joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
push str.IsWow64Process
push str.kernel32
mov edi, 0x20019
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401231
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40123d
cmp dword [esp + 8], 0
je 0x40123d
mov edi, 0x20219
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401291
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4012a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401309
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.AutoSendDate
push eax
mov dword [esp + 0x24], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401312
xor eax, eax
xor edx, edx
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop esi
add esp, 0x18
ret

Function at 0x401320
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40136b
mov edx, dword [esp + 4]
push 8
lea ecx, [esp + 0x10]
push ecx
push 0xb
push eax
push str.AutoSendDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret

Function at 0x401380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013e1
push esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.AutoSend
push eax
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
je 0x4013e7
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 4]
add esp, 0xc
ret
Function at 0x4013f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40143b
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push eax
push str.AutoSend
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret

Function at 0x401450
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x24]
push edx
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x24], ecx
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4014b5
mov ecx, dword [esp + 0x24]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.AutoSend
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call esi
test eax, eax
jne 0x4014ff
mov ecx, dword [esp + 0x24]
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.AutoSendDate
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x401510
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x804
mov eax, dword [0x40d798]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
push 0x40eb38
push 0x400
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push 0x40b588
push eax
push str.STRING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dx, word [esp + 4]
test dx, dx
lea ecx, [esp + 4]
movzx eax, dx
je 0x4015a9
nop
add ecx, 2
cmp ax, 0x5c
jne 0x40159b
movzx eax, word [ecx]
movzx edx, ax
add edx, 0xffffffb2
add ecx, 2
cmp edx, 0x24
ja case.0x401581.79
movzx edx, byte [edx + 0x4015d0]
jmp dword [edx*4 + 0x4015c4]
mov eax, 0xa
jmp 0x40159b
mov eax, 0xd
jmp 0x40159b
test ax, ax
je 0x4015a9
mov word [esi], ax
movzx eax, word [ecx]
add esi, 2
test ax, ax
jne 0x401560
mov ecx, dword [esp + 0x804]
mov word [esi], 0
pop esi
xor ecx, esp
call fcn.0040373d
add esp, 0x804
ret
Function at 0x401600
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20c4
call fcn.00409910
mov eax, dword [0x40d798]
xor eax, esp
mov dword [esp + 0x20c0], eax
test ebx, ebx
mov eax, dword [esp + 0x20c8]
push esi
mov esi, 0x800
je 0x4016bb
push edi
push 0x40eb38
push 0x1060
lea ecx, [esp + 0x10]
push ecx
push 0x40b588
push eax
push str.STRING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edi, [esp + 8]
mov edx, ebx
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x4016b5
cmp ax, 0x5c
jne 0x4016a7
movzx eax, word [edi]
movzx ecx, ax
add ecx, 0xffffffb2
add edi, 2
cmp ecx, 0x24
ja case.0x40167d.79
movzx ecx, byte [ecx + 0x4016e0]
jmp dword [ecx*4 + 0x4016d4]
mov word [edx], 0xd
sub esi, 1
add edx, 2
cmp esi, 1
jle 0x4016b5
mov eax, 0xa
jmp 0x4016a7
mov eax, 0xd
jmp 0x4016a7
test ax, ax
je 0x4016b5
mov word [edx], ax
sub esi, 1
add edx, 2
cmp esi, 1
jg 0x401654
mov word [edx], 0
pop edi
mov ecx, dword [esp + 0x20c4]
pop esi
xor ecx, esp
call fcn.0040373d
add esp, 0x20c4
ret

Function at 0x401fc0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push esi
push edi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00405f20
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x84]
push eax
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40205b
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov eax, dword [esp + 8]
neg esi
sbb esi, esi
push eax
add esi, 1
call edi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop edi
pop esi
add esp, 0x58
ret

Function at 0x402070
Capabilities:
Delete registry key

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
xor esi, esi
push esi
push 0xf003f
push 1
push 0x40b588
push esi
push str.SYSTEMMsetupInstCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4020c5
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMMsetupInstCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [esi + 1]
pop esi
add esp, 8
ret
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x4020d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402136
mov eax, dword [esp + 0x10]
push 8
lea edx, [esp + 0x1c]
push edx
push 0xb
push 0
push str.InstallDate
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x40216d
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
test eax, eax
je 0x4021b5
cmp dword [esp + 0x14], 0
je 0x4021b5
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call esi
test eax, eax
jne 0x4021b5
mov edx, dword [esp + 0x10]
push 8
lea ecx, [esp + 0x1c]
push ecx
push 0xb
push eax
push str.InstallDate
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4021c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x40d798]
xor eax, esp
mov dword [esp + 0x224], eax
push 0x200
push 0
push esi
call fcn.00405f20
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402233
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x14]
push str.guid
push eax
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [esp + 0x20], 0
je 0x402259
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [esp + eax*2 + 0x1e], 0
cmp word [esi], 0
je 0x402276
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x26]
push edx
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, 0x6a9
jne 0x402286
push 0x200
push 0
push esi
call fcn.00405f20
add esp, 0xc
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0040373d
add esp, 0x22c
ret
Function at 0x4022a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x228
mov eax, dword [0x40d798]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4022d7
cmp word [eax], 0
je 0x4022d7
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4022f7
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x100
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40235b
lea edx, [esp + 0x30]
push edx
call ebx
mov edx, dword [esp + 0x14]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x34]
push ecx
push 1
push 0
push str.guid
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call ebp
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x402396
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x24]
test eax, eax
je 0x4023e9
cmp dword [esp + 0x18], 0
je 0x4023e9
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call esi
test eax, eax
jne 0x4023e9
lea eax, [esp + 0x30]
push eax
call ebx
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
push 1
push 0
push str.guid
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040373d
add esp, 0x228
ret

Function at 0x402410
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402493
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push edx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.RESIDENCE
push eax
call edi
push ebx
call esi
mov edx, dword [esp + 0xc]
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.REGION
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x402660
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push edi
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4026cc
xor eax, eax
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
push 1
push str.D:_A_OICI_GWGRSDDTDC___BU__A_OICI_GWGRSDDTDC___AU__A_OICI_GA___BA__A_OICI_GA___SY_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x4026b3
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], ecx
lea esi, [esp + 8]
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x4026cc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
pop esi
add esp, 0x10
ret
Function at 0x40373d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d798]
jne 0x403747
repz ret
jmp fcn.00404c95

Function at 0x405100
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40d7a8]
je 0x40511b
inc edi
cmp edi, 0x17
jb 0x40510c
cmp edi, 0x17
jae 0x40529b
push ebp
push 3
call fcn.00407bd1
cmp eax, 1
pop ecx
je 0x405267
push 3
call fcn.00407bd1
test eax, eax
pop ecx
jne 0x40514f
cmp dword [section..data], 1
je 0x405267
cmp ebx, 0xfc
je 0x40529a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x40e190
push ebp
call fcn.00406c69
add esp, 0xc
test eax, eax
je 0x405185
push esi
push esi
push esi
push esi
push esi
call fcn.00404b27
add esp, 0x14
push 0x104
mov esi, 0x40e1a9
push esi
push 0
mov byte [0x40e2ad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4051c9
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00406c69
add esp, 0xc
test eax, eax
je 0x4051c9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404b27
add esp, 0x14
push esi
call fcn.004070d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40520e
push esi
call fcn.004070d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x40e4a4
push 0x40a8f4
sub ecx, eax
push ecx
push eax
call fcn.00406bb6
add esp, 0x14
test eax, eax
je 0x40520e
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00404b27
add esp, 0x14
jmp 0x405210
xor esi, esi
push 0x40a8f0
push ebx
push ebp
call fcn.00406af3
add esp, 0xc
test eax, eax
je 0x405230
push esi
push esi
push esi
push esi
push esi
call fcn.00404b27
add esp, 0x14
push dword [edi*8 + 0x40d7ac]
push ebx
push ebp
call fcn.00406af3
add esp, 0xc
test eax, eax
je 0x405252
push esi
push esi
push esi
push esi
push esi
call fcn.00404b27
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00407a14
add esp, 0xc
jmp 0x40529a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40529a
cmp ebp, 0xffffffff
je 0x40529a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40d7ac]
push dword [esi]
call fcn.004070d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x407a14
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00404437
xor ebx, ebx
cmp dword [0x40e854], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x407aea
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x407bca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x407bca
push eax
call fcn.004043c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e854], eax
call esi
push eax
call fcn.004043c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e858], eax
call esi
push eax
call fcn.004043c9
mov dword [0x40e85c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404e8d
test eax, eax
pop ecx
pop ecx
je 0x407ab8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404b27
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x407aea
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004043c9
cmp eax, ebx
pop ecx
mov dword [0x40e864], eax
je 0x407aea
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004043c9
pop ecx
mov dword [0x40e860], eax
mov eax, dword [0x40e860]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x407b6f
cmp dword [0x40e864], ecx
je 0x407b6f
push eax
call fcn.00404440
push dword [0x40e864]
mov esi, eax
call fcn.00404440
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x407b6f
cmp edi, ebx
je 0x407b6f
call esi
cmp eax, ebx
je 0x407b3c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b3c
test byte [ebp - 0x18], 1
jne 0x407b6f
lea eax, [ebp - 0x10]
push eax
call fcn.00404ec4
test eax, eax
pop ecx
je 0x407b57
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404b27
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x407b66
or dword [ebp + 0x10], 0x200000
jmp 0x407baa
or dword [ebp + 0x10], 0x40000
jmp 0x407baa
mov eax, dword [0x40e858]
cmp eax, dword [ebp - 8]
je 0x407baa
push eax
call fcn.00404440
cmp eax, ebx
pop ecx
je 0x407baa
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x407baa
mov eax, dword [0x40e85c]
cmp eax, dword [ebp - 8]
je 0x407baa
push eax
call fcn.00404440
cmp eax, ebx
pop ecx
je 0x407baa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e854]
call fcn.00404440
cmp eax, ebx
pop ecx
je 0x407bca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407bcc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dea0
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea ecx, [ebp - 0xc]
call fcn.0040f550
lea eax, [ebp - 4]
push eax
push 0x431188
push 3
push 0
push 0x431078
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea ecx, [ebp - 0x14]
call fcn.0040f550
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x431098
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0xc]
call edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f570
push eax
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0xc]
call ecx
test eax, eax
jne 0x40dfa2
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
call fcn.0040f210
movzx eax, al
test eax, eax
je 0x40df9d
lea ecx, [ebp - 0x14]
call fcn.0040f520
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
call edx
test eax, eax
jl 0x40df9d
cmp dword [ebp - 0x1c], 0
je 0x40df9d
push str.MJPEG_Compressor
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40df9d
lea ecx, [ebp - 0x14]
call fcn.0040f520
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xc]
call fcn.0040f570
push eax
push 0x431198
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
call ecx
jmp 0x40dfa2
jmp 0x40deee
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0xc]
push ecx
push 0
call fcn.0040ff00
add esp, 8
movzx edx, al
test edx, edx
je 0x40dff0
lea ecx, [ebp - 0xc]
call fcn.0040f570
push eax
push 0x431198
push 1
push 0
push 0x431068
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040f1e0
lea ecx, [ebp - 0x14]
call fcn.00413400
lea ecx, [ebp - 0xc]
call fcn.00413400
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x40e020
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea ecx, [ebp - 0xc]
call fcn.0040f550
lea eax, [ebp - 4]
push eax
push 0x431188
push 3
push 0
push 0x431078
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea ecx, [ebp - 0x14]
call fcn.0040f550
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4310a8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0xc]
call edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f570
push eax
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0xc]
call ecx
test eax, eax
jne 0x40e122
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
call fcn.0040f210
movzx eax, al
test eax, eax
je 0x40e11d
lea ecx, [ebp - 0x14]
call fcn.0040f520
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
call edx
test eax, eax
jl 0x40e11d
cmp dword [ebp - 0x1c], 0
je 0x40e11d
push str.ADPCM
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40e11d
lea ecx, [ebp - 0x14]
call fcn.0040f520
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xc]
call fcn.0040f570
push eax
push 0x431198
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
call ecx
jmp 0x40e122
jmp 0x40e06e
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040f1e0
lea ecx, [ebp - 0x14]
call fcn.00413400
lea ecx, [ebp - 0xc]
call fcn.00413400
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret