joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424c30
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x5972f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
mov ebx, ecx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x60], 1
test eax, eax
mov dword [ebx], 0x5b1484
mov dword [ebx + 4], eax
je 0x424ddf
mov eax, dword [esp + 0x6c]
push 0x61810c
push eax
call fcn.0053d34d
add esp, 8
test eax, eax
jne 0x424c9c
mov ecx, dword [esp + 0x70]
push 0x61810c
push ecx
call fcn.0053d34d
add esp, 8
test eax, eax
je 0x424ddf
push esi
push edi
lea edx, [esp + 0x74]
push 0x5c
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0056a336
lea ecx, [esp + 0x78]
lea edx, [esp + 0x70]
push ecx
push eax
push edx
mov byte [esp + 0x74], 2
call fcn.00575e04
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 4
call fcn.00575bd5
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00424e20
add esp, 0xc
mov esi, dword [eax]
mov byte [esp + 0x68], 5
call fcn.0058ec69
mov eax, dword [eax + 4]
push 0
push str.Bars
push esi
mov ecx, eax
call fcn.0058f93a
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x68], 4
call fcn.00575bd5
lea ecx, [esp + 0x18]
call fcn.005825cd
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x6c], 6
call fcn.005827e7
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.00424f20
test eax, eax
jne 0x424dc1
push ebp
call fcn.0058ec69
mov ecx, dword [eax + 4]
call fcn.0058f860
mov ebp, eax
test ebp, ebp
je 0x424db9
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00424e20
mov eax, dword [eax]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
push eax
push ebp
call ebx
lea ecx, [esp + 0x14]
call fcn.00575bd5
xor esi, esi
test edi, edi
jle 0x424db5
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
push esi
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00424e80
mov eax, dword [eax]
add esp, 0x10
push eax
push ebp
call ebx
lea ecx, [esp + 0x14]
call fcn.00575bd5
inc esi
cmp esi, edi
jl 0x424d89
mov ebx, dword [esp + 0x18]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 4
call fcn.00582660
lea ecx, [esp + 0x70]
mov byte [esp + 0x68], 1
call fcn.00575bd5
pop edi
pop esi
lea ecx, [esp + 0x6c]
mov byte [esp + 0x60], 0
call fcn.00575bd5
lea ecx, [esp + 0x70]
mov dword [esp + 0x60], 0xffffffff
call fcn.00575bd5
mov ecx, dword [esp + 0x58]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
Function at 0x426dd0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x597777
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebp
push esi
push edi
mov edi, ecx
push 0x61810c
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.00575c43
xor esi, esi
mov dword [esp + 0x58], 1
mov si, word [0x61821c]
call fcn.0058ec69
mov eax, dword [eax + 0xc]
push str.BINHELP
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call fcn.0058ec69
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
call fcn.0058ec69
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea esi, [edi + 0x50]
push ebp
push eax
mov ecx, esi
call fcn.0042b9b0
mov al, byte [esp + 0x64]
push 0
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
call fcn.00406080
mov cl, byte [esp + 0x64]
push 0
mov byte [esp + 0x30], cl
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 2
call fcn.00406080
mov edx, dword [esp + 0x64]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x5c], 3
mov dword [esp + 0x40], edx
call fcn.00427390
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x60], 4
call fcn.00427700
mov esi, dword [eax]
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0x5c], 3
call fcn.00406080
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 2
call fcn.00406080
mov eax, dword [esi + 0x14]
mov esi, 0x5af328
test eax, eax
je 0x426ee5
mov esi, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x20]
push ebp
call fcn.00405f60
test al, al
je 0x426f23
mov edi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
mov esi, dword [esp + 0x60]
mov dl, byte [esp + 0x1c]
xor edi, edi
lea ecx, [esp + 0x1c]
mov byte [esi], dl
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [0x5af33c]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00427500
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x426f78
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x426f6f
cmp al, 0xff
je 0x426f6f
dec al
mov byte [ecx], al
jmp 0x426f78
push ecx
call fcn.00570be5
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x58], 0
call fcn.00575bd5
mov ecx, dword [esp + 0x50]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x50
ret 8
Function at 0x42e750
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x598038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x6c]
test eax, eax
jne 0x42e804
mov eax, dword [0x6131b0]
push esi
mov dword [esp + 8], eax
push 0x410
push 0x410
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00576005
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00576054
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.00575fb1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x42e7eb
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x42e7eb
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x6c], eax
mov dword [edi + 0xc8], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00575bd5
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42e820
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x418
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42e882
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x428]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x418
ret
Function at 0x42ea90
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x824
test eax, eax
je 0x42eab5
mov eax, dword [esp + 0x828]
push eax
call fcn.0042ebb0
add esp, 4
add esp, 0x824
ret
lea ecx, [esp + 4]
push edi
push ecx
push str..htm
push SysReAllocStringLen
call fcn.0042e820
add esp, 0xc
test eax, eax
jne 0x42eb7a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 8]
push str._shellopencommand
push edx
call edi
lea eax, [esp + 8]
lea ecx, [esp + 8]
push eax
push ecx
push SysReAllocStringLen
call fcn.0042e820
add esp, 0xc
test eax, eax
jne 0x42eba3
push esi
lea edx, [esp + 0xc]
push str.__1_
push edx
call fcn.0053f012
mov esi, eax
add esp, 8
test esi, esi
jne 0x42eb48
lea eax, [esp + 0xc]
push 0x5fe3e4
push eax
call fcn.0053f012
mov esi, eax
add esp, 8
test esi, esi
jne 0x42eb48
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xb]
jmp 0x42eb4b
mov byte [esi], 0
push 0x5fda9c
push esi
call edi
mov edx, dword [esp + 0x830]
push edx
push esi
call edi
mov eax, dword [esp + 0x834]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop esi
pop edi
add esp, 0x824
ret
mov edx, dword [esp + 0x830]
mov eax, dword [esp + 0x82c]
push edx
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
add esp, 0x824
ret
mov eax, dword [esp + 4]
pop edi
add esp, 0x824
ret

Function at 0x42ebb0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x598088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
push edi
push eax
lea ecx, [esp + 0x24]
call fcn.00575c43
push str.mailto:
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.00575c43
mov byte [esp + 0x18], 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [esp + 8]
push 0x40
mov edi, eax
mov esi, dword [ecx - 8]
lea ecx, [esp + 0x24]
call fcn.005760f6
cmp eax, 0xffffffff
je 0x42ec76
push ebx
lea edx, [esp + 0x10]
push esi
push edx
lea ecx, [esp + 0x2c]
call fcn.0056a8b1
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push eax
call fcn.0053d34d
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00575bd5
test bl, bl
pop ebx
je 0x42ec76
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00575e04
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 2
call fcn.00575d0e
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call fcn.00575bd5
mov edx, dword [esp + 0x20]
push 5
push 0x61810c
push 0
push edx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.00575bd5
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00575bd5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x42ef60
Capabilities:
Check for peb ntglobalflag flag
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x598173
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005763e4
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x5c], ebp
mov eax, dword [0x6131b0]
lea edi, [esi + 0x6c]
mov dword [edi], eax
lea ecx, [esi + 0x70]
mov byte [esp + 0x1c], 2
call fcn.00422890
mov ecx, dword [0x6131b0]
mov dword [esi + 0x108], ecx
mov edx, dword [0x6131b0]
mov dword [esi + 0x10c], edx
lea ebx, [esi + 0x114]
mov byte [esp + 0x1c], 5
mov ecx, ebx
call fcn.00570cfe
mov dword [ebx], vtable.CButton.0
mov ebx, dword [esp + 0x24]
mov ecx, edi
push ebx
mov byte [esp + 0x20], 6
mov dword [esi], method.CHelpTarget_class_CDialog_.virtual_0
mov dword [esi + 0x60], ebp
call fcn.00575d5e
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push edx
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x42f06e
mov ecx, dword [esi + 0x5c]
xor eax, eax
cmp ecx, ebp
je 0x42f02d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x5c], ebp
mov ecx, dword [esp + 0x24]
cmp eax, ebp
mov dword [esi + 0x5c], ecx
jne 0x42f06e
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esi + 0x5c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push ebp
push ebx
push edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42f06e
mov eax, dword [esp + 0x24]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
cmp eax, ebp
je 0x42f081
cmp eax, 2
je 0x42f081
mov eax, 1
jmp 0x42f083
xor eax, eax
mov byte [esi + 0x64], al
mov eax, dword [esp + 0x30]
mov ecx, eax
mov dword [esi + 0x150], ebp
shr ecx, 1
and ecx, 1
and eax, 1
mov dword [esi + 0x68], eax
mov dword [esi + 0x110], ecx
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x42f0d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x598197
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov ebp, ecx
mov dword [esp + 4], 0
mov al, byte [ebp + 0x64]
test al, al
jne 0x42f230
mov eax, dword [ebp + 0x110]
push ebx
mov ebx, dword [esp + 0x1c]
test eax, eax
je 0x42f1a6
push esi
lea esi, [ebp + 0x10c]
push edi
push ebx
mov ecx, esi
call fcn.00575d5e
push 0x5ff4ec
push 0x5fdb10
mov ecx, esi
call fcn.0056a5c8
lea edi, [ebp + 0x108]
push esi
mov ecx, edi
call fcn.00575d0e
push str._br_
push 0x5fdb10
mov ecx, edi
call fcn.0056a5c8
push 0x5fdb10
push str._br_
mov ecx, esi
call fcn.0056a5c8
push 0x5fdb10
mov ecx, esi
call fcn.00575fb1
push 0x3c
mov ecx, esi
call fcn.005760f6
mov edi, eax
test edi, edi
jl 0x42f1a4
push edi
push 0x3e
mov ecx, esi
call fcn.00576104
cmp eax, edi
jle 0x42f195
sub eax, edi
mov ecx, esi
inc eax
push eax
push edi
call fcn.0056a3fa
push 0x3c
mov ecx, esi
call fcn.005760f6
mov edi, eax
test edi, edi
jge 0x42f17b
pop edi
pop esi
push ebp
call fcn.005715f8
mov eax, dword [ebp + 0x110]
test eax, eax
je 0x42f1be
lea eax, [ebp + 0x10c]
jmp 0x42f1d8
push ebx
lea ecx, [esp + 0x20]
call fcn.00575c43
mov dword [esp + 8], 1
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push 1
push eax
call fcn.0057e45c
mov dword [ebp + 0x60], eax
mov al, byte [esp + 8]
test al, 1
mov dword [esp + 0x14], 0xffffffff
pop ebx
je 0x42f204
lea ecx, [esp + 0x18]
call fcn.00575bd5
mov al, byte [ebp + 0x64]
test al, al
mov eax, dword [ebp + 0x60]
je 0x42f233
cmp eax, 2
je 0x42f230
mov ecx, dword [ebp + 0x5c]
lea edx, [esp + 0x20]
push 4
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x6c]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0x60]
mov ecx, dword [esp + 8]
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4382d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59898b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
mov eax, dword [0x5b3680]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x3c], 0x5b367c
mov dword [esp + 0x78], vtable.CSerializable.0
mov dword [esp + eax + 0x3c], vtable.CMatrix_double_.0
mov ecx, dword [esp + 0x3c]
xor ebx, ebx
push edi
mov eax, dword [ecx + 4]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
lea edx, [eax - 0x3c]
mov dword [esp + eax + 0x3c], edx
xor edx, edx
movsx ecx, dx
xor eax, eax
lea ecx, [ecx + ecx*2]
movsx edi, ax
add edi, ecx
inc eax
cmp eax, 3
mov dword [esp + edi*8 + 0x48], ebx
mov dword [esp + edi*8 + 0x4c], ebx
jl 0x438335
inc edx
cmp edx, 2
jl 0x43832d
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x3ff00000
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x3ff00000
mov eax, dword [esi]
lea ecx, [esp + 0xc0]
push ecx
mov ecx, esi
mov dword [esp + 0xec], ebx
call dword [eax + 0x28]
mov edi, dword [ebp + 8]
mov esi, eax
fld qword [esi + 8]
fld qword [esi]
fld qword [edi + 8]
fld qword [edi]
fst qword [esp + 0x34]
fstp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
fstp qword [esp + 0x18]
fld qword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
fsub st(1)
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
fstp qword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
fstp st(0)
fld qword [esp + 0x28]
fsub st(1)
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push ecx
lea ecx, [esp + 0x44]
fstp qword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
fstp st(0)
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.00440de0
push 1
lea ecx, [esp + 0x84]
call fcn.0043fa10
fld qword [esi + 0x10]
fsub qword [esi]
mov byte [esp + 0xe8], 1
fcom qword [0x5b3130]
fnstsw ax
test ah, 0x40
jne 0x43848e
fld qword [esi + 0x18]
fsub qword [esi + 8]
fcom qword [0x5b3130]
fnstsw ax
test ah, 0x40
jne 0x43848c
fld qword [edi + 0x18]
fsub qword [edi + 8]
sub esp, 8
lea edx, [esp + 0x18]
sub esp, 8
mov ecx, esi
fdiv st(1)
fstp qword [esp + 8]
fstp st(0)
fld qword [edi + 0x10]
fsub qword [edi]
fdiv st(1)
fstp qword [esp]
push edx
fstp st(0)
call fcn.0043f9f0
push eax
lea ecx, [esp + 0x94]
call fcn.00440e40
lea eax, [esp + 0x80]
lea ecx, [esp + 0x40]
push eax
call fcn.00440d70
jmp 0x438490
fstp st(0)
fstp st(0)
lea ecx, [esp + 0x80]
mov byte [esp + 0xe8], bl
call fcn.004385d0
mov esi, dword [esp + 0x30]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x38]
push eax
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x48]
call fcn.00440b10
mov edx, dword [esi]
push eax
mov ecx, esi
mov byte [esp + 0xec], 2
call dword [edx + 0x3c]
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438ca0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x598a03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
mov eax, dword [ecx - 0xa8]
push ebx
lea ebx, [ecx - 0xa8]
push esi
mov dword [esp + 0xc], ecx
push edi
mov ecx, ebx
mov dword [esp + 0xb4], 0
call dword [eax + 0x38]
lea esi, [eax + 8]
mov ecx, 0xc
lea edi, [esp + 0x7c]
mov dword [esp + 0x74], 0x5b367c
mov dword [esp + 0xb0], vtable.CSerializable.0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x5b3680]
xor edi, edi
mov dword [esp + ecx + 0x74], vtable.CMatrix_double_.0
mov edx, dword [esp + 0x74]
mov eax, dword [edx + 4]
mov dword [esp + eax + 0x70], edi
lea ecx, [esp + 0x74]
push 1
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc8], edi
call fcn.00438ee0
fld qword [esp + 0x54]
fchs
fstp qword [esp + 0x94]
fld qword [esp + 0x44]
fchs
fstp qword [esp + 0x84]
fld qword [esp + 0x64]
fmul qword [esp + 0x44]
fld qword [esp + 0x4c]
fmul qword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
fsubp st(1)
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x40]
mov byte [esp + 0xc0], 1
mov dword [esp + 0x9c], ecx
fstp qword [esp + 0x8c]
fld qword [esp + 0x64]
fmul qword [esp + 0x3c]
fld qword [esp + 0x4c]
fmul qword [esp + 0x54]
mov dword [esp + 0xa0], edx
fsubp st(1)
fchs
fstp qword [esp + 0xa4]
fld qword [esp + 0x44]
fmul qword [esp + 0x94]
fld qword [esp + 0x3c]
fmul qword [esp + 0x5c]
faddp st(1)
fcom qword [0x5b3130]
fnstsw ax
test ah, 0x40
je 0x438df1
lea eax, [esp + 0x10]
push 0x5dedf8
push eax
mov dword [esp + 0x18], vtable.CNumericException.0
fstp st(0)
call fcn.0053e275
xor esi, esi
movsx ecx, si
xor eax, eax
lea edx, [ecx + ecx*2]
movsx ecx, ax
add ecx, edx
inc eax
cmp eax, 3
fld qword [esp + ecx*8 + 0x7c]
lea ecx, [esp + ecx*8 + 0x7c]
fdiv st(1)
fstp qword [ecx]
jl 0x438dfb
inc esi
cmp esi, 2
jl 0x438df3
lea ecx, [esp + 0x34]
mov byte [esp + 0xc0], 0
fstp st(0)
call fcn.004385d0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x1c], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x20], ecx
push edx
lea ecx, [esp + 0x78]
call fcn.00440c10
fld qword [esp + 0x1c]
fadd qword [0x5af430]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub esp, 8
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
fstp qword [esp]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.0053e2af
call fcn.0053e380
fld qword [esp + 0x2c]
fadd qword [0x5af430]
mov esi, eax
fstp qword [esp]
call fcn.0053e2af
add esp, 8
call fcn.0053e380
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ebp + 8]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x44]
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x444ac0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x2c]
test eax, eax
jne 0x444ba0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RICHED20
call esi
test eax, eax
je 0x444b8e
lea eax, [esp + 0xc]
push ebx
push eax
push str.RICHED20.DLL
mov dword [esp + 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
push ebx
call fcn.00570bbc
add esp, 4
mov esi, eax
push esi
push ebx
push 0
push str.RICHED20.DLL
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x18]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x14]
push esi
movsx edx, byte [ecx]
sub edx, 0x30
mov dword [edi + 0x2c], edx
call fcn.00570be5
mov eax, dword [edi + 0x2c]
add esp, 4
pop ebx
pop edi
pop esi
add esp, 0x110
ret
push str.RICHED32
call esi
test eax, eax
je 0x444ba0
mov dword [edi + 0x2c], 1
mov eax, dword [edi + 0x2c]
pop edi
pop esi
add esp, 0x110
ret

Function at 0x444e30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x599935
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push 0x61810c
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.00575c43
lea eax, [esp + 4]
mov dword [esp + 0x11c], 1
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNCoverEd.exe_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x444ebc
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
lea ecx, [esp]
push edx
call fcn.00575d5e
push esi
mov esi, dword [esp + 0x128]
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.0057594a
mov dword [esp + 0x10], 1
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call fcn.00575bd5
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 4