joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459590
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb2c
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0xb28], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4595d8
mov ecx, dword [edi + 0x40]
sub ecx, eax
mov eax, 0xa57eb503
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x4595dd
call fcn.00462e47
imul esi, esi, 0x630
add esi, dword [edi + 0x3c]
mov ecx, 0x18c
lea edi, [esp + 0x2f8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x2f8]
push eax
push 0
push 0x410
call dword [0x49f0d8]
mov esi, eax
test esi, esi
je 0x459640
push 0x104
lea ecx, [esp + 0x92c]
push ecx
push 0
push esi
call fcn.0049387c
lea edx, [esp + 0x928]
push edx
push 0x4a2ba0
call fcn.00466ab9
add esp, 8
push esi
call dword [0x49f2e4]
push 0x100
push 0x2b4
lea eax, [esp + 0x48]
push eax
push 0
lea ecx, [esp + 0x938]
push ecx
call dword [0x49f378]
test eax, eax
jl 0x45966b
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [0x49f478]
mov eax, dword [ebx]
mov edi, dword [esp + 0x3c]
push eax
call dword [0x49f058]
mov edx, dword [ebx]
push edx
mov esi, eax
call dword [0x49f050]
push esi
call dword [0x49f050]
push edi
push esi
call dword [0x49f05c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push 0x18
push edi
call dword [0x49f07c]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 3
push 0
push 0
push 0x10
push 0x10
push ecx
mov ecx, dword [ebx]
add edx, 0xc
push edx
add eax, 0xe
push eax
push ecx
call dword [0x49f450]
push 0xffffffffffffffff
push esi
call dword [0x49f04c]
test esi, esi
je 0x45970a
push esi
call dword [0x49f054]
test eax, eax
je 0x45970a
xor esi, esi
mov edx, dword [ebx]
push 0xffffffffffffffff
push edx
call dword [0x49f04c]
mov eax, dword [esp + 0x3c]
mov ebx, dword [0x49f074]
push eax
call ebx
mov ecx, dword [esp + 0x38]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [0x49f47c]
test esi, esi
je 0x45973f
push esi
call dword [0x49f054]
test edi, edi
je 0x459746
push edi
call ebx
mov ecx, dword [esp + 0xb34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004629a0
mov esp, ebp
pop ebp
ret 0x18
Function at 0x45f690
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [0x49f428]
xor ebx, ebx
push ebx
mov ebp, ecx
call edi
push 1
mov esi, eax
call edi
push ebx
push 0x4a051c
mov edi, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [0x49f388]
cmp eax, ebx
je 0x45f6d8
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x49f3ac]
mov eax, dword [esp + 0x10]
cmp eax, ebx
jle 0x45f6f3
sub eax, dword [esp + 0x18]
lea ecx, [edi - 0xe2]
lea eax, [eax + esi - 0xcd]
jmp 0x45f723
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jle 0x45f703
add ecx, 0xffffff1e
jmp 0x45f71d
mov eax, dword [esp + 0x18]
cmp eax, edi
jge 0x45f716
add eax, 5
lea ecx, [edi - 0xe2]
jmp 0x45f723
mov ecx, dword [esp + 0x1c]
add ecx, 0x1f
lea eax, [esi - 0xcd]
mov edx, dword [ebp + 4]
push 0x10
push 0xdf
push 0xc8
push ecx
push eax
push ebx
push edx
call dword [0x49f474]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4604c0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0045fb10
mov eax, dword [esi + 4]
push eax
call dword [0x49f414]
push 0
push 0
push 0x465
push eax
call dword [0x49f3b0]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [0x49f420]
xor eax, eax
pop esi
ret 0x10
Function at 0x47f6e2
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x47f7bf
cmp byte [edi], bl
je 0x47f7bf
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x47f7bf
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push edi
mov byte [esi], bl
call dword [0x49f224]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x47f7bf
push ebx
push edi
mov dword [ebp - 8], ebx
call fcn.00493864
mov edi, eax
cmp edi, ebx
mov byte [esi], bl
je 0x47f7b1
push edi
call fcn.00462f90
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x47f7b1
push eax
push edi
push ebx
push dword [ebp + 8]
call fcn.0049385e
test eax, eax
je 0x47f7a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x4a5330
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.00493858
test eax, eax
je 0x47f7a8
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push 0x77
push esi
call fcn.004664ea
add esp, 0x1c
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.00462c8a
pop ecx
push dword [ebp - 0x10]
call dword [0x49f2e4]
mov eax, dword [ebp - 8]
jmp 0x47f7c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47f7c6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x4b6640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov esi, edx
je 0x47f96a
cmp byte [edi], bl
je 0x47f96a
cmp esi, ebx
je 0x47f96a
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push edi
mov byte [esi], bl
call dword [0x49f224]
cmp eax, 0xffffffff
mov dword [ebp - 0x4c], eax
je 0x47f96a
push ebx
push edi
mov dword [ebp - 0x58], ebx
call fcn.00493864
cmp eax, ebx
mov dword [ebp - 0x48], eax
mov byte [esi], bl
je 0x47f8a7
push eax
call fcn.00462f90
cmp eax, ebx
pop ecx
mov dword [ebp - 0x5c], eax
je 0x47f8a7
push eax
push dword [ebp - 0x48]
push ebx
push edi
call fcn.0049385e
test eax, eax
je 0x47f89e
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x4a5330
push dword [ebp - 0x5c]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], ebx
call fcn.00493858
test eax, eax
je 0x47f89e
push esi
call fcn.00468840
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx + 0xc]
push edx
movzx edx, word [ecx + 0xe]
push edx
movzx edx, word [ecx + 8]
movzx ecx, word [ecx + 0xa]
push edx
push ecx
dec eax
push str._d._d._d._d
push eax
push esi
call fcn.004664ea
add esp, 0x20
mov dword [ebp - 0x58], 1
push dword [ebp - 0x5c]
call fcn.00462c8a
pop ecx
mov edi, dword [0x49f11c]
push ebx
lea eax, [ebp - 0x50]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x47f95c
cmp dword [ebp - 0x50], 0x40
jne 0x47f95c
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x4c]
call dword [0x49f120]
push ebx
lea eax, [ebp - 0x50]
push eax
push 0xf8
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x47f95c
cmp dword [ebp - 0x50], 0xf8
jne 0x47f95c
push esi
call fcn.00468840
add esi, eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x5c], ebx
call fcn.00493d6a
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x80]
inc eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d
push 0x77
push dword [ebp - 0x54]
call fcn.004664ea
add esp, 0x2c
push dword [ebp - 0x4c]
call dword [0x49f2e4]
mov eax, dword [ebp - 0x58]
jmp 0x47f96c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004629a0
leave
ret
Function at 0x4804ad
Capabilities:
Parse pe header

Disassembly:
push ebp
sub esp, 0x90
lea ebp, [esp - 4]
mov eax, dword [0x4b6640]
xor eax, ebp
mov dword [ebp + 0x90], eax
push 0x118
mov eax, 0x49be36
call fcn.004738c6
mov ebx, dword [ebp + 0x9c]
mov esi, dword [ebp + 0xa0]
mov eax, dword [ebp + 0xa4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xa8]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 0xac]
mov dword [ebp - 0x24], edx
and dword [ebp - 4], 0
mov byte [ebp + 0x40], 0
xor eax, eax
lea edi, [ebp + 0x41]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
pop ecx
xor eax, eax
lea edi, [ebp + 0x48]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x18]
push eax
push 0x40
lea eax, [ebp]
push eax
push esi
push ebx
call edx
test eax, eax
je 0x480535
cmp dword [ebp - 0x18], 0x40
mov byte [ebp - 0x14], 1
je 0x480539
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00480472
cmp word [ebp], 0x5a4d
sete al
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00480472
lea eax, [ebp - 0x18]
push eax
mov edi, 0xf8
push edi
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp + 0x3c]
add eax, esi
push eax
push ebx
call dword [ebp - 0x24]
test eax, eax
je 0x480583
cmp dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 1
je 0x480587
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00480472
cmp dword [ebp - 0x124], 0x4550
jne 0x4805b8
cmp word [ebp - 0x120], 0x14c
jne 0x4805b8
cmp word [ebp - 0x10c], 0x10b
mov byte [ebp - 0x14], 1
je 0x4805bc
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00480472
mov eax, dword [ebp + 0x3c]
lea eax, [esi + eax + 0xf8]
mov dword [ebp - 0x1c], eax
movzx edi, word [ebp - 0x11e]
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], edi
jae 0x480669
lea eax, [ebp - 0x18]
push eax
push 0x28
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x1c]
push ebx
call dword [ebp - 0x24]
test eax, eax
je 0x480607
cmp dword [ebp - 0x18], 0x28
mov byte [ebp - 0x14], 1
je 0x48060b
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00480472
add dword [ebp - 0x1c], 0x28
push 0x28
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00476bc5
add esp, 0xc
test eax, eax
je 0x480669
mov ecx, dword [ebp + 0x8c]
mov eax, 0x20000020
and ecx, eax
cmp ecx, eax
jne 0x48065a
mov eax, dword [ebp + 0x74]
add eax, esi
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x78]
add eax, ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x48066b
inc dword [ebp - 0x20]
jmp 0x4805df
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.004629a0
add ebp, 0x94
leave
ret
Function at 0x492770
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49cf58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x492620
push 0
push 0
call fcn.004648d4
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4927db
lea ecx, [esp + 0x10]
call fcn.00462a48
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00412530
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x492801
cmp eax, 0xffffffff
je 0x492801
push eax
call dword [0x49f2e4]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [0x49f250]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x401a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4264ed
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x433e70]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4e0], ecx
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d980
push 0x3ef
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
push 0x428878
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d315
push 3
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
push 0
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d35c
push 0x3ea
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
push 0
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d35c
push 0x3ef
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
push 0
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d35c
push 0x3f0
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
push 0
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d35c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x4d0], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SoftwareSynapse_AudioLegend_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b95
mov dword [ebp - 0x4d0], 0x104
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x4cc]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push str.Serial
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401b8b
push 0x3ee
mov ecx, dword [ebp - 0x4e0]
call fcn.0040d22b
mov dword [ebp - 0x4d4], eax
lea edx, [ebp - 0x4cc]
push edx
mov ecx, dword [ebp - 0x4d4]
call fcn.0040d315
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [ecx + 0x78]
push edx
mov ecx, dword [ebp - 0x4e0]
call fcn.00401670
push 0
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [eax + 0x78]
push ecx
mov ecx, dword [ebp - 0x4e0]
call fcn.00401670
push 0xc8
call fcn.00401200
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x4dc], 0
je 0x401bfd
mov edx, dword [ebp - 0x4e0]
push edx
mov ecx, dword [ebp - 0x4dc]
call fcn.00405160
mov dword [ebp - 0x4e4], eax
jmp 0x401c07
mov dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [ebp - 0x4d8]
mov dword [ecx + 0x74], edx
push 0
push 0x82
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [eax + 0x74]
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx + 0x74]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x13c]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004159dd
mov esp, ebp
pop ebp
ret
Function at 0x404650
Capabilities:
Prepare http request

Disassembly:
sub esp, 0x240
mov eax, dword [0x433e70]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebp
mov ebp, dword [esp + 0x248]
push esi
push edi
push 0x3c
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
call fcn.004159f0
or eax, 0xffffffff
mov dword [esp + 0x48], eax
mov dword [esp + 0x20], eax
lea eax, [edi + 0x4c]
lea ecx, [esp + 0x54]
push str.WinHttpCrackURL
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0x100
call fcn.00402cf0
mov eax, ebp
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4046b7
push 0
push 0
sub eax, ecx
push eax
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x4046e4
mov ecx, edi
call fcn.00404510
xor al, al
jmp 0x40480e
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
push ebx
neg ecx
or ecx, eax
push ecx
call fcn.004076bb
mov ebx, eax
add esp, 4
xor eax, eax
mov word [ebx + esi*2], ax
mov eax, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404710
push esi
push ebx
sub eax, edx
push eax
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
push ecx
push 0
push esi
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x404800
push 0x429834
lea esi, [edi + 0x4c]
push esi
call fcn.00402cf0
mov edx, dword [esp + 0x30]
mov ecx, dword [edi + 0x34]
add esp, 8
push 0
push edx
lea eax, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0x38], eax
test eax, eax
je 0x404800
xor ebx, ebx
cmp dword [esp + 0x1c], 2
push 0x42980c
setne bl
push esi
dec ebx
and ebx, 0x800000
call fcn.00402cf0
mov edx, dword [esp + 0x44]
mov eax, dword [edi + 0x38]
add esp, 8
push ebx
push 0
push 0
push 0
push edx
push 0x429804
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x3c], eax
test eax, eax
je 0x404800
push 0x4297d0
push esi
call fcn.00402cf0
mov ecx, dword [edi + 0x3c]
add esp, 8
push 0
push 0x7e4000
push 0x4040c0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
test eax, eax
jne 0x404800
push 0x4297a8
push esi
call fcn.00402cf0
mov edx, dword [edi + 0x3c]
add esp, 8
push edi
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x40480b
mov ecx, edi
call fcn.00404510
xor al, al
jmp 0x40480d
mov al, 1
pop ebx
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004159dd
add esp, 0x240
ret 4
Function at 0x4049c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x4c0
mov eax, dword [0x433e70]
xor eax, esp
mov dword [esp + 0x4bc], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareSynapse_AudioLegend_
push 0x80000001
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404a59
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x42996c
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a4f
mov al, 1
mov ecx, dword [esp + 0x4bc]
xor ecx, esp
call fcn.004159dd
add esp, 0x4c0
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4bc]
xor ecx, esp
xor al, al
call fcn.004159dd
add esp, 0x4c0
ret
Function at 0x40d170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40d1b7
call fcn.0040eae5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40d1b7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40d1d3
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040cce8
mov esi, eax
test edi, edi
je 0x40d1d1
test ebx, ebx
je 0x40d1d1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d491
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x426f1c
call fcn.00417602
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40d4b6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40d4fc
lea ecx, [ebp - 0x10]
call fcn.004020c0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407824
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011a0
mov eax, esi
call fcn.004176da
ret 8

Function at 0x40debc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40dee0
cmp dword [edi + 0x54], 0
jne 0x40dee0
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040eae5
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040de7d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4159dd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433e70]
jne 0x4159e7
repz ret
jmp fcn.0041bc65

Function at 0x41ebcc
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41ebfb
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x41ebf6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41ebe0
invalid
adc eax, dword [ecx + 0xfffe1]
add byte [ebx + 0x34572bd6], cl
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x41ebe8
cmp edx, ebx
jne 0x41ed36
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x41ebb7
add eax, dword [eax + 4]
jmp 0x41eba4
mov dword [ebp + 0xc], ebx
jmp 0x41ec06
Function at 0x41edd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041e557
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041e50c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
invalid
invalid
invalid
stc

Function at 0x41f906
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x4206da
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.0041e4b8
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x41f954
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x41f99d
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x41f947
call fcn.0041e547
adc al, 0xfd
mov bl, 0x1f
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
pop edi
pop esi
pop ebx
leave
ret