joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4977b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cb750
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004c2e98
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4977e3
xor al, al
jmp 0x49790f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x497805
xor al, al
jmp 0x49790f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x497818
xor al, al
jmp 0x49790f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x49782c
xor al, al
jmp 0x49790f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004b6b75
test eax, eax
jne 0x497860
xor al, al
jmp 0x49790f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x57a8cc
mov dword [esp + 0x20], ebp
call fcn.004c2e98
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004bfa94
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004bfaeb
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4978f4
mov ax, word [ebx]
test ax, ax
je 0x4978e6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00497930
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4978ca
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004bfaeb
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x497e70
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004c1180
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x497eb6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004a7408
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x599074
push ecx
call fcn.004a8aa1
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x498dc0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x498e63
test eax, eax
jbe 0x498e63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x498e63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x498e0e
xor esi, esi
jmp 0x498e14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x498e3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0049c7a0
add esi, eax
push esi
mov ebx, esi
call fcn.0049c7a0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x498e20
pop ebp
test edi, edi
pop edi
jne 0x498e63
test ebx, ebx
je 0x498e63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004a7f10
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x498fa5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4990bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4990bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004ba5d6
mov esi, eax
test esi, esi
je 0x4990bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4990bd
mov ecx, esi
call fcn.00498f10
cmp edi, eax
jge 0x4990bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x499043
mov dword [esp + 0x34], 1
jmp 0x49909e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4990bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00498490
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4baf7a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bafb2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b8f55
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b8f2d
jmp 0x4bafbe
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bc778
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bc7ba
call fcn.004c2e98
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4bc7ba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bc7b1
xor eax, eax
jmp 0x4bc7c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bc7c8
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c33c8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c33f6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c3414
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c332e
jmp 0x4c3414
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c3414
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c332e
test edi, edi
mov eax, edi
jne 0x4c33fe
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401c80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [str.SoftwareRealNetworksRealJukebox1.0Preferences]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
push str.ClearLibCorruptionOnShutdown
mov dword [ebp - 0xc], 1
call fcn.0040b400
mov eax, dword [ebp - 0xc]
add esp, 0x10
test eax, eax
je 0x401d0a
lea edx, [ebp - 0x110]
push 0x104
push edx
call fcn.004018e0
mov al, byte [ebp - 0x110]
add esp, 8
test al, al
je 0x401d0a
lea ecx, [ebp - 8]
call fcn.00406320
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 8]
push str._scpt
push ecx
call fcn.00406f80
mov al, byte [ebp - 1]
add esp, 0xc
cmp al, 0xff
lea eax, [ebp - 8]
jne 0x401cfb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 8]
call fcn.00406520
mov esp, ebp
pop ebp
ret
Function at 0x4024e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, str.RealPlayer
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4024f1
sub eax, edx
mov dword [ebp - 4], eax
jne 0x40258f
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.MSVCR71.dll_strrchr]
lea ecx, [ebp - 0x108]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40254a
lea edx, [ebp - 0x108]
push 0x2f
push edx
call esi
add esp, 8
test eax, eax
jne 0x40254a
lea eax, [ebp - 0x108]
jmp 0x40254b
inc eax
push 0x104
push str.RealPlayer
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
pop esi
jne 0x40258f
mov eax, dword [0x40ea4c]
mov ecx, dword [0x40ea50]
mov dx, word [0x40ea54]
mov dword [str.RealPlayer], eax
mov al, byte [0x40ea56]
mov dword [0x4114a4], ecx
mov word [0x4114a8], dx
mov byte [0x4114aa], al
mov eax, str.RealPlayer
mov esp, ebp
pop ebp
ret

Function at 0x403080
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
test ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
je 0x40317f
push edi
push str.PATH
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00406320
test edi, edi
je 0x4030c0
push edi
lea ecx, [ebp - 0x14]
call fcn.00406610
mov al, byte [esi + 0x2b]
add esi, 0x24
cmp al, 0xff
pop edi
je 0x403187
xor ecx, ecx
cmp al, 7
sete cl
mov eax, ecx
test eax, eax
je 0x403101
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push 0x40ec8c
push eax
call fcn.00406d90
add esp, 0xc
push eax
mov ecx, esi
call fcn.00406560
lea ecx, [ebp - 0x1c]
call fcn.00406520
push 0x40ec8c
lea ecx, [ebp - 0xc]
call fcn.00406540
push ebx
lea ecx, [ebp - 0xc]
call fcn.004069a0
mov ax, word [ebp - 0xe]
cmp ah, 0xff
je 0x4031ad
xor ecx, ecx
cmp ah, 7
sete cl
mov eax, ecx
test eax, eax
jne 0x40314b
push 0x40ec88
lea ecx, [ebp - 0xc]
call fcn.004069a0
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
call fcn.00406a00
cmp byte [ebp - 5], 0xff
lea eax, [ebp - 0xc]
jne 0x403157
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR71.dll__putenv]
add esp, 4
test eax, eax
mov esi, 0x80004005
jne 0x40316d
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00406520
lea ecx, [ebp - 0x14]
call fcn.00406520
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [esi + 4]
test al, al
jne 0x403101
mov al, byte [esi + 5]
test al, al
jne 0x403101
mov al, byte [esi + 6]
test al, al
je 0x4030dc
jmp 0x403101
mov ecx, dword [ebp - 0x10]
test cl, cl
jne 0x403132
test ch, ch
jne 0x403132
test al, al
je 0x40314b
jmp 0x403132
Function at 0x404a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push edi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x404b10
mov eax, dword [ebp - 4]
test eax, eax
jle 0x404b10
push 0x18
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x404ac3
mov ecx, eax
call fcn.00407440
jmp 0x404ac5
xor eax, eax
test eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
jne 0x404adf
mov ecx, dword [ebp + 0x14]
pop esi
pop edi
mov dword [ecx], 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax]
push eax
call dword [edx + 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [edx + 0x1c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
je 0x405363
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x405373
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405369
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x405380
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x4116b8]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x25
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
or ebx, 0xffffffff
push eax
mov dword [ebp - 0xa6], ebx
mov dword [ebp - 0xa2], ebx
mov dword [ebp - 0x9e], 0
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0x8c]
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov word [ebp - 0xa8], dx
xor edx, edx
cmp esi, 2
sete dl
mov di, ax
mov word [ebp - 0xac], di
mov word [ebp - 0xaa], cx
mov esi, edx
test esi, esi
je 0x405419
mov ebx, 8
jmp 0x40543a
cmp ax, 4
jae 0x405426
mov ebx, 2
jmp 0x40543a
jne 0x405440
cmp cx, 0xa
sbb ebx, ebx
and ebx, 0xfffffc04
add ebx, 0x400
mov dword [ebp - 0xa6], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405556
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0xd0]
cmp eax, 3
ja case.default.0x405468
jmp dword [eax*4 + 0x405568]
test esi, esi
je 0x4054bb
cmp di, 3
ja 0x405485
jne 0x4054bb
cmp word [ebp - 0xaa], 0x32
jb 0x4054bb
movzx eax, word [ebp - 0xb0]
sub eax, 4
jns 0x40549d
mov dword [ebp - 0xa2], 0xfffffffe
jmp 0x405518
test eax, eax
je 0x4054de
cmp eax, 1
je 0x4054d2
xor ecx, ecx
cmp eax, 2
setne cl
dec ecx
and ecx, 5
dec ecx
mov dword [ebp - 0xa2], ecx
jmp 0x405518
mov eax, dword [ebp - 0xb8]
sub eax, 0x182
je 0x405491
sub eax, 0x64
je 0x4054de
sub eax, 0x64
jne case.default.0x405468
mov dword [ebp - 0xa2], 2
jmp 0x405518
mov dword [ebp - 0xa2], 1
jmp 0x405518
mov dword [ebp - 0xa2], 0x40
jmp 0x405518
mov dword [ebp - 0xa2], 0x20
jmp 0x405518
mov dword [ebp - 0xa2], 8
jmp 0x405518
mov dword [ebp - 0xa2], 0xffffffff
call fcn.00405320
mov edx, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x9e], eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp - 0xa4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xa0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x9e]
shr edx, 0x10
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0040cc02
mov esp, ebp
pop ebp
ret
Function at 0x4056b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4057b8
mov esi, dword [ebp + 8]
test esi, esi
je 0x4057b8
cmp byte [esi], 0
je 0x4057b8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4057b8
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebx], 0
jne 0x40570c
mov ecx, dword [edi + 8]
push 0
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4057b8
mov eax, dword [ebp + 0x10]
dec eax
je 0x405778
sub eax, 3
je 0x40574c
sub eax, 3
jne 0x4057a8
push 0x10
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4057a4
mov edx, dword [edi + 8]
push edx
push esi
mov ecx, eax
call fcn.00405fc0
mov dword [ebx], eax
mov ecx, dword [ebx]
pop edi
xor eax, eax
test ecx, ecx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
push 0x10
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4057a4
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.00405eb0
mov dword [ebx], eax
mov ecx, dword [ebx]
pop edi
xor eax, eax
test ecx, ecx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
push 0x10
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4057a4
mov edx, dword [edi + 8]
push edx
push esi
mov ecx, eax
call fcn.00405d40
mov dword [ebx], eax
mov ecx, dword [ebx]
pop edi
xor eax, eax
test ecx, ecx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
mov ecx, dword [ebx]
pop edi
xor eax, eax
test ecx, ecx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x4057f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4116b8]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4058b2
mov eax, 0x80
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
mov edx, dword [esi + 0x14]
push 0
lea eax, [ebp - 0x108]
push eax
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x84]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4058b2
mov edx, dword [esi + 0x14]
inc edx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x405890
mov ecx, dword [esi + 8]
cmp byte [ebp - 0x84], 0x5c
mov dword [edi + 4], ecx
lea ecx, [edi + 0xc]
jne 0x405884
lea edx, [ebp - 0x83]
push edx
jmp 0x40588b
lea eax, [ebp - 0x84]
push eax
call fcn.00406610
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x40589d
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x1c], ecx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
call fcn.0040cc02
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
call fcn.0040cc02
mov esp, ebp
pop ebp
ret 4
Function at 0x405a50
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], esi
jne 0x405a73
pop edi
mov eax, 0x80040009
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, 0x40ee60
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.00406320
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0x20019
mov dword [ebp - 8], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
call fcn.00406320
cmp dword [ebp - 8], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x20019
mov dword [ebp - 0x2c], edi
jne 0x405ae9
mov eax, dword [esi + 8]
mov dword [ebp - 0x24], eax
cmp byte [ebx], 0x5c
jne 0x405ad4
lea ecx, [ebx + 1]
push ecx
jmp 0x405ad5
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00406610
cmp dword [ebp - 8], edi
jne 0x405ae9
mov dword [ebp - 0xc], 0xe
lea ecx, [ebp - 0x28]
call fcn.00405980
mov esi, eax
cmp esi, edi
jl 0x405b93
cmp dword [ebp - 8], edi
je 0x405b03
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.004057f0
test eax, eax
je 0x405b44
cmp byte [ebp - 0x39], 0xff
lea eax, [ebp - 0x40]
jne 0x405b1f
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405a50
test eax, eax
jl 0x405b44
cmp dword [ebp - 8], edi
je 0x405b34
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004057f0
test eax, eax
jne 0x405b13
cmp dword [ebp - 8], edi
je 0x405b5a
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405b5a
mov dword [ebp - 8], edi
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push eax
call esi
test eax, eax
push ebx
jg 0x405b7c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call esi
mov esi, eax
jmp 0x405b93
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 0x2c], edi
mov ebx, 0x40ee60
mov dword [ebp - 0x4c], ebx
je 0x405bb1
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405bb1
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x40]
call fcn.00406520
cmp dword [ebp - 8], edi
mov dword [ebp - 0x28], ebx
pop ebx
je 0x405bd3
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405bd3
mov dword [ebp - 8], edi
lea ecx, [ebp - 0x1c]
call fcn.00406520
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408a00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, 0x80004005
push edi
mov dword [ebp - 0xc], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a17
push str.RealPlayer_CmdLine_Proc_Mutex
push 1
sub eax, edx
push 0
lea edi, [eax + 5]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x10], esi
je 0x408b48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408a58
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.RealPlayer_CmdLine_Shmem
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x408b3a
push edi
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x408b2d
mov esi, dword [ebp + 8]
lea ecx, [edi - 4]
mov eax, ecx
shr ecx, 2
mov dword [ebx], edi
lea edi, [ebx + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [ebp - 8]
push str.RealPlayer_CmdLine_Trigger_Event
xor esi, esi
push ecx
mov dword [ebp - 8], esi
call fcn.0040d0b0
push 1
lea edx, [ebp - 4]
push str.RealPlayer_CmdLine_ProcessingDone_Event
push edx
mov dword [ebp - 4], esi
call fcn.0040d0b0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add esp, 0x18
cmp eax, esi
je 0x408b16
cmp ecx, esi
je 0x408b04
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
push 0x2710
call dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x408b16
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], esi
cmp ecx, esi
je 0x408b23
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret