joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ae0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46df18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00443720
lea ecx, [ebp + 8]
call fcn.00419920
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0x47c838
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404b59
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x1c]
jmp 0x404d17
push 0
push str.mfcaptureengine.dll
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404b8c
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x20]
jmp 0x404d17
push 0
push str.gamebar.exe
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404bcf
cmp dword [ebp + 0xc], 0
je 0x404bb1
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x24]
jmp 0x404d17
mov dword [ebp - 0x10], 0
jmp 0x404be1
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0x14
call fcn.0042bc00
cmp dword [ebp - 0x10], eax
jae 0x404c36
push 0
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, 0x14
call fcn.00405720
mov ecx, eax
call fcn.00419920
push eax
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404c34
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x28]
jmp 0x404d17
jmp 0x404bd8
mov dword [ebp - 0x14], 0
jmp 0x404c48
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x2c
call fcn.0042bc00
cmp dword [ebp - 0x14], eax
jae 0x404c9a
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0x2c
call fcn.00405720
mov ecx, eax
call fcn.00419920
push eax
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404c98
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x2c]
jmp 0x404d17
jmp 0x404c3f
mov dword [ebp - 0x18], 0
jmp 0x404cac
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.0042bc00
cmp dword [ebp - 0x18], eax
jae 0x404cfe
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.00405720
mov ecx, eax
call fcn.00419920
push eax
lea ecx, [ebp + 8]
call fcn.004054e0
test eax, eax
jl 0x404cfc
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x30]
jmp 0x404d17
jmp 0x404ca3
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443990
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x404df0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa028
call fcn.0045a240
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa018], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa014], eax
mov dword [ebp - 8], 0xc8
mov dword [ebp - 4], 0
mov ecx, dword [0x47c898]
mov dword [ebp - 0xa010], ecx
push 0x9ffc
push 0
lea edx, [ebp - 0xa00c]
push edx
call fcn.00459470
add esp, 0xc
mov eax, 1
test eax, eax
je 0x404eec
lea ecx, [ebp - 0xa010]
push ecx
push 0x5000
push 0xd
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0xa010]
mov dword [ebp - 0xa01c], eax
mov ecx, dword [ebp - 0xa01c]
add ecx, 2
mov dword [ebp - 0xa020], ecx
mov edx, dword [ebp - 0xa01c]
mov ax, word [edx]
mov word [ebp - 0xa022], ax
add dword [ebp - 0xa01c], 2
cmp word [ebp - 0xa022], 0
jne 0x404e8a
mov ecx, dword [ebp - 0xa01c]
sub ecx, dword [ebp - 0xa020]
sar ecx, 1
mov dword [ebp - 0xa028], ecx
je 0x404ec3
jmp 0x404eec
mov edx, dword [ebp - 4]
add edx, 0xc8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xa014]
jbe 0x404edc
jmp 0x404eec
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404e4a
lea ecx, [ebp - 0xa010]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004053d0
mov edx, dword [ebp - 0xa018]
or edx, 1
mov dword [ebp - 0xa018], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret
Function at 0x40caf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push 0x47ac48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40cb2c
lea ecx, [ebp - 4]
push ecx
push str.SoftwarePassword_Protect_Video_MasterDT_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 8
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x40cbc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x3a0], ecx
push 0
push 0
push 0xf0
push 0x3ec
lea eax, [ebp - 0x39c]
push eax
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040fad0
mov ecx, eax
call fcn.0040fa80
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 0x2001f
push 0
push 0x47acf8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40cc60
lea edx, [ebp - 0x214]
push edx
push 0x47ad48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40cc60
jmp 0x40cdd9
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov cx, word [0x47ad98]
mov word [ebp - 0x398], cx
push 0x17e
push 0
lea edx, [ebp - 0x396]
push edx
call fcn.00459470
add esp, 0xc
cmp dword [ebp - 0x218], 0
je 0x40ccf0
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + 0xf8], 0
je 0x40ccd1
push 0xc0
lea ecx, [ebp - 0x398]
push ecx
push 0x3eb
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040f9d0
jmp 0x40ccf0
push 0xc0
lea edx, [ebp - 0x398]
push edx
push 0x3f0
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040f9d0
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + 0xf8], 0
je 0x40cd49
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x3a4], ecx
mov edx, dword [ebp - 0x3a4]
mov ax, word [edx + 2]
mov word [ebp - 0x3a6], ax
add dword [ebp - 0x3a4], 2
cmp word [ebp - 0x3a6], 0
jne 0x40cd0e
mov edi, dword [ebp - 0x3a4]
mov ecx, dword [0x47ad9c]
mov dword [edi], ecx
mov dx, word [0x47ada0]
mov word [edi + 4], dx
lea eax, [ebp - 0x398]
mov dword [ebp - 0x3ac], eax
mov ecx, dword [ebp - 0x3ac]
add ecx, 2
mov dword [ebp - 0x3b0], ecx
mov edx, dword [ebp - 0x3ac]
mov ax, word [edx]
mov word [ebp - 0x3b2], ax
add dword [ebp - 0x3ac], 2
cmp word [ebp - 0x3b2], 0
jne 0x40cd64
mov ecx, dword [ebp - 0x3ac]
sub ecx, dword [ebp - 0x3b0]
sar ecx, 1
mov dword [ebp - 0x3b8], ecx
mov edx, dword [ebp - 0x3b8]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x398]
push ecx
push 1
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x214], 0
je 0x40cdd9
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret
Function at 0x40e2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0xc], 1
mov ecx, 0x48dbf0
call fcn.00408a00
mov dword [ebp - 8], eax
push 0xf0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e4a5
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40e4a5
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40e4a5
cmp dword [ebp - 0xc], 0
je 0x40e4a5
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x40e4a5
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x403
jne 0x40e419
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x130]
call fcn.0040e9c0
lea ecx, [ebp - 0x130]
call fcn.00419920
push eax
push 0
push 0x143
movzx eax, word [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0040f1e0
cmp eax, 0xffffffff
jne 0x40e40c
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x130]
call fcn.0040e9f0
jmp 0x40e497
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x1234
jne 0x40e497
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x150], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x258]
call fcn.0040e9c0
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
call fcn.00419920
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x258]
call fcn.0040e9f0
lea eax, [ebp - 0x154]
push eax
push 0
push 0x40b
movzx ecx, word [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0040f1e0
cmp eax, 0xffffffff
jne 0x40e497
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
jmp 0x40e370
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret 4
Function at 0x40f940
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040fad0
mov ecx, eax
call fcn.00419920
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f9b3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407b80
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040fff0
mov eax, dword [ebp - 0xc]
jmp 0x40f9bd
mov ecx, dword [ebp + 0xc]
call fcn.004077c0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41ab00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.0041a660
call fcn.004148e0
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a880
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41ac44
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a880
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x41ab84
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
xor eax, eax
jne 0x41ab6f
xor ecx, ecx
jne 0x41ab6f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41ac2b
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41ac20
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041a8a0
add esp, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041aaf0
add esp, 4
movzx edx, al
test edx, edx
jne 0x41ac05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x41ac1e
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x41ac29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x41ac34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41ac44
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42b130
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42b157
xor eax, eax
jmp 0x42b1be
lea edx, [ebp - 0x10]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x42b170
xor eax, eax
jmp 0x42b1be
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x42b1a8
xor eax, eax
jmp 0x42b1be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x42b1b9
xor eax, eax
jmp 0x42b1be
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42b560
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x14]
push eax
push 0x474ae8
push 1
push 0
push 0x474b08
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x42b5ec
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x42b5fa
mov eax, dword [ebp - 0x20]
jmp 0x42b70c
cmp dword [ebp - 0x24], 0
je 0x42b709
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [edx + 0x14]
call ecx
xor edx, edx
mov word [ebp - 0x34], dx
xor eax, eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jne 0x42b709
cmp dword [ebp - 0x1c], 0
je 0x42b704
lea eax, [ebp - 0x38]
push eax
push 0x474b48
push 0
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 0x24]
call ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x42b683
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [eax + 8]
call edx
jmp 0x42b627
cmp dword [ebp - 0x38], 0
je 0x42b704
mov eax, 8
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
lea edx, [ebp - 0x34]
push edx
push 0x47a4c4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004053d0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
jl 0x42b6eb
lea ecx, [ebp - 0x3c]
call fcn.00419920
push eax
call fcn.0042b1d0
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00443990
jmp 0x42b627
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42db30
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e07b
mov eax, dword fs:[0]
push eax
mov eax, 0x2224
call fcn.0045a240
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x2020], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2010], eax
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea ecx, [ebp - 0x200c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov dword [ebp - 0x2018], 0
jmp 0x42dba1
mov edx, dword [ebp - 0x2018]
add edx, 1
mov dword [ebp - 0x2018], edx
mov eax, dword [ebp - 0x2014]
shr eax, 2
cmp dword [ebp - 0x2018], eax
jae 0x42dc8d
mov ecx, dword [ebp - 0x2018]
mov edx, dword [ebp - 0x2010]
cmp edx, dword [ebp + ecx*4 - 0x200c]
jne 0x42dbcd
jmp 0x42db92
mov eax, dword [ebp - 0x2018]
mov ecx, dword [ebp + eax*4 - 0x200c]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x201c], eax
cmp dword [ebp - 0x201c], 0
je 0x42dc88
push 0x104
lea edx, [ebp - 0x222c]
push edx
mov eax, dword [ebp - 0x201c]
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x42dc7b
lea ecx, [ebp - 0x222c]
push ecx
lea ecx, [ebp - 0x2230]
call fcn.004053d0
mov dword [ebp - 4], 0
push 0
push str.getkey.exe
lea ecx, [ebp - 0x2230]
call fcn.00443720
mov ecx, eax
call fcn.004054e0
test eax, eax
jl 0x42dc69
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2230]
call fcn.00443990
mov edx, dword [ebp - 0x201c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42db92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2020]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret
Function at 0x430d50
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
add ecx, 2
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x130]
mov ax, word [edx]
mov word [ebp - 0x136], ax
add dword [ebp - 0x130], 2
cmp word [ebp - 0x136], 0
jne 0x430d81
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp - 0x134]
sar ecx, 1
mov dword [ebp - 0x13c], ecx
jne 0x430dbd
jmp 0x430f61
push 0x114
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00459470
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x430dfc
cmp dword [ebp - 0x118], 2
jae 0x430e05
cmp dword [ebp - 0x11c], 6
jbe 0x430e0a
jmp 0x430f4c
mov ecx, dword [ebp - 0x12c]
cmp dword [ecx + 0x2fc], 0
jne 0x430f4c
push 0x4776d8
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x300], eax
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x300], 0
je 0x430f4c
push 0x400
push 0
push 0
push 6
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 0x300]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + 0x304], eax
mov edx, dword [ebp - 0x12c]
cmp dword [edx + 0x304], 0
je 0x430f28
push 0x400
push 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x304]
push ecx
call fcn.00459470
add esp, 0xc
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 0x304]
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x140]
mov dx, word [ecx]
mov word [ebp - 0x14a], dx
mov eax, dword [ebp - 0x144]
mov cx, word [ebp - 0x14a]
mov word [eax], cx
mov edx, dword [ebp - 0x140]
add edx, 2
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x144]
add eax, 2
mov dword [ebp - 0x144], eax
cmp word [ebp - 0x14a], 0
jne 0x430ee0
push 1
mov ecx, dword [ebp - 0x12c]
call fcn.00430f80
push 0x477760
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x37c
call fcn.00443af0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret 4
Function at 0x430f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e048
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftMediaPlayerMediaPluginsDSPConfig8EAABC66_3F85_4b85_84A1_424AB8DDA041_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x430fd0
jmp 0x431049
lea ecx, [ebp - 0x14]
call fcn.004053b0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x430ff4
push str.true
lea ecx, [ebp - 0x14]
call fcn.00443af0
jmp 0x431001
push str.false
lea ecx, [ebp - 0x14]
call fcn.00443af0
lea ecx, [ebp - 0x14]
call fcn.00405880
lea ecx, [eax + eax + 2]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00431370
push eax
push 1
push 0
push str.Enabled
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x10], 0
je 0x43103a
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00443990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x431290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0x477910
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4312e7
lea ecx, [ebp - 0xc]
push ecx
push str.SoftwareMicrosoftMediaPlayerPreferencesVideoSettings_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x4312e7
jmp 0x431329
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.IgnoreAVSync
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.DontUseFrameInterpolation
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0xc], 0
je 0x431329
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret