joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426150
Capabilities:
Get file attributes

Disassembly:
lea eax, [esp + 4]
push 0x564f30
push eax
call fcn.00410940
add esp, 8
test al, al
jne 0x426189
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edx, 0xffffffff
cmp eax, edx
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
jne 0x4261b9
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4261b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
ret
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4261cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
ret

Function at 0x4262a0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esi + 0x1a04]
test eax, eax
je 0x4262bf
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x4262bf
mov dword [esi + 0x1a04], 0
push 0
push 0
push 0x426220
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x1a04], eax
mov eax, ecx
ret

Function at 0x4265c0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, eax
test ebx, ebx
jne 0x4265f1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4265ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop ebx
add esp, 8
ret
lea ecx, [esp + 0x10]
push 0x564f30
push ecx
call fcn.00410940
add esp, 8
test al, al
jne 0x42661d
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4265de
mov ecx, ebx
call fcn.004280b0
test eax, eax
jne 0x426641
call fcn.00428010
test eax, eax
jne 0x426641
lea ecx, [esp + 0x10]
call fcn.00401640
xor eax, eax
pop ebx
add esp, 8
ret
lea ecx, [esp + 4]
push ecx
push 2
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426607
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
push esi
push 4
lea edx, [esp + 0x10]
push edx
push 4
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
push 0
push ecx
push eax
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4266a8
test esi, esi
je 0x426697
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
call fcn.00401640
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
test esi, esi
je 0x4266b3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
call fcn.00401640
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4266d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x547188
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
test edi, edi
je 0x4267c2
mov dword [esp + 0x14], 0
mov esi, ecx
lea ebx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.00422d00
lea eax, [esp + 0x10]
push eax
push 2
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4267a2
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 0xc]
je 0x4267d6
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426783
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x42678e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4267c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4267ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4267fa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x426820
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x547158
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
cmp edi, ebp
je 0x426950
mov dword [esp + 0x20], ebp
mov esi, edx
lea ebx, [esp + 0x14]
mov dword [esp + 0x30], ebp
call fcn.00422d00
lea eax, [esp + 0x18]
push eax
push 3
push ebp
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x426930
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
push ebp
push ecx
mov edi, 4
push esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x4268cf
cmp dword [esp + 0x24], edi
jne 0x4268cf
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x38]
je 0x426966
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
push edi
lea ecx, [esp + 0x28]
push ecx
push edi
push ebp
push edx
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x426966
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42690f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebp
je 0x42691a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426950
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426986
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebp
je 0x426991
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4269b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x547128
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
test edi, edi
je 0x426a6a
mov dword [esp + 0xc], 0
mov esi, ecx
lea ebx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00422d00
lea eax, [esp + 0x14]
push eax
push 2
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426a23
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], esi
jmp 0x426a82
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0x14]
call fcn.00416a60
test eax, eax
je 0x426a7e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426a5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x426a6a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push eax
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x10]
je 0x426ae4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426ac5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x426ad0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426afd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x426b08
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x427340
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x544262
mov eax, dword fs:[0]
push eax
mov eax, 0x1000c
call fcn.005259e0
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x10008], eax
push esi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x10014]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x1001c], esi
push 0x564f30
mov ecx, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
call fcn.00404670
push 0xfffe
lea eax, [esp + 0x14]
push esi
mov dword [esp + 0x10024], esi
push eax
mov dword [esp + 0x14], 1
call fcn.00523750
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42742c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4273d6
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xe], 0x5c
jne 0x427408
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4273f4
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0xe], si
lea eax, [esp + 0x10]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x427410
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00404a30
mov eax, edi
mov ecx, dword [esp + 0x10014]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x10008]
xor ecx, esp
call fcn.0052151a
add esp, 0x10018
ret

Function at 0x427460
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x544219
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
xor esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
push 0x564f30
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.00404670
lea eax, [esp + 0x10]
push eax
push esi
push esi
mov dword [esp + 0x2c], esi
push 0x55f930
mov dword [esp + 0x24], 1
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edx, dword [esp + 0x10]
cmp edx, esi
jne 0x4274cd
xor eax, eax
jmp 0x4274e1
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4274d2
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, ebx
call fcn.00404a30
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x427ae0
Capabilities:
Check os version

Disassembly:
cmp dword [0x5b6edc], 0
jne 0x427afe
push 0x5b6ed8
mov dword [0x5b6ed8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x5b6edc], 6
jne 0x427b16
cmp dword [0x5b6ee0], 2
jne 0x427b16
mov eax, 1
ret
xor eax, eax
ret
Function at 0x428990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [edi], ebx
push esi
mov esi, eax
mov dword [esp + 8], ebx
jne 0x4289a9
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
lea eax, [esp + 8]
push eax
call fcn.00428620
add esp, 4
test eax, eax
jl 0x428a00
xor eax, eax
mov dword [esi], eax
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea edx, [esp + 0x10]
push edx
mov dword [esi + 0xc], eax
mov esi, dword [esp + 0x14]
mov eax, dword [edi]
push ebx
push esi
push eax
mov dword [esp + 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4289f9
cmp dword [esp + 8], 3
jne 0x4289f9
mov ebx, 1
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x429780
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4297ad
mov eax, dword [esp + 8]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xd
ret 8

Function at 0x4297b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4297e9
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8

Function at 0x429840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREReal_Sound_LabCONEQAPOSettings
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4298e0
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.DisableSpeakerModeMonitoring
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4298a4
mov edi, eax
jmp 0x4298b2
mov edi, dword [esp + 0x18]
sub edi, 4
neg edi
sbb edi, edi
and edi, 0xd
test esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4298c1
push esi
call ebx
xor esi, esi
test edi, edi
jne 0x4298d9
test esi, esi
mov edi, dword [esp + 0x10]
je 0x4298d0
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
test esi, esi
je 0x4298e0
push esi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x42d426
Capabilities:
Get common file path
Get system information on windows

Disassembly:
sub esp, 0x230
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x22c], eax
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00430dc0
mov eax, dword [esi + 8]
test eax, eax
je 0x42d4cb
test byte [esi + 0x50], 8
je 0x42d47d
cmp dword [eax + 0x4d8], 0
jle 0x42d47d
or dword [eax + 4], 0x2000000
mov eax, dword [esi + 8]
or dword [eax + 4], 0x4000000
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp word [esp + 4], 9
lea ecx, [esp + 0x28]
sete al
push ecx
push 0
push 0
lea eax, [eax*4 + 0x26]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42d4cb
lea edx, [esp + 0x28]
add esi, 0x54
push edx
mov ecx, esi
call fcn.004049b0
push str.RealtekAudioHelp_
mov ecx, esi
call fcn.00410cd0
mov ecx, dword [esp + 0x230]
pop esi
xor ecx, esp
call fcn.0052151a
add esp, 0x230
ret
Function at 0x43a4a0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x53edd3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
push edi
call fcn.0047c9f0
xor ebp, ebp
mov dword [esp + 0x1c], ebp
lea esi, [edi + 0xfc]
push 0xa
mov ecx, esi
mov dword [edi], vtable.CDeviceSettingDlg.0
mov dword [edi + 0x78], vtable.CDeviceSettingDlg.1.0
call fcn.005032d0
mov dword [esi], vtable.CTypedPtrList_class_CPtrList__class_CMMLineControl__.0
lea esi, [edi + 0x120]
mov ebx, 1
mov ecx, esi
mov byte [esp + 0x1c], bl
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea eax, [edi + 0x174]
push eax
mov byte [esp + 0x20], 2
call fcn.0048a310
lea ecx, [edi + 0x248]
push ecx
mov byte [esp + 0x20], 3
call fcn.004c0bf0
lea esi, [edi + 0x2d8]
call fcn.0046ce10
mov dword [esi], vtable.CImageEx.0
mov dword [esi + 0x30], ebp
lea esi, [edi + 0x30c]
call fcn.0046ce10
mov dword [esi], vtable.CImageEx.0
mov dword [esi + 0x30], ebp
mov byte [edi + 0x24], bl
mov dword [edi + 0xf4], ebp
mov dword [edi + 0xf8], ebp
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x2cc], ebp
cmp dword [0x5b6edc], ebp
jne 0x43a59a
push 0x5b6ed8
mov dword [0x5b6ed8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x5b6edc], 6
jne 0x43a5ab
cmp dword [0x5b6ee0], ebp
je 0x43a5ad
xor ebx, ebx
mov dword [edi + 0x2d4], ebx
mov dword [edi + 0x2d0], ebp
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4454a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54a68f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
push edi
call fcn.0047c1a0
mov dword [esp + 0x14], 0
lea esi, [edi + 0x22c]
mov ecx, esi
mov dword [edi], vtable.CDolbyHpOnlySettingDlg.0
mov dword [edi + 0x78], vtable.CDolbyHpOnlySettingDlg.1.0
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea esi, [edi + 0x280]
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea esi, [edi + 0x2d4]
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea esi, [edi + 0x328]
call fcn.0046ce10
mov dword [esi], vtable.CImageEx.0
mov dword [esi + 0x30], 0
lea esi, [edi + 0x35c]
mov ecx, esi
mov byte [esp + 0x14], 4
call fcn.004fc3ae
mov dword [esi], vtable.CStatic.0
mov dword [edi + 0x228], 0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x44dfe0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x546cce
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0x34]
lea ebp, [ebx + 0x3ac]
call fcn.00505193
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x44e02f
push 0x80004005
call fcn.00402900
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
cmp edi, esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], esi
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x3a4], ecx
mov dword [ebx + 0x3a0], edx
mov dword [ebx + 0x3a8], esi
je 0x44e109
push esi
push 0x564f30
mov ecx, ebp
call fcn.00404a30
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x44e076
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebx + 0x3ac]
call fcn.00404550
xor ebp, ebp
mov edi, ebx
push esi
push esi
push esi
push esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [edi], eax
je 0x44e0ca
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
mov ecx, ebp
lea esi, [esp + 0x20]
mov eax, ebx
call fcn.0044e260
mov edx, dword [eax]
mov dword [edi + 8], edx
mov eax, dword [eax + 4]
mov dword [edi + 0xc], eax
xor esi, esi
add ebp, 1
add edi, 0x10
cmp ebp, 0x39
jl 0x44e096
push esi
push esi
push esi
push esi
mov dword [ebx + 0x394], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [ebx + 0x390], eax
je 0x44e109
lea ecx, [esp + 0x38]
push ecx
push esi
push ebx
push 0x44e350
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x3a8], eax
mov eax, dword [ebx + 0x3ac]
push 1
push ecx
sub eax, 0x10
mov dword [esp + 0x40], esp
mov esi, esp
push eax
call fcn.00404600
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0044e3f0
add esp, 8
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x459ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54a1f4
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
push edi
call fcn.0047c1a0
mov dword [esp + 0x14], 0
lea esi, [edi + 0x22c]
mov ecx, esi
mov dword [edi], vtable.CDtsS2MainSettingDlg.0
mov dword [edi + 0x78], vtable.CDtsS2MainSettingDlg.1.0
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea esi, [edi + 0x280]
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.004fc3ae
mov dword [esi], vtable.CButton.0
lea esi, [edi + 0x2d4]
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.004fc3ae
mov dword [esi], vtable.CStatic.0
lea esi, [edi + 0x328]
call fcn.0046ce10
mov dword [esi], vtable.CImageEx.0
mov dword [esi + 0x30], 0
mov dword [edi + 0x228], 0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4