joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4653f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0
push 0
call dword [0x46b88c]
mov edi, dword [esp + 0x30]
push 1
push 0x400
mov ecx, esi
mov dword [esp + 0x30], 0
mov dword [esi], 0x4729c4
mov dword [esi + 8], edi
call dword [0x46b890]
mov eax, dword [edi + 0x24]
mov ecx, dword [eax + 0x14]
imul ecx, dword [edi + 0xc]
mov edx, dword [eax + 0x18]
imul edx, dword [edi + 0x10]
mov dword [esp + 0x30], ecx
lea eax, [esp + 0x10]
push eax
fild dword [esp + 0x34]
mov dword [esp + 0x34], edx
mov ecx, esi
fstp qword [esp + 0x14]
fild dword [esp + 0x34]
fstp qword [esp + 0x1c]
call dword [0x46ad0c]
fld dword [edi + 0x1c]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call dword [0x46ad40]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x439510
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4654c1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebx, dword [edi + 0x3c]
push eax
call dword [0x46b8a0]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x10], ebx
xor ebx, ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], 0xffffffff
mov byte [esi + 0x18], bl
push ebx
push ebx
push 0x472b24
lea edx, [esp + 0x34]
push 0x46c748
push edx
mov dword [esp + 0x30], ebx
mov dword [esi], 0x472b10
call dword [0x46a758]
add esp, 0x14
push eax
mov ecx, esi
mov byte [esp + 0x20], 1
call dword [0x46b8f8]
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], bl
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4395b6
mov edx, dword [esp + 0x28]
push edx
call dword [0x46a75c]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x43ebc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x465f64
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004423f0
mov ecx, dword [edi + 0x28]
mov esi, eax
mov eax, dword [edi + 0x2c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 0xc]
mov ebx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x20], ecx
lea ecx, [ecx + ebx - 1]
lea edx, [eax + edx - 1]
mov dword [esp + 0x24], eax
xor ebx, ebx
push ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x34], edx
call dword [0x46a2ec]
test al, al
je 0x43ecbc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push 1
push 1
push ecx
push edx
lea ecx, [esp + 0x24]
call dword [0x46b8cc]
push 0x1c
mov dword [esp + 0x3c], ebx
call fcn.0045dcdc
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x38], 1
cmp eax, ebx
je 0x43ec82
mov ecx, dword [edi + 0x1c]
lea edx, [esp + 0x10]
push edx
push esi
push ecx
mov ecx, eax
call fcn.0043edd0
jmp 0x43ec84
xor eax, eax
mov cl, byte [esp + 0x40]
mov byte [eax + 0x18], cl
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x24]
push eax
mov byte [esp + 0x3c], bl
call dword [0x46b8dc]
mov ecx, dword [edi + 0x1c]
push esi
lea edx, [esp + 0x14]
push edx
call fcn.0041c1f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call dword [0x46b8ec]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4

Function at 0x43edd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x465fd7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
push 0
call dword [0x46b8a0]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
lea edi, [esi + 0x14]
push edx
mov ecx, edi
mov dword [esp + 0x20], 0
mov dword [esi], 0x473420
mov dword [esi + 8], eax
call dword [0x46b8e8]
push 0
push 0
push 0x473414
lea eax, [esp + 0x30]
push 0x46c748
push eax
mov byte [esp + 0x30], 1
mov byte [esi + 0x18], 0
call dword [0x46a758]
add esp, 0x14
push eax
mov ecx, esi
mov byte [esp + 0x20], 2
call dword [0x46b8f8]
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x1c], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x43ee82
mov eax, dword [esp + 0x24]
push eax
call dword [0x46a75c]
add esp, 4
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
neg eax
neg ecx
push eax
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call dword [0x46b8c4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x20], 3
call dword [0x46bde8]
lea ecx, [esp + 0xc]
mov dword [esi + 0x10], eax
mov byte [esp + 0x1c], 1
call dword [0x46b8ec]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x445a70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x466eb1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
mov ecx, dword [esp + 0x20]
push ecx
push eax
push edx
mov ecx, esi
call fcn.00445950
push 0
push 0
push 0x474268
lea edx, [esp + 0x28]
push 0x46c748
push edx
mov dword [esp + 0x28], 0
mov dword [esi], 0x474254
call dword [0x46a758]
add esp, 0x14
push eax
mov ecx, esi
mov byte [esp + 0x18], 1
call dword [0x46b8f8]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x14], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x445b0e
mov edx, dword [esp + 0x1c]
push edx
call dword [0x46a75c]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x44e760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x468394
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x1c]
mov esi, dword [esp + 0x38]
mov ebx, dword [eax + 0x24]
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
push eax
push 0x47448e
lea eax, [esp + 0x1c]
push 0x474de4
push eax
call fcn.0044e190
add esp, 0x10
push eax
mov ecx, ebx
mov dword [esp + 0x34], 0
call dword [0x46b898]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44e7e7
mov eax, dword [esp + 0x14]
push eax
call dword [0x46a75c]
add esp, 4
mov eax, dword [0x46a704]
mov dword [esp + 0x38], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea edx, [esp + 0x18]
push esi
push edx
mov dword [esp + 0x38], 1
call fcn.004044f0
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 2
lea esp, [esp]
mov edx, eax
inc eax
mov dword [esp + 0x1c], eax
test edx, edx
jne 0x44e8a9
cmp ecx, dword [esp + 0x24]
je 0x44e8a9
mov edi, dword [ecx]
test eax, eax
je 0x44e899
mov ecx, edi
call dword [0x46bdcc]
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], esi
call fcn.00414810
push 0x1c
call fcn.0045dcdc
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x30], 3
test eax, eax
je 0x44e87e
mov ecx, dword [edi + 0x3c]
mov edx, dword [ebp + 0x1c]
push 0
push esi
push ecx
push edx
mov ecx, eax
call fcn.00439450
jmp 0x44e880
xor eax, eax
push eax
mov ecx, ebx
mov byte [esp + 0x34], 2
call dword [0x46b8dc]
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x1c], eax
jmp 0x44e833
mov ecx, dword [esp + 0x20]
add ecx, 4
mov dword [esp + 0x20], ecx
jmp 0x44e820
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x30], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov esi, dword [0x46a6d4]
jne 0x44e8cb
mov eax, dword [esp + 0x18]
push eax
call esi
add esp, 4
mov ecx, ebx
call dword [0x46b89c]
mov ecx, dword [ebp + 0x1c]
lea edx, [esp + 0x38]
push edx
call fcn.0041c7e0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44e8ff
mov edx, dword [esp + 0x38]
push edx
call esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x44e920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4683cc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x1c]
mov esi, dword [esp + 0x34]
mov ebp, dword [eax + 0x24]
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
push eax
push 0x47448e
lea eax, [esp + 0x3c]
push 0x474dfc
push eax
call fcn.0044e190
add esp, 0x10
push eax
mov ecx, ebp
mov dword [esp + 0x30], 0
call dword [0x46b898]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44e9a7
mov eax, dword [esp + 0x34]
push eax
call dword [0x46a75c]
add esp, 4
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004044f0
add esp, 8
mov ebx, dword [0x46b8dc]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 1
jmp 0x44e9d0
mov edx, eax
inc eax
mov dword [esp + 0x18], eax
test edx, edx
jne 0x44ea32
cmp ecx, dword [esp + 0x20]
je 0x44ea32
mov esi, dword [ecx]
test eax, eax
je 0x44ea25
push 0x1c
call fcn.0045dcdc
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x2c], 2
test eax, eax
je 0x44ea0e
mov ecx, dword [edi + 0x1c]
push 0
push esi
push ecx
mov ecx, eax
call fcn.00439510
jmp 0x44ea10
xor eax, eax
push eax
mov ecx, ebp
mov byte [esp + 0x30], 1
call ebx
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jmp 0x44e9e3
mov ecx, dword [esp + 0x1c]
add ecx, 4
mov dword [esp + 0x1c], ecx
jmp 0x44e9d0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44ea55
mov edx, dword [esp + 0x14]
push edx
call dword [0x46a6d4]
add esp, 4
mov ecx, ebp
call dword [0x46b89c]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x44ea80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4683cc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x1c]
mov esi, dword [esp + 0x34]
mov ebx, dword [eax + 0x24]
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
push eax
push 0x47448e
lea eax, [esp + 0x3c]
push 0x474e10
push eax
call fcn.0044e190
add esp, 0x10
push eax
mov ecx, ebx
mov dword [esp + 0x30], 0
call dword [0x46b898]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44eb07
mov eax, dword [esp + 0x34]
push eax
call dword [0x46a75c]
add esp, 4
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004044f0
add esp, 8
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 1
lea esp, [esp]
mov edx, eax
inc eax
mov dword [esp + 0x18], eax
test edx, edx
jne 0x44eb9a
cmp ecx, dword [esp + 0x20]
je 0x44eb9a
mov esi, dword [ecx]
test eax, eax
je 0x44eb8d
cmp dword [esi + 0x3c], edi
je 0x44eb86
push 0x18
call fcn.0045dcdc
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x2c], 2
test eax, eax
je 0x44eb72
mov ecx, dword [ebp + 0x1c]
push edi
push esi
push ecx
mov ecx, eax
call fcn.00439040
jmp 0x44eb74
xor eax, eax
push eax
mov ecx, ebx
mov byte [esp + 0x30], 1
call dword [0x46b8dc]
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jmp 0x44eb43
mov ecx, dword [esp + 0x1c]
add ecx, 4
mov dword [esp + 0x1c], ecx
jmp 0x44eb30
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44ebbd
mov edx, dword [esp + 0x14]
push edx
call dword [0x46a6d4]
add esp, 4
mov ecx, ebx
call dword [0x46b89c]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x44f3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46850a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0
call dword [0x46b8a0]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi], 0x474e80
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov eax, dword [edx]
lea ecx, [esi + 0x10]
mov ebx, 1
mov dword [esp + 0x20], 0
mov dword [ecx], eax
mov edx, ebx
lock xadd dword [eax], edx
mov eax, dword [ecx]
mov ebp, dword [0x46a2a4]
test byte [eax + 0xc], bl
jne 0x44f454
call ebp
mov eax, dword [edi + 0x30]
lea ecx, [esi + 0x14]
mov byte [esp + 0x20], bl
mov dword [ecx], eax
mov edx, ebx
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0xc], bl
jne 0x44f46f
call ebp
push 0
push 0
push 0x474e6c
lea ecx, [esp + 0x34]
push 0x46c748
mov bl, 2
push ecx
mov byte [esp + 0x34], bl
call dword [0x46a758]
add esp, 0x14
push eax
mov ecx, esi
mov byte [esp + 0x24], 3
call dword [0x46b8f8]
mov edx, dword [esp + 0x28]
mov byte [esp + 0x20], bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x44f4be
mov ecx, dword [esp + 0x28]
push ecx
call dword [0x46a75c]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x44f710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x468599
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4c003c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [eax + 8]
mov eax, dword [edi + 0x30]
mov dword [esp + 0xc], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0xc]
test byte [edx + 0xc], 1
jne 0x44f761
lea ecx, [esp + 0xc]
call dword [0x46a2a4]
mov eax, dword [esp + 0x30]
fld qword [eax]
lea ecx, [esp + 0xc]
fsub qword [edi + 0x10]
mov dword [esp + 0x28], 0
fld qword [eax + 8]
mov eax, dword [esi + 0xc]
fsub qword [edi + 0x18]
push eax
fxch st(1)
fstp qword [esp + 0x14]
fstp qword [esp + 0x1c]
call dword [0x46a1f0]
fld qword [esp + 0x10]
lea ecx, [esp + 0xc]
fstp qword [eax]
push ecx
fld qword [esp + 0x1c]
fstp qword [eax + 8]
mov ecx, dword [esi + 8]
call fcn.0041fd20
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call dword [0x46a2b0]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x401430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x401449
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
test esi, esi
jne 0x40145d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40147e
cmp esi, eax
jae 0x401457
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401470
cmp esi, eax
jae 0x401457
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403c80
Capabilities:
Check os version

Disassembly:
sub esp, 0x384
mov eax, dword [0x493ea0]
push ebx
push esi
mov dword [esp + 0x388], eax
mov esi, ecx
mov ecx, dword [0x493198]
mov eax, 0x64
cmp ecx, eax
push edi
jle 0x403cab
mov dword [0x493198], eax
xor ebx, ebx
push 0x2d
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], 0x12
call dword [sym.imp.user32.dll_GetSystemMetrics]
mov dword [esi + 0x5c], eax
or eax, 0xffffffff
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
lea eax, [esp + 0x1a4]
push eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x138], ebx
mov dword [esp + 0x1a8], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x1b4], 2
jne 0x403d28
mov eax, dword [esp + 0x1a8]
cmp eax, 5
ja 0x403d21
jne 0x403d28
cmp dword [esp + 0x1ac], 1
jb 0x403d28
mov eax, 1
jmp 0x403d2a
xor eax, eax
cmp eax, ebx
lea ecx, [esi + 0x140]
push ebp
mov ebp, dword [sym.imp.user32.dll_SystemParametersInfoA]
mov dword [esi + 0x13c], eax
mov dword [ecx], ebx
je 0x403d4d
push ebx
push ecx
push ebx
push 0x1022
call ebp
mov edi, dword [sym.imp.user32.dll_GetSysColor]
push 4
call edi
push 0xd
mov dword [esi + 0x144], eax
call edi
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], eax
cmp dword [esi + 0x13c], ebx
je 0x403d7f
push 0x1d
call edi
mov dword [esi + 0x14c], eax
push 0xe
call edi
push 7
mov dword [esi + 0x150], eax
call edi
movzx ecx, byte [esi + 0x146]
imul ecx, ecx, 0xcf
mov dword [esi + 0x154], eax
movzx eax, byte [esi + 0x14a]
lea edx, [eax + eax*2]
movzx eax, byte [esi + 0x149]
shl edx, 4
add ecx, edx
sar ecx, 8
xor edx, edx
mov dh, cl
movzx ecx, byte [esi + 0x145]
imul ecx, ecx, 0xcf
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
movzx eax, byte [esi + 0x148]
mov dl, ch
movzx ecx, byte [esi + 0x144]
imul ecx, ecx, 0xcf
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
mov eax, dword [esi + 0x5c]
sar ecx, 8
shl edx, 8
movzx ecx, cl
or edx, ecx
mov dword [esi + 0x158], edx
mov edx, dword [esi + 0x58]
shl eax, 1
sub edx, eax
sub edx, 2
cmp edx, 5
jge 0x403e19
add eax, 7
mov dword [esi + 0x58], eax
push ebx
lea eax, [esp + 0x240]
push eax
push 0x154
push 0x29
mov dword [esp + 0x24c], 0x154
call ebp
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
push eax
lea ecx, [esi + 0xb0]
call fcn.0046b92a
mov edi, dword [0x493198]
cmp edi, ebx
mov word [esp + 0x10], 0x300
mov word [esp + 0x12], di
pop ebp
jle 0x403e8f
mov ecx, 0x4908f8
lea eax, [esp + 0x11]
mov dl, byte [ecx]
mov byte [eax - 1], dl
mov dl, byte [ecx + 1]
mov byte [eax], dl
mov dl, byte [ecx + 2]
mov byte [eax + 1], dl
mov byte [eax + 2], bl
add ecx, 0x104
add eax, 4
dec edi
jne 0x403e70
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.gdi32.dll_CreatePalette]
push eax
lea ecx, [esi + 0xb8]
call fcn.0046b92a
mov ecx, dword [esp + 0x38c]
pop edi
pop esi
pop ebx
call fcn.00410507
add esp, 0x384
ret
Function at 0x404f30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x471eb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.user32.dll_ReleaseCapture]
mov eax, dword [esp + 0xfc]
cmp eax, 0x7ed
je 0x4050fc
cmp dword [esi + 0x60], 0xfffffffe
jne 0x4050f5
mov eax, dword [esi + 0xc0]
push ebx
push ebp
push edi
push esi
push 0x102
push eax
lea ecx, [esp + 0x70]
mov dword [esi + 0x138], 1
call fcn.00462ba1
xor ebp, ebp
mov dword [esp + 0x100], ebp
call fcn.004684ee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov edi, dword [esi + 0x15c]
mov dword [esp + 0x1c], 4
mov eax, dword [edi - 0xc]
test eax, eax
mov byte [esp + 0x100], 1
je 0x404fe2
call fcn.0046eb29
mov eax, dword [eax + 4]
push edi
mov ecx, eax
call fcn.0046ee8d
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x405026
push edi
lea eax, [esp + 0x14]
push str.CUSTOM_COLOR__d
push eax
call fcn.00404ed0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x405026
mov ecx, dword [esp + 0x18]
mov dword [esp + edi*4 + 0x24], ecx
jmp 0x40502e
mov dword [esp + edi*4 + 0x24], 0xffffff
inc edi
cmp edi, 0x10
jl 0x404fe4
lea edx, [esp + 0x24]
lea ecx, [esp + 0x64]
mov dword [esp + 0xe4], edx
call fcn.00462b29
cmp eax, 1
jne 0x40505c
mov eax, dword [esp + 0xe0]
mov dword [esi + 0xc4], eax
jmp 0x405067
mov dword [esp + 0x108], 0x7ed
test ebp, ebp
je 0x4050ab
xor esi, esi
lea edi, [esp + 0x24]
push esi
lea ecx, [esp + 0x14]
push str.CUSTOM_COLOR__d
push ecx
call fcn.00404ed0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push 4
push edi
push 4
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegSetValueExA]
inc esi
add edi, 4
cmp esi, 0x10
jl 0x405071
push ebp
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
add ebx, 0xfffffff0
mov dword [esi + 0x138], 0
mov byte [esp + 0x100], 0
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4050d7
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
lea ecx, [esp + 0x64]
mov dword [esp + 0x100], 0xffffffff
call fcn.00468761
mov eax, dword [esp + 0x108]
pop edi
pop ebp
pop ebx
cmp eax, 0x7ed
jne 0x405108
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0xc4], ecx
mov edx, dword [esi + 0xc4]
push 0
push edx
push eax
mov eax, dword [esi + 0x134]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x405133
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0xec]
pop esi
mov dword fs:[0], ecx
add esp, 0xf4
ret 4
Function at 0x4062a0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x471fd5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
mov eax, dword [0x493ea0]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 8], esi
call fcn.004652b4
xor ebx, ebx
push 0xc
mov dword [esp + 0xb0], ebx
mov dword [esi], 0x474c18
mov dword [esi + 0x50], 0xff000000
call dword [sym.imp.user32.dll_GetSysColor]
push str.Automatic
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], eax
call fcn.004061f0
push str.More_Colors...
lea ecx, [esi + 0x5c]
mov byte [esp + 0xb0], 1
call fcn.004061f0
push 0x474f1c
lea ecx, [esi + 0x78]
mov byte [esp + 0xb0], 2
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.004061f0
push 0x474f1a
lea ecx, [esi + 0x7c]
mov byte [esp + 0xb0], 3
call fcn.004061f0
lea ecx, [esi + 0x80]
mov byte [esp + 0xac], 4
call fcn.0040ed60
lea ecx, [esi + 0x84]
mov byte [esp + 0xac], 5
call fcn.0040ed60
lea ecx, [esi + 0x88]
mov byte [esp + 0xac], 6
call fcn.0040ed60
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x4063b9
mov eax, dword [esp + 0x10]
cmp eax, 5
ja 0x4063b5
jne 0x4063b9
cmp dword [esp + 0x14], 1
jb 0x4063b9
mov cl, 1
jmp 0x4063bb
xor cl, cl
cmp cl, bl
lea eax, [esi + 0x6c]
mov dword [eax], ebx
je 0x4063d2
push ebx
push eax
push ebx
push 0x1022
call dword [sym.imp.user32.dll_SystemParametersInfoA]
mov ecx, dword [esp + 0xa4]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x9c]
pop ebx
call fcn.00410507
add esp, 0xa8
ret