joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e80
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x419b84]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
test eax, eax
jne 0x410ec8
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x410ea8
mov eax, 1
jmp 0x410ec3
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x410f99
mov eax, 2
mov dword [0x419b84], eax
cmp eax, 1
jne 0x410ee8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x410fab
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x410f03
mov ecx, dword [0x419920]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test esi, esi
jne 0x410f22
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00409890
mov edi, eax
add esp, 4
test edi, edi
jne 0x410f36
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x410f90
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x410f74
mov edx, dword [esp + 0x24]
push eax
push eax
push 0xffffffffffffffff
push edi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x410f90
push edi
call fcn.00409ae0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push edi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x410fa0
push edi
call fcn.00409ae0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00409ae0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410fb0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x419b88]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x410ff8
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x410fd8
mov eax, 2
jmp 0x410ff3
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4110d8
mov eax, 1
mov dword [0x419b88], eax
cmp eax, 2
jne 0x411018
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x4110ea
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x411033
mov ecx, dword [0x419920]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x411052
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.00409890
mov esi, eax
add esp, 4
test esi, esi
jne 0x411069
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4110cf
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x4110b0
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4110cf
push esi
call fcn.00409ae0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x4110df
push esi
call fcn.00409ae0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00409ae0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4010b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0041ebe0
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2008], eax
cmp ebx, dword [0x449360]
jg 0x401191
push esi
push 0x5c
push edi
call fcn.00411eac
mov esi, eax
add esp, 8
test esi, esi
je 0x4010f3
add esi, 2
jmp 0x4010f5
mov esi, edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
push ecx
push edx
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00411e8f
mov ecx, dword [ebp - 0x2008]
mov eax, dword [0x449368]
add esp, 0x10
test ecx, ecx
je 0x401153
cmp dword [0x44937c], 8
jae 0x40112e
mov eax, 0x449368
lea edx, [ebp - 0x1004]
push edx
push ecx
mov ecx, dword [ebp + 8]
push ebx
push ecx
push esi
push eax
lea edx, [ebp - 0x2004]
push 0x43c618
push edx
call fcn.00411c81
add esp, 0x20
jmp 0x401183
cmp dword [0x44937c], 8
jae 0x401161
mov eax, 0x449368
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1004]
push ecx
push ebx
push edx
push esi
push eax
lea eax, [ebp - 0x2004]
push 0x43c664
push eax
call fcn.00411c81
add esp, 0x1c
lea ecx, [ebp - 0x2004]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret

Function at 0x401b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401b58
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401b8a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401b86
cmp esi, eax
jae 0x401b8a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401b78
cmp esi, eax
jb 0x401b90
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x4028f0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
xor esi, esi
push edx
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], esi
mov word [ebp - 0x20c], cx
call fcn.00416250
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402a74
cmp word [ebp - 0x20c], si
je 0x402a74
push ebx
push 3
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
jne 0x4029c5
push eax
push str.OpenSCManager_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x60c]
call fcn.00402ea0
lea ecx, [ebp - 0x60c]
push ecx
push 0x43c6f0
push esi
push 0x31
lea ebx, [esi + 1]
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov eax, dword [ebp - 0x610]
add esp, 0x1c
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x614]
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
push 1
push 2
push 0x10
push 4
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
call ebx
test edi, edi
jne 0x402a4c
push eax
push str.CreateService_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x60c]
call fcn.00402ea0
lea ecx, [ebp - 0x60c]
push ecx
push 0x43c6f0
push edi
lea ebx, [edi + 1]
push 0x31
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov ebx, dword [ebp - 0x610]
add esp, 0x1c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 4
push edi
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004117c9
mov esp, ebp
pop ebp
ret 4
Function at 0x402a90
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, 1
push ebx
push eax
push eax
mov edi, ecx
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x40c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x402b0a
push eax
push str.OpenSCManager_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea eax, [ebp - 0x404]
push eax
push 0x43c6f0
push esi
push 0x31
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov edi, dword [ebp - 0x40c]
add esp, 0x1c
jmp 0x402b16
push 0x10
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x402b54
push eax
push str.OpenService_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea ecx, [ebp - 0x404]
push ecx
push 0x43c6f0
push edi
push 0x31
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
add esp, 0x1c
jmp 0x402b70
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x402b69
mov dword [ebp - 0x408], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x402b7b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x408]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004117c9
mov esp, ebp
pop ebp
ret
Function at 0x402ba0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x414], eax
xor eax, eax
push 1
push eax
push eax
mov edi, ecx
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x408], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
jne 0x402c24
push eax
push str.OpenSCManager_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea ecx, [ebp - 0x404]
push ecx
push 0x43c6f0
push esi
push 0x31
lea ebx, [esi + 1]
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp 0x402c34
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x408], eax
call ebx
cmp dword [ebp - 0x408], 0
jne 0x402c7d
push eax
push str.OpenService_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea edx, [ebp - 0x404]
push edx
push 0x43c6f0
push 0
push 0x31
mov ebx, 1
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
mov edx, dword [ebp - 0x408]
mov eax, dword [ebp - 0x414]
lea ecx, [ebp - 0x40c]
push ecx
push 1
push edx
mov dword [ebp - 0x40c], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x402cc6
call ebx
push eax
push str.Service_description_has_been_updated.
push 0
push 0x1ac
mov ebx, 2
mov edi, str.C:p4clientConsumerdev_dadiConsumerPlatformVistaSharedGenericService.cpp
call fcn.004010b0
lea edi, [ebx - 1]
jmp 0x402cea
call ebx
push eax
push str.ChangeServiceConfig2_failed.
push 0
push 0x1b1
mov ebx, 2
mov edi, str.C:p4clientConsumerdev_dadiConsumerPlatformVistaSharedGenericService.cpp
call fcn.004010b0
mov edi, dword [ebp - 0x410]
mov eax, dword [ebp - 0x408]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
test eax, eax
je 0x402d00
push eax
call ebx
test esi, esi
je 0x402d07
push esi
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004117c9
mov esp, ebp
pop ebp
ret 4
Function at 0x402d20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
push 1
push eax
push eax
mov edi, ecx
mov dword [ebp - 0x428], eax
xor esi, esi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x424], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x402dc5
push eax
push str.OpenSCManager_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea eax, [ebp - 0x404]
push eax
push 0x43c6f0
push ebx
push 0x31
lea ebx, [esi + 1]
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov ebx, dword [ebp - 0x424]
add esp, 0x1c
jmp 0x402dd4
push 0x10024
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x402e21
push eax
push str.OpenService_failed.
push str._s._Error_Code___d.
lea edx, [ebp - 0x404]
call fcn.00402ea0
lea ecx, [ebp - 0x404]
push ecx
push 0x43c6f0
push esi
push 0x31
lea ebx, [esi + 1]
mov edi, str.c:p4clientconsumerdev_dadiconsumerplatform_vista_sharedGenericService.h
call fcn.004010b0
mov ebx, dword [ebp - 0x424]
mov edi, dword [ebp - 0x428]
add esp, 0x1c
jmp 0x402e74
lea edx, [ebp - 0x420]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402e64
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x402e40
lea eax, [ebp - 0x420]
push eax
push esi
call edi
test eax, eax
je 0x402e64
cmp dword [ebp - 0x41c], 3
jne 0x402e64
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402e40
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x402e7f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004117c9
mov esp, ebp
pop ebp
ret
Function at 0x402ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x423b81
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x448090]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
mov eax, dword [0x448090]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push 0x43d210
xor edi, edi
push 0x80000002
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x402f55
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
push ecx
push edi
push 0x43d204
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x402f62
mov dword [0x449360], eax
lea esi, [esp + 0x1c]
call fcn.00403090
mov ecx, esi
call fcn.00401fc0
mov dword [esp + 0x1c], vtable.CWavesSysSvcService.0
lea ecx, [esp + 0x8c]
mov dword [esp + 0xe0], 2
call fcn.004011d0
mov eax, dword [esp + 0x5c]
cmp eax, edi
je 0x402fa2
push eax
call fcn.00411eda
add esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
cmp eax, edi
je 0x402fbf
push eax
call fcn.00411eda
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.004117c9
mov esp, ebp
pop ebp
ret
Function at 0x403850
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041ebe0
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1008], eax
cmp ebx, dword [0x449360]
jg 0x40392f
push esi
push 0x5c
push edi
call fcn.00412e05
mov esi, eax
add esp, 8
test esi, esi
je 0x403891
inc esi
jmp 0x403893
mov esi, edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
push ecx
push edx
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.004124dc
mov ecx, dword [ebp - 0x1008]
mov eax, dword [0x449384]
add esp, 0x10
test ecx, ecx
je 0x4038f1
cmp dword [0x449398], 0x10
jae 0x4038cc
mov eax, 0x449384
lea edx, [ebp - 0x804]
push edx
push ecx
mov ecx, dword [ebp + 8]
push ebx
push ecx
push esi
push eax
lea edx, [ebp - 0x1004]
push str._s__s__d____d_:_ASSERT___s_____s__n
push edx
call fcn.00412bf2
add esp, 0x20
jmp 0x403921
cmp dword [0x449398], 0x10
jae 0x4038ff
mov eax, 0x449384
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x804]
push ecx
push ebx
push edx
push esi
push eax
lea eax, [ebp - 0x1004]
push str._s__s__d____d_:_trace__s_n
push eax
call fcn.00412bf2
add esp, 0x1c
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret
Function at 0x404b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov esi, eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
cmp edi, ebx
je 0x404b92
cmp byte [edi], bl
je 0x404b92
push 0x43df84
lea eax, [ebp - 8]
push edi
push eax
call fcn.004131bc
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, ebx
je 0x404b92
push 2
push ebx
push eax
call fcn.00413827
mov ecx, dword [ebp - 8]
push ecx
call fcn.004136cb
mov edx, dword [ebp - 8]
push ebx
push ebx
push edx
mov edi, eax
call fcn.00413827
add esp, 0x1c
cmp edi, ebx
jle 0x404b7c
mov eax, edi
call fcn.00409510
mov ecx, dword [ebp - 8]
mov eax, dword [esi]
push ecx
push 1
push edi
push eax
call fcn.004134bb
add esp, 0x10
cmp eax, 1
sete byte [ebp - 1]
mov edx, dword [ebp - 8]
push edx
call fcn.00413988
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Failed_to_open____s___file
push ebx
push 0x3f
mov ebx, 1
mov edi, str.C:p4clientConsumerdev_dadiConsumerPlatformVistaSharedControlMaxxAudioAPO.cpp
call fcn.00403850
mov al, byte [ebp - 1]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x448090]
xor eax, esp
mov dword [esp + 0x4c], eax
cmp dword [esi + 0x4b8], 0
push ebx
push edi
mov ebx, ecx
je 0x405ea4
cmp ebx, 1
jne 0x405ea4
fld qword [ebp + 0xc]
mov al, cl
fstp qword [esi + 0x4b0]
pop edi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x40], 0
jne 0x405eda
lea eax, [esi + 0x14c]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, eax
test edi, edi
je 0x405ecb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
setne al
test eax, eax
jne 0x405f9a
fld qword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
fstp qword [esp + 0x18]
mov dword [esp + 8], 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebx
cmp dword [ebp + 8], eax
je 0x405f42
push ebx
push str.Param_u
lea edx, [esp + 0x3c]
call fcn.0040d760
fld qword [ebp + 0xc]
mov eax, dword [esi + 0x460]
fstp qword [esp + 0x34]
add esp, 8
push 8
lea ecx, [esp + 0x30]
push ecx
push 3
push 0
lea edx, [esp + 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esi]
mov eax, dword [edx + 0x9c]
mov ecx, esi
xor bl, bl
call eax
test eax, eax
je 0x405f78
cmp byte [esi + 0x61c], bl
je 0x405f78
mov edx, dword [esi + 0x20]
mov edx, dword [edx + 4]
push 0x20
lea ecx, [esi + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x12c
call edx
test eax, eax
setne bl
mov eax, dword [esi + 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, bl
pop edi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x54]
pop edi
pop ebx
xor ecx, esp
xor al, al
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
push edi
lea edi, [esi + 0x20]
mov dword [ebp - 0x28], eax
jne 0x40636d
lea ecx, [edi + 0x12c]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40635c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
xor edx, edx
test eax, eax
setne dl
mov eax, edx
test eax, eax
jne 0x406424
mov eax, dword [ebp + 8]
push eax
push str.Chunk_u
lea edx, [ebp - 0x24]
call fcn.0040d760
mov ecx, dword [ebp - 0x28]
mov eax, dword [esi + 0x460]
add esp, 8
push ebx
push ecx
push 3
push 0
lea edx, [ebp - 0x24]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esi]
mov eax, dword [edx + 0x9c]
mov ecx, esi
call eax
test eax, eax
je 0x406424
cmp byte [esi + 0x61c], 0
je 0x40640f
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
mov esi, eax
test esi, esi
je 0x4063e3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
push ebx
push edx
lea eax, [esi + 0x10]
push eax
mov dword [esi], 5
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
call fcn.00415e40
add esp, 0xc
mov edx, dword [edi]
mov eax, dword [edx + 4]
add ebx, 0x10
push ebx
push esi
push 0x12c
mov ecx, edi
call eax
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
jne 0x4064b9
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push edi
push edi
push edi
push 0x84000000
lea edx, [ebp - 0x14]
push edx
push str.ChangeNotify
lea ecx, [esi + 4]
push edi
push str.WavesNotifications
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x570], ecx
mov dword [esi + 0x574], edx
cmp dword [esi + 0x56c], edi
jne 0x4064ef
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0x404be0
push edi
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x56c], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 0x56c], edi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.004117c9
mov esp, ebp
pop ebp
ret 0xc