joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f720
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415d5c]
call fcn.00404b6c
xor eax, eax
push ebp
push 0x46f864
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bb068], 0
jne 0x46f773
mov ecx, dword [0x4bc89c]
mov dl, 1
mov eax, dword [0x407644]
call fcn.0040c288
call fcn.00403b4c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402da4
mov eax, ebx
call fcn.00404a1c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46f874
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405c64
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a2c
test eax, eax
jle 0x46f80b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46f804
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040443c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404424
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004084f0
test eax, eax
jne 0x46f804
mov ebx, 0x15
jmp 0x46f810
mov ebx, 0x10
jmp 0x46f810
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4bb068]
call fcn.0046f61c
mov eax, dword [ebp - 8]
call fcn.0046f61c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f86b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004041d8
lea eax, [ebp - 0x10]
mov edx, dword [0x415d5c]
call fcn.00404c3c
ret

Function at 0x497644
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49769e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00497634
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00495304
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00494e1c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4976a5
lea eax, [ebp - 4]
call fcn.004041b4
ret
Function at 0x49ce1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49d07c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49ce7f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049c934
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cbd0
cmp al, 1
jne 0x49ce7f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049cbfc
test al, al
je 0x49d00b
cmp dword [ebp - 8], 0
jge 0x49ce9d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049c934
mov eax, dword [ebp - 0x210]
call fcn.00404474
cmp ebx, eax
jge 0x49cee7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049c934
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4bcfa8]
and eax, 0xff
bt dword [edx], eax
jae 0x49cee7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49cefb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049cdf8
cmp ebx, dword [ebp - 8]
je 0x49cffd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49cf27
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035bc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbf24]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49cfea
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035bc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbf24]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004547cc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035bc
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbf24]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004547cc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cff1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49d05e
cmp dword [ebp - 8], 0
jge 0x49d016
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049c934
mov eax, dword [ebp - 0x218]
call fcn.00404474
cmp eax, dword [ebp - 8]
jg 0x49d050
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049c934
mov eax, dword [ebp - 0x21c]
call fcn.00404474
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049cdf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d083
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004041d8
ret
Function at 0x4a1370
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a139e
mov eax, ebx
call fcn.004a1e24
cmp dword [ebx + 0x40], 0
je 0x4a1397
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a140f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a1401
cmp dword [ebx + 8], 0
je 0x4a13c0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a13d2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a1401
cmp dword [ebx + 8], 0
je 0x4a13b3
cmp eax, 3
je 0x4a13e5
dec eax
jne 0x4a13b3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a13b3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a13b3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a142d
cmp dword [ebx + 0x14], 0xcc
je 0x4a142d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a1438
pop ebx
ret

Function at 0x4b51c4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409348
add esp, 0x108
pop ebx
ret

Function at 0x4b69dc
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404664
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x4b6ac9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [edi]
call fcn.0040278c
mov ebx, eax
cmp dword [edi], 0
jbe 0x4b6a26
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x4b6a9c
mov eax, dword [ebx + 0xc]
and eax, 1
cmp eax, 1
jne 0x4b6a4b
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 4]
call fcn.004043ac
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004047b8
test eax, eax
jle 0x4b6a68
mov eax, dword [ebp - 0xc]
call fcn.00404674
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [edi]
mov eax, ebx
call fcn.004027ac
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [edi]
call fcn.0040278c
mov ebx, eax
cmp dword [edi], 0
jbe 0x4b6a90
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x4b6a35
mov edx, dword [edi]
mov eax, ebx
call fcn.004027ac
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6ad0
lea eax, [ebp - 0xc]
call fcn.004041b4
lea eax, [ebp - 4]
call fcn.004041b4
ret
Function at 0x401f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4562f4]
push esi
test eax, eax
je 0x401f57
mov esi, dword [ebp + 8]
test esi, esi
je 0x401f57
mov ax, word [0x4562f8]
push eax
call fcn.004077c0
mov ecx, dword [0x4562f8]
add esp, 4
and ecx, 0xffff
push esi
push 1
push ecx
call fcn.00407890
add esp, 0xc
test eax, eax
jne 0x401f47
mov eax, 1
pop esi
pop ebp
ret
push eax
call fcn.00404470
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4028a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 1
push eax
push 0xf003f
push 0
push str.SoftwareSquare_Soft__Inc.Final_Fantasy_VII1.00Graphics
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4029ce
push edi
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [ebp - 0xc]
push esi
push edx
push eax
mov eax, dword [ebp - 8]
push 0x410298
push eax
mov dword [ebp - 4], 0x10
call edi
test eax, eax
jne 0x402915
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402915
mov edx, esi
or ecx, 0xffffffff
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea eax, [ebp - 4]
lea ecx, [esi + 0x14]
push eax
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push ecx
push edx
push 0
push str.Driver
push eax
mov dword [ebp - 4], 4
call edi
lea ecx, [ebp - 4]
lea edx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push edx
push eax
push 0
push str.DriverPath
push ecx
mov dword [ebp - 4], 0x104
call edi
test eax, eax
jne 0x402971
lea edx, [ebp - 0x114]
lea eax, [esi + 0x18]
push edx
push eax
call fcn.00408950
add esp, 8
jmp 0x402975
mov byte [esi + 0x18], 0
lea ecx, [ebp - 4]
lea edx, [esi + 0x11c]
push ecx
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push edx
push eax
push 0
push str.Mode
push ecx
mov dword [ebp - 4], 4
call edi
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
add esi, 0x120
push edx
lea eax, [ebp - 0xc]
push esi
push eax
push 0
push 0x4102c0
push ecx
mov dword [ebp - 4], 4
call edi
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4029e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
push 0xf003f
push 0
push str.SoftwareSquare_Soft__Inc.Final_Fantasy_VII1.00Graphics
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a87
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov esi, dword [ebp + 8]
push 0x10
push esi
push 3
push eax
push 0x410298
push ecx
call edi
mov eax, dword [ebp - 4]
lea edx, [esi + 0x14]
push 4
push edx
push 4
push 0
push str.Driver
push eax
call edi
mov edx, dword [ebp - 4]
lea ecx, [esi + 0x11c]
push 4
push ecx
push 4
push 0
push str.Mode
push edx
call edi
mov eax, dword [ebp - 4]
add esi, 0x120
push 4
push esi
push 4
push 0
push 0x4102c0
push eax
call edi
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0xf003f
push 0
push 0x410228
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402b0b
mov edx, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x130]
push ecx
push edx
call fcn.00406e00
mov edx, dword [ebp - 4]
add esp, 8
lea eax, [ebp - 8]
add edi, 0x140
push eax
lea ecx, [ebp - 0xc]
push edi
push ecx
push 0
push 0x4102f8
push edx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402b20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
push 0xf003f
push 0
push 0x410228
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ba7
push edi
mov edi, dword [ebp + 8]
push esi
lea esi, [edi + 0x130]
push esi
call fcn.004011a0
add esp, 4
test eax, eax
jne 0x402b6e
mov ecx, dword [ebp - 4]
push esi
push ecx
call fcn.00406e60
add esp, 8
mov edx, dword [ebp - 4]
add edi, 0x140
push 4
push edi
push 4
push 0
push 0x4102f8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4033a0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push esi
push eax
mov dword [ebp - 0x28], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 0
mov dword [ebp - 8], ecx
fild qword [ebp - 8]
fmul qword [0x410348]
fsub qword [0x410350]
call fcn.00408d70
mov ecx, dword [ebp + 8]
push eax
push 0x413278
lea esi, [ecx + 0x10c]
mov dword [ecx + 0x108], eax
push esi
call fcn.00408b20
add esp, 0xc
push 0x452b78
push esi
call fcn.00408960
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403750
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov eax, 1
je 0x4037a6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.DIRECT_SOUND_ERROR_n
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push edi
call fcn.004035b0
add esp, 4
lea edx, [ebp - 0x200]
push eax
push str.___ERROR:__s_in_FILE__s_LINE__d__n
push edx
call fcn.00408b20
add esp, 0x14
lea eax, [ebp - 0x200]
push eax
call esi
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x405680
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x2001f
push 0
push str.SoftwareNVIDIA_CorporationRIVA_128DIRECT3D
push reloc.DSOUND.dll_DirectSoundEnumerateA
call esi
test eax, eax
je 0x4056f3
lea ecx, [ebp - 4]
push ecx
push 0x2001f
push 0
push str.SoftwareNVIDIA_CorporationRIVA_TNTDIRECT3D
push reloc.DSOUND.dll_DirectSoundEnumerateA
call esi
test eax, eax
je 0x4056f3
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x4710f8
push 0
push 0x410360
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405799
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 8]
push 4
push ecx
push 4
push 0
push str.SQUAREONLYENABLE
push edx
mov dword [ebp - 8], 0
call esi
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push ecx
push edx
push 0
push 0x4141cc
push eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 8]
mov eax, 0x800000
cmp ecx, eax
jae 0x405764
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push 4
push ecx
push 4
push 0
push str.TEXHEAP
push edx
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push str.TEXELALIGNMENT
push ecx
mov dword [ebp - 8], 0
call esi
mov edx, dword [ebp - 4]
push str.ZOHMODE
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push edi
push eax
lea ecx, [ebp + 0xc]
push esi
push ecx
push 0
push str.Sound_GUID
push edx
mov edi, 1
mov dword [ebp - 4], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406e4c
test esi, esi
je 0x406e4e
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406e4e
or eax, 0xffffffff
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
xor edi, edi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 4]
lea ecx, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp + 8]
push ecx
push edx
push 0
push str.MIDI_data
push eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407040
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x104]
push ecx
push edx
call fcn.00408950
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x407050
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x407082
push esi
call fcn.00408b90
add esp, 4
inc eax
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push str.MIDI_data
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.MIDI_data
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ebp
ret

Function at 0x4071c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push str.SSI_Application_Setup
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4711bc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
je 0x407229
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 8]
push eax
call fcn.00407240
add esp, 4
or esi, eax
jne 0x407229
push 0x4711d0
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
test eax, eax
je 0x407216
call fcn.00401b70
mov esi, eax
jmp 0x407224
mov eax, dword [0x4562f0]
test eax, eax
je 0x407224
mov esi, 0x200
call fcn.004010c0
mov ecx, dword [0x4711bc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x407a40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov si, word [ebp + 0xc]
test si, si
jne 0x407a57
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00408500
add esp, 0xc
lea ecx, [ebp + 0xc]
push 4
push 0
push ecx
call fcn.00408500
mov edx, dword [ebp + 0x10]
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push eax
mov eax, dword [0x471310]
push ecx
push edx
mov dword [ebp - 0x10], 0x80
mov word [ebp + 0xc], si
call dword [eax + 0x34]
add esp, 0xc
mov esi, eax
push esi
call fcn.00404470
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4091b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411c80
push 0x40c718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4713c4], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4713c0], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4713bc], ecx
shr eax, 0x10
mov dword [0x4713b8], eax
call fcn.0040a0a0
test eax, eax
jne 0x40921a
push 0x1c
call fcn.00409380
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040c420
call fcn.0040c410
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4728d4], eax
call fcn.0040bdd0
mov dword [0x471364], eax
test eax, eax
je 0x40924d
mov eax, dword [0x4728d4]
test eax, eax
jne 0x409257
push 0xffffffffffffffff
call fcn.0040b730
add esp, 4
call fcn.0040bb20
call fcn.0040ba30
call fcn.0040b700
mov esi, dword [0x4728d4]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x409336
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x40929e
test al, al
je 0x40929e
and eax, 0xff
push eax
call fcn.0040b9d0
add esp, 4
test eax, eax
je 0x409278
inc esi
mov dword [ebp - 0x64], esi
jmp 0x409278
cmp byte [esi], 0x22
jne 0x4092a7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x4092b7
cmp al, 0x20
ja 0x4092b7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4092a7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4092d8
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4092dd
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0040b730
jmp 0x40931b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4092a7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x409336

Function at 0x409380
Capabilities:
Terminate process

Disassembly:
cmp dword [0x47136c], 1
jne 0x40938e
call fcn.0040c7f0
mov eax, dword [esp + 4]
push eax
call fcn.0040c830
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]