joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ccd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ca0c8
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push esi
push 1
push 1
push eax
call ebx
mov ebp, dword [esp + 0x3c]
push esi
push 1
push 4
push ebp
call ebx
mov eax, dword [ebp]
add esp, 0x20
test eax, eax
jle 0x42ce3b
push esi
lea edi, [ebp + 4]
push 1
push 4
push edi
call ebx
mov eax, dword [edi]
add esp, 0x10
test eax, eax
jl 0x42ce3b
push esi
push 1
lea ecx, [ebp + 8]
push 4
push ecx
call ebx
push esi
push 1
lea edx, [ebp + 0xc]
push 4
push edx
call ebx
push esi
push 1
lea eax, [ebp + 0x10]
push 4
push eax
call ebx
push esi
push 1
lea ecx, [esp + 0x6c]
push 4
push ecx
mov dword [esp + 0x74], 0
call ebx
mov eax, dword [esp + 0x74]
add esp, 0x40
test eax, eax
jle 0x42ce3b
cmp eax, 0x1048
jae 0x42ce3b
lea edx, [ebp + 0x14]
mov ecx, 0x82
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
push esi
push eax
push 2
push edx
call ebx
push esi
push 1
lea ecx, [esp + 0x4c]
push 4
push ecx
mov dword [esp + 0x54], 0
call ebx
mov eax, dword [esp + 0x54]
add esp, 0x20
test eax, eax
jle 0x42ce34
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x30], edi
je 0x42ce34
mov edx, dword [esp + 0x34]
xor eax, eax
push esi
mov esi, dword [esp + 0x34]
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x38]
push eax
push 1
push esi
call ebx
add esp, 0x10
lea ecx, [esp + 0x10]
push esi
call fcn.00410350
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
push ecx
lea ecx, [ebp + 0x21c]
call fcn.00410450
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00410330
push esi
call fcn.00495c27
add esp, 4
mov eax, 1
jmp 0x42ce3e
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x42dd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca123
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebx + 8]
xor eax, eax
cmp edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
jle 0x42dd8f
mov esi, dword [ebx + 4]
mov edi, dword [ebp + 8]
mov ecx, esi
cmp dword [ecx], edi
jne 0x42dd87
cmp byte [ecx + 8], 0
je 0x42ddb1
inc eax
add ecx, 0xc
cmp eax, edx
jl 0x42dd7d
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00410330
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ecx + 4]
dec edx
cmp eax, edx
je 0x42ddc7
lea eax, [eax + eax*2 + 3]
mov ecx, dword [esi + eax*4 + 4]
lea eax, [esi + eax*4]
mov dword [ebp - 0x14], ecx
test edi, edi
jle 0x42dd8f
add ebx, 0x10
push 0x4e9358
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
mov dword [ebp - 0x20], esi
je 0x42dd8f
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x42de09
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0x228
mov dword [ebp - 0x18], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x14
mov dword [ebp + 8], edi
test edi, edi
mov byte [ebp - 4], 2
je 0x42de46
lea ecx, [edi + 0x21c]
call fcn.004102e0
mov ebx, edi
jmp 0x42de48
xor ebx, ebx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, edx
jge 0x42df0c
test ebx, ebx
je 0x42df24
mov ecx, 0x8a
xor eax, eax
mov edi, ebx
mov byte [ebp + 0xb], al
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp + 0xb]
push esi
push eax
push ebx
call fcn.0042ccd0
cmp eax, 0xffffffff
je 0x42df0c
lea ecx, [ebp + 0xc]
call fcn.004c5480
mov edi, eax
mov eax, dword [ebx + 0x220]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x42debb
test cl, cl
je 0x42deb7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x42debb
add eax, 2
add edi, 2
test cl, cl
jne 0x42de97
xor eax, eax
jmp 0x42dec0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42defa
push esi
mov byte [ebp + 0xb], 1
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
mov eax, dword [ebp - 0x18]
push 0
push eax
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 1
lea ecx, [ebp + 0xb]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push 0
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x2c
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x42de4c
test ebx, ebx
je 0x42df24
lea ecx, [ebx + 0x21c]
call fcn.00410330
push ebx
call fcn.00495c27
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x42dd8f
Function at 0x42df50
Capabilities:
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ca138
push eax
mov dword fs:[0], esp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x1c], 0
call fcn.0042dfd0
mov edi, eax
sub esp, 0xc
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004103d0
push edi
mov ecx, esi
call fcn.0042dd40
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.00410330
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x18
Function at 0x435ac0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
mov ebp, dword [esp + 0x10]
jne 0x435bcc
test ebp, ebp
je 0x435af6
push str.DEFAULTSS.XSL
push edi
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
jmp 0x435b35
push ebx
mov esi, 0x4e9504
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x435b26
test cl, cl
je 0x435b22
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x435b26
add eax, 2
add esi, 2
test cl, cl
jne 0x435afe
xor eax, eax
jmp 0x435b2b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
pop ebx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
je 0x435bcc
cmp dword [0x4e941c], 0xffffffff
jne 0x435b5a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4e941c], eax
je 0x435bdf
test ebp, ebp
push 0x17
push edi
je 0x435b70
mov edx, dword [0x5cad44]
push edx
call dword [0x5c5248]
jmp 0x435b7c
mov eax, dword [0x5cad44]
push eax
call dword [0x5c524c]
mov esi, eax
test esi, esi
je 0x435bcc
mov ecx, dword [0x4e941c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.00494d39
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004950fd
push 0x435990
push 0x5c5244
call fcn.0049516c
push 0x435a20
push 0x5c5240
call fcn.0049516c
call fcn.00494e9f
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [0x4e941c]
cmp eax, 0xffffffff
je 0x435bdf
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebp, ebp
je 0x435bfa
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push edx
push edi
push eax
call dword [0x5c5248]
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edi
push edx
call dword [0x5c524c]
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x436270
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
mov edx, dword [ebx]
push ecx
lea esi, [eax*4]
push 0x40
add edx, esi
push 4
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebx]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push 4
add edx, esi
push ecx
push edx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x436307
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x436307
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xc]
push edx
push 4
mov dword [ecx], eax
mov ecx, dword [ebx]
lea eax, [esp + 0x28]
add ecx, esi
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x436307
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x438870
Capabilities:
Create thread

Disassembly:
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4388d4
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [eax + 8], edx
mov edx, dword [esp + 4]
mov dword [eax + 0x10], edx
lea edx, [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x20]
push fcn.004388e0
push 0
push 0
mov dword [eax], 1
mov dword [eax + 0x14], ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4388d4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x439100
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
push 0x11
call edi
shr eax, 8
test al, al
je 0x439176
push 0x12
call edi
movsx eax, ax
shr eax, 0x10
je 0x439134
mov edx, dword [esi]
push 0x64
mov ecx, esi
call dword [edx + 0x74]
pop edi
mov eax, 1
pop esi
ret 4
mov eax, dword [esi + 0x30c4]
cmp eax, 0xffffffff
jne 0x439144
mov eax, 0x64
cmp word [esp + 0xc], 0
jle 0x439161
mov edx, dword [esi]
add eax, 5
push eax
mov ecx, esi
call dword [edx + 0x74]
pop edi
mov eax, 1
pop esi
ret 4
mov edx, dword [esi]
add eax, 0xfffffffb
push eax
mov ecx, esi
call dword [edx + 0x74]
pop edi
mov eax, 1
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x43abe0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x43ac53
mov eax, dword [esi + 0x50]
mov dword [esi + 0x60ac], 0
test eax, eax
je 0x43ac14
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x43ac14
push 0
call fcn.00409c30
push 0
push 0xf
mov ecx, esi
call fcn.00409ab0
push 0
push 6
mov ecx, esi
call fcn.00409ab0
mov eax, dword [esi]
push 2
mov ecx, esi
call dword [eax + 0x48]
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x43ac4c
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_SetParent]
mov dword [esi + 0x48], 1
pop esi
ret
Function at 0x43bbf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
mov eax, dword [esi + 4]
cmp eax, 0x100
jne 0x43bc4f
mov eax, dword [esi + 8]
add eax, 0xfffffff7
cmp eax, 0x72
ja case.0x43bc69.21
xor ecx, ecx
mov cl, byte [eax + 0x43bcd8]
jmp dword [ecx*4 + 0x43bccc]
mov dx, word [esi + 8]
mov ecx, edi
push edx
push 0xc
call fcn.00409ab0
mov ebx, eax
pop edi
pop esi
pop ebx
ret 4
mov ax, word [esi + 8]
mov ecx, edi
push eax
push 0xc
call fcn.00409ab0
mov ebx, eax
pop edi
pop esi
pop ebx
ret 4
cmp eax, 0x104
jne case.0x43bc69.21
mov eax, dword [esi + 8]
add eax, 0xffffffee
cmp eax, 0x67
ja case.0x43bc69.21
xor ecx, ecx
mov cl, byte [eax + 0x43bd5c]
jmp dword [ecx*4 + 0x43bd4c]
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je case.0x43bc69.21
mov ax, word [esi + 8]
mov ecx, edi
push eax
push 0xc
call fcn.00409ab0
mov ebx, 1
pop edi
mov eax, ebx
pop esi
pop ebx
ret 4
mov eax, dword [edi + 0x50]
test eax, eax
je 0x43bcb1
mov ecx, edi
call fcn.00409be0
push 1
mov ecx, edi
call fcn.00409c30
mov cx, word [esi + 8]
push ecx
push 0xc
mov ecx, edi
call fcn.00409ab0
xor ebx, ebx
pop edi
mov eax, ebx
pop esi
pop ebx
ret 4

Function at 0x43c500
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2094
call fcn.00495c50
push esi
mov esi, ecx
mov dword [esp + 4], 0
call fcn.0043bde0
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [esp + 4]
test eax, eax
je 0x43c5c2
mov ecx, dword [esp + 0x209c]
push edi
xor edi, edi
test ecx, ecx
je 0x43c555
mov ecx, esi
call fcn.0043bde0
push eax
call fcn.00442a60
add esp, 4
test eax, eax
je 0x43c596
jmp 0x43c591
push eax
push str.mailto:_subjectFrom_Browserbody_s
lea eax, [esp + 0x14]
push 0x1048
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0xc]
push 5
push 0x4f04e0
push 0x4f04e0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x43c596
mov edi, 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
pop edi
jne 0x43c5c2
push 0x40
push 0x4f0b48
push 0x78
call fcn.00457390
add esp, 4
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
add esp, 0x2094
ret 4
Function at 0x43c6b0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 8]
push edi
push eax
push str.SoftwareMicrosoftInternet_ExplorerDefault_HTML_Editor_shelleditcommand
mov edi, ecx
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x14], 0x104
call esi
test eax, eax
je 0x43c6f6
lea ecx, [esp + 0xc]
push ecx
push str.InternetShortcut_shelleditcommand
push DirectSoundCreate
call esi
test eax, eax
jne 0x43c78f
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push 0x4f04e0
push ecx
mov dword [esp + 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
lea esi, [esp + 0x10]
test eax, eax
jbe 0x43c78f
cmp word [esp + 0x10], 0x22
jne 0x43c73f
lea esi, [esp + 0x12]
push 0x22
push esi
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x43c754
mov word [eax], 0
push str._dde
push esi
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x43c76c
mov word [eax], 0
push 5
lea eax, [edi + 0x1064]
push 0
push eax
push esi
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x43c798
push 2
mov ecx, edi
call fcn.0043c7b0
pop edi
pop esi
add esp, 0x210
ret
Function at 0x43f340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ca8d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
push eax
push esi
push edi
mov dword [esp + 0x34], ebx
call fcn.0043eba0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, ebx
je 0x43f38a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 4]
mov edx, dword [edi]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
mov eax, dword [esi]
push ecx
push eax
push edi
call dword [edx + 0x1ac]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x43f501
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
push ecx
lea ecx, [esp + 0x34]
call fcn.00441d50
cmp eax, ebx
jge 0x43f3d7
cmp eax, 0x80004002
je 0x43f3d7
push eax
call fcn.00495b54
mov eax, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x3c]
cmp eax, ebx
je 0x43f4c4
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], ebx
mov edx, dword [eax]
push ecx
push eax
mov byte [esp + 0x34], 2
call dword [edx + 0x48]
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x43f4b1
mov dword [esp + 0x3c], ebx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x3c]
push edx
mov byte [esp + 0x30], 3
call fcn.00436970
cmp eax, ebx
jge 0x43f430
cmp eax, 0x80004002
je 0x43f430
push eax
call fcn.00495b54
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call fcn.0043f180
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
push edx
push eax
push ecx
call fcn.0043efc0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov edi, dword [esi]
mov ecx, dword [esp + 0x38]
sub edx, eax
mov eax, dword [esp + 0x34]
add edi, edx
mov edx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [esp + 0x58]
mov dword [esi], edi
mov edi, dword [esi + 4]
push ecx
push ebp
add edi, eax
push esi
push edx
mov dword [esi + 4], edi
call fcn.0043f340
mov eax, dword [esp + 0x64]
add esp, 0x28
cmp eax, ebx
mov byte [esp + 0x2c], 2
je 0x43f4ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov byte [esp + 0x2c], 1
je 0x43f4c0
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x34]
cmp dword [ebp], ebx
jne 0x43f4ee
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x43f4df
push 0x80004003
call fcn.00495b54
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
push 0x4d021c
push eax
call dword [ecx]
mov eax, dword [esp + 0x34]
cmp eax, ebx
mov byte [esp + 0x2c], bl
pop ebp
je 0x43f4fd
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
pop edi
pop esi
cmp eax, ebx
mov dword [esp + 0x20], 0xffffffff
pop ebx
je 0x43f516
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4426d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x30e0
call fcn.00495c50
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
mov word [esp + 0x1060], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x823
xor eax, eax
lea edi, [esp + 0x1062]
mov dword [esp + 0x10], 0x824
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftInternet_ExplorerMain
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44277b
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push esi
push esi
push str.Start_Page
push eax
call edi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1060]
push ecx
push edx
push esi
push esi
push str.Secondary_Start_Pages
push eax
mov dword [esp + 0x28], 0x1048
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x30f8]
mov edi, dword [esp + 0x30f4]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x18]
push edx
push 0x4de3ac
push ebx
push edi
call ebp
lea eax, [esp + 0x1070]
mov word [edi + ebx*2 - 2], si
push eax
lea esi, [esp + 0x1074]
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
mov dword [esp + 0x10], eax
test eax, eax
jle 0x4427ee
push esi
push edi
push str._s_r_n_s
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x24]
mov word [edi + ebx*2 - 2], 0
lea esi, [esi + ecx*2 + 2]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x18
mov dword [esp + 0x10], eax
test eax, eax
jg 0x4427c2
push edi
call fcn.004610c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30e0
ret

Function at 0x442810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [0x5c79c0]
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
test ecx, ecx
mov dword [esp], 1
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternationalScripts26
je 0x44283c
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternational
lea ecx, [esp + 4]
push ecx
push eax
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44287d
lea edx, [esp + 8]
lea eax, [esp]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.AutoDetect
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x10
ret
Function at 0x442890
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [0x5c79c0]
mov dword [esp], 1
test ecx, ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 4
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternationalScripts26
je 0x4428bf
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternational
lea ecx, [esp + 4]
push ecx
push eax
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44292d
lea edx, [esp + 8]
lea eax, [esp]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.AutoDetect
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp]
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 8]
lea edx, [esp]
sete al
push ecx
push edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
push 4
push 0
push str.AutoDetect
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret