90]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00401850
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [esi], eax
call fcn.0046a2e0
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 0x10]
add eax, 0x90
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
lea esi, [esp + 0x1c]
call fcn.00401850
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.0046a130
add esp, 4
test eax, eax
je 0x49838a
mov eax, dword [ebx + 0x10]
add eax, 0x90
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
lea esi, [esp + 0x44]
call fcn.00401850
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.0044f490
mov esi, eax
add esp, 4
test esi, esi
je 0x49838a
mov eax, dword [ebp + 4]
cmp eax, dword [esp + 0x18]
jne 0x49838a
mov cx, word [ebp + 2]
cmp cx, word [esp + 0x16]
jne 0x49838a
mov edx, eax
cmp edx, dword [esp + 0x40]
jne 0x49838a
mov ax, cx
cmp ax, word [esp + 0x3e]
je 0x498416
mov ecx, 0xa
mov esi, ebp
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x70]
shr eax, 0x10
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
movzx ecx, ax
imul ecx, dword [esp + 0x68]
mov word [esp + 0x70], ax
mov eax, dword [ebx + 0x10]
mov word [esp + 0x66], 2
mov dword [esp + 0x78], 3
mov dword [esp + 0x6c], ecx
mov eax, dword [eax + 0x90]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
lea esi, [esp + 0x6c]
call fcn.00401850
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.0046a2e0
add esp, 4
push 0x14
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
add eax, 1
cmp eax, 0xa
mov dword [esp + 0xc], eax
jl 0x4982c0
mov edx, dword [ebx + 0x10]
mov edi, dword [edx + 0x90]
call fcn.004c9321
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + 4]
push ecx
push str.SetDefRetryTime
push edi
mov ecx, eax
call fcn.004c5406
mov ecx, dword [esp + 0x8c]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004cf0b8
add esp, 0x88
ret
Function at 0x49a570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
push 0x48
mov ebx, eax
lea eax, [esp + 0x14]
push 0
push eax
mov esi, ecx
call fcn.004d1c40
mov ecx, dword [ebp + 8]
add esp, 0xc
push str.WAVE
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp dword [ebp + 8], 0
mov edi, eax
je 0x49a714
test edi, edi
je 0x49a714
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0xc]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x28], eax
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], edi
call dword [sym.imp.WINMM.dll_mmioOpenW]
push 0x20
push 0
lea ebx, [esi + 0x1b0]
mov edi, eax
push ebx
push edi
mov dword [esi + 0x1b8], 0x45564157
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x49a70b
push 0x10
lea eax, [esi + 0x19c]
push ebx
push eax
push edi
mov dword [eax], 0x20746d66
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
push 0
jne 0x49a70d
lea eax, [esi + 0x19c]
push eax
push edi
call dword [sym.imp.WINMM.dll_mmioAscend]
push 0x10
lea eax, [esi + 0x188]
push ebx
push eax
push edi
mov dword [eax], 0x61746164
call dword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
push 0
jne 0x49a70d
lea eax, [esi + 0x188]
push eax
push edi
call dword [sym.imp.WINMM.dll_mmioAscend]
mov ecx, dword [esi + 0x1a8]
push 0
push ecx
push edi
call dword [sym.imp.WINMM.dll_mmioSeek]
mov edx, dword [esi + 0x1a0]
push edx
lea eax, [esi + 0x160]
push eax
push edi
call dword [sym.imp.WINMM.dll_mmioRead]
cmp dword [esi + 0x1a0], eax
jne 0x49a70b
mov ebx, 1
cmp word [esi + 0x162], bx
jne 0x49a70b
cmp word [esi + 0x16e], 0x10
jne 0x49a70b
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi + 0x18c]
push edx
push esi
mov dword [esi + 0x84], ecx
call fcn.0049a720
test eax, eax
jne 0x49a6f0
push eax
push edi
call dword [sym.imp.WINMM.dll_mmioClose]
call fcn.0049aba0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x80], ebx
mov dword [esi + 0x8c], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49a720
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
lea esi, [ebp + 0xc]
push esi
push 0x49aa30
call sub.DSOUND.dll_DirectSoundEnumerateW
cmp dword [esi], 0
je 0x49a7a9
mov ebx, ebp
call fcn.0049ab60
test eax, eax
je 0x49a7a9
mov ebx, dword [esp + 0x18]
mov ecx, ebp
call fcn.0049a7c0
test eax, eax
je 0x49a7a9
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
lea esi, [ebp + 0x48]
push 0
push 0
push 0
push 0
call ebx
test eax, eax
mov dword [esi], eax
je 0x49a7a9
add edi, 1
add esi, 4
cmp edi, 4
jl 0x49a760
push 0
push 0
push 0
push 0
call ebx
test eax, eax
mov dword [ebp + 0x44], eax
je 0x49a7a9
lea eax, [ebp + 0x5c]
push eax
push 0
push ebp
push 0x49a980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 0x58], eax
jne 0x49a7b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x49bbb0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f0cb6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2028
call fcn.004d3970
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0x2024], eax
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x2038]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edi, [eax + 0xe0]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x49bc84
lea ecx, [esp + 0x2c]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49bc20
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2a], 0x5c
jne 0x49bc54
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49bc40
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x2a], cx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49bc71
push 0
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x2c]
push ecx
push 0x515798
push edi
call fcn.00401af0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.004cae58
mov dword [esp + 0x2040], 0
mov eax, dword [edi]
push 0
push eax
lea ecx, [esp + 0x1c]
call fcn.004caee6
test eax, eax
jne 0x49bcec
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.WAVE
call fcn.00401b10
mov byte [esp + 0x2044], 1
mov eax, dword [edi]
push 0x65
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00401850
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x204c], 0
call fcn.0044a880
lea ecx, [esp + 0x14]
mov dword [esp + 0x2040], 0xffffffff
call fcn.004cae7e
mov eax, 1
mov ecx, dword [esp + 0x2038]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x2024]
xor ecx, esp
call fcn.004cf0b8
mov esp, ebp
pop ebp
ret 4