joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404501
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 4], 0x80070057
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4045d9
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x3c], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebx + 0x3c]
lea edi, [ebx + 0x40]
push edi
push 0x406318
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
mov dword [ebp - 4], eax
jl 0x4045d9
mov esi, ebx
lea eax, [ebx + 4]
neg esi
sbb esi, esi
and esi, eax
push esi
mov eax, dword [esi]
call dword [eax + 4]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov eax, dword [edi]
lea edx, [ebp + 8]
lea edi, [ebx + 0x18]
push edx
mov ecx, dword [eax]
push edi
push esi
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp eax, dword [ebp + 0x10]
jae 0x40458f
mov dword [ebp - 4], 0x80004005
cmp dword [ebp - 4], 0
jl 0x4045d9
mov edi, dword [edi]
test edi, edi
je 0x40467f
mov eax, 0x2004
cmp dword [ebp + 8], eax
jae 0x4045ac
mov dword [ebp + 8], eax
test edi, edi
je 0x40467f
push 0x38
call fcn.00404cfe
test eax, eax
pop ecx
je 0x4045c9
mov ecx, eax
call fcn.0040329b
jmp 0x4045cb
xor eax, eax
test eax, eax
mov dword [ebx + 0x38], eax
jne 0x404629
mov dword [ebp - 4], 0x8007000e
mov eax, dword [ebx + 0x40]
xor esi, esi
cmp eax, esi
je 0x4045eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x40], esi
mov ecx, dword [ebx + 0x38]
cmp ecx, esi
je 0x4045fb
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0x38], esi
mov eax, dword [ebx + 0x1c]
cmp eax, esi
je 0x40460c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x1c], esi
mov eax, dword [ebx + 0x3c]
cmp eax, esi
je 0x40461c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x64], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov edx, dword [eax]
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 4]
test eax, eax
mov dword [ebp - 4], eax
jl 0x4045d9
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor esi, esi
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x1c], eax
jne 0x404654
mov dword [ebx + 0x18], esi
jmp 0x40467f
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x20], eax
je 0x40464f
lea eax, [ebx + 0x14]
push eax
push esi
push ebx
push 0x4049a6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebx + 0x10], eax
jne 0x40467f
and dword [ebx + 0x18], 0
mov eax, dword [ebp + 0x14]
push ebx
mov dword [eax], ebx
mov eax, dword [ebx]
call dword [eax + 4]
mov ebx, dword [ebx + 0x64]
test ebx, ebx
je 0x40461f
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
jmp 0x40461f
Function at 0x4012a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4012b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4012f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4012f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4012f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4012e0
cmp esi, eax
jb 0x4012fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402040
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x44b6d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
call fcn.00411416
test eax, eax
jne 0x40206f
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov edi, eax
add edi, 0x10
call fcn.00411416
test eax, eax
jne 0x402091
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
push ebx
mov ecx, eax
mov eax, dword [edx + 0xc]
push esi
call eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWARESAMSUNGdmhkcoreSettings
mov esi, eax
push SysReAllocString
add esi, 0x10
call ebx
test eax, eax
je 0x4020d1
lea edx, [esp + 0x10]
push edx
push str.SOFTWARESAMSUNGDisplayManagerSettings
push SysReAllocString
call ebx
test eax, eax
jne 0x40211d
push 0x100
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00425490
mov ecx, dword [esp + 0x1c]
mov dl, byte [esp + 0x12c]
add esp, 0xc
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push ebp
push ecx
mov byte [esp + 0x2c], dl
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40211d
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40212d
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402139
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402155
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x114]
pop esi
pop ebx
pop edi
pop ebp
xor ecx, esp
call fcn.00424e42
add esp, 0x108
ret
Function at 0x402170
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4385e6
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x44b6d0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44b6d0]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x138]
mov ebp, dword [esp + 0x13c]
call fcn.00411416
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4021d3
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x130], 0
call fcn.00411416
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402208
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x18]
push ecx
push str.SOFTWARESAMSUNGdmhkcoreSettings
push SysReAllocString
mov byte [esp + 0x13c], 1
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
je 0x402272
lea edx, [esp + 0x18]
push edx
push str.SOFTWARESAMSUNGDisplayManagerSettings
push SysReAllocString
call edi
test eax, eax
je 0x402272
lea eax, [esi - 0x10]
mov byte [esp + 0x130], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4022c6
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4022a6
mov edi, dword [esp + 0x140]
push edi
push ebx
call fcn.00402040
add esp, 8
mov dword [ebp], edi
jmp 0x402258
movzx ecx, byte [esp + 0x24]
lea eax, [esi - 0x10]
mov dword [ebp], ecx
mov byte [esp + 0x130], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4022d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4022fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00424e42
add esp, 0x120
ret
Function at 0x402330
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x44b6d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
call fcn.00411416
test eax, eax
jne 0x40235f
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov edi, eax
add edi, 0x10
call fcn.00411416
test eax, eax
jne 0x402381
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
push ebx
mov ecx, eax
mov eax, dword [edx + 0xc]
push esi
call eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWARESAMSUNGdmhkcoreSettings
mov esi, eax
push SysReAllocString
add esi, 0x10
call ebx
test eax, eax
je 0x402405
lea edx, [esp + 0x10]
push edx
push str.SOFTWARESAMSUNGDisplayManagerSettings
push SysReAllocString
call ebx
test eax, eax
je 0x402405
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4023dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4023f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x120]
add eax, 0xfffffff0
jmp 0x402476
mov ebx, dword [esp + 0x120]
push ebx
lea ecx, [esp + 0x18]
push 0x43bc78
push ecx
call fcn.0042550a
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0x100
lea edx, [esp + 0x18]
push edx
push 1
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or edx, 0xffffffff
test eax, eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402457
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402473
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40248f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x114]
pop esi
pop ebx
pop edi
pop ebp
xor ecx, esp
call fcn.00424e42
add esp, 0x108
ret
Function at 0x402f20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x438726
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x44b6d0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44b6d0]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x13c]
mov edi, dword [esp + 0x140]
call fcn.00411416
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402f83
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x134], 0
call fcn.00411416
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402fb8
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x18]
push ecx
push str.SOFTWARESAMSUNGdmhkcoreSettings
push SysReAllocString
mov byte [esp + 0x140], 1
mov dword [esp + 0x28], 0x100
call ebp
test eax, eax
je 0x403022
lea edx, [esp + 0x18]
push edx
push str.SOFTWARESAMSUNGDisplayManagerSettings
push SysReAllocString
call ebp
test eax, eax
je 0x403022
lea eax, [esi - 0x10]
mov byte [esp + 0x134], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40309f
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403074
push 4
push str.1_31
mov ecx, edi
call fcn.00402580
mov eax, dword [edi]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov ebp, esp
push eax
call fcn.00401ec0
add esp, 4
add eax, 0x10
push ebx
mov dword [ebp], eax
call fcn.00402330
add esp, 8
jmp 0x403008
lea ecx, [esp + 0x28]
push ecx
push 0x43bc78
push edi
call fcn.004028c0
lea eax, [esi - 0x10]
add esp, 0xc
mov byte [esp + 0x134], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4030ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x134], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00424e42
add esp, 0x124
ret
Function at 0x4092e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40932a
call fcn.00410adf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40932a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40936d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x409356
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x409356
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40936a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40f064
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40f0a7
call fcn.00410adf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f0a7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40f0c2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040ec1b
test ebx, ebx
mov esi, eax
je 0x40f0c0
test edi, edi
je 0x40f0c0
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x416264
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x416292
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4162b0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004161ce
jmp 0x4162b0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4162b0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004161ce
test edi, edi
mov eax, edi
jne 0x41629a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44e69c]
test ecx, ecx
je 0x416373
jmp 0x416263
ret 8

Function at 0x424e42
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b6d0]
jne 0x424e4c
repz ret
jmp fcn.0042ab0c
Function at 0x4333f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042a555
xor ebx, ebx
cmp dword [0x44f44c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4334c5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x433430
xor eax, eax
jmp 0x433589
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4413c4
push edi
call esi
cmp eax, ebx
je 0x433429
push eax
call fcn.0042a4f2
mov dword [esp], 0x4413b4
push edi
mov dword [0x44f44c], eax
call esi
push eax
call fcn.0042a4f2
mov dword [esp], 0x4413a0
push edi
mov dword [0x44f450], eax
call esi
push eax
call fcn.0042a4f2
mov dword [0x44f454], eax
lea eax, [ebp - 8]
push eax
call fcn.00425669
test eax, eax
pop ecx
pop ecx
je 0x433493
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042b6d2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4334c5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042a4f2
cmp eax, ebx
pop ecx
mov dword [0x44f45c], eax
je 0x4334c5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042a4f2
pop ecx
mov dword [0x44f458], eax
mov eax, dword [0x44f458]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x43353e
cmp dword [0x44f45c], esi
je 0x43353e
push eax
call fcn.0042a55e
pop ecx
call eax
cmp eax, ebx
je 0x43350b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x44f45c]
call fcn.0042a55e
pop ecx
call eax
test eax, eax
je 0x43350b
test byte [ebp - 0x18], 1
jne 0x43353e
lea eax, [ebp - 0xc]
push eax
call fcn.004256a0
test eax, eax
pop ecx
je 0x433526
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042b6d2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x433535
or dword [ebp + 0x10], 0x200000
jmp 0x43356f
or dword [ebp + 0x10], 0x40000
jmp 0x43356f
mov eax, dword [0x44f450]
cmp eax, esi
je 0x43356f
push eax
call fcn.0042a55e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43356f
mov eax, dword [0x44f454]
cmp eax, esi
je 0x43356f
push dword [ebp - 4]
push eax
call fcn.0042a55e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44f44c]
call fcn.0042a55e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x437fac
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44b6d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00437f41
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00425490
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x437ffb
cmp dword [ebp - 0x1c], 5
jb 0x438013
jmp 0x43800f
cmp dword [ebp - 0x10], 1
jne 0x438013
cmp dword [ebp - 0x1c], 4
ja 0x43800f
jne 0x438013
cmp dword [ebp - 0x18], 0
jbe 0x438013
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x441bc8
call fcn.00437e15
test eax, eax
jge 0x438034
mov byte [0x44cb68], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00424e42
add ebp, 0x78
leave
ret
Function at 0x402c80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
push 0x11
push edi
call fcn.00402c50
mov ebp, dword [esp + 0x120]
add esp, 8
push eax
push ebp
push edi
call fcn.00403410
add esp, 0xc
test eax, eax
je 0x402cc2
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push str.mmates.ini
lea eax, [esp + 0x14]
push 0x104
push eax
push str._DEFAULT
push str.browser
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str._DEFAULT
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402d17
test cl, cl
je 0x402d13
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402d17
add eax, 2
add esi, 2
test cl, cl
jne 0x402cef
xor eax, eax
jmp 0x402d1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402d51
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov ecx, dword [esp + 0x120]
push ecx
push edi
push ebp
call fcn.00402ae0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x403240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
lea ebp, [ebx + 0x30c]
push eax
push ebp
push ecx
push 0x80000000
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4033fa
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x18
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x124]
push esi
call fcn.00402c50
add esp, 8
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push ebx
push eax
push 0x80000000
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4033fa
push ebx
call fcn.00416c40
add esp, 4
push 0x15
push esi
call fcn.00402c50
add esp, 8
push eax
push ebx
call fcn.004108d0
mov byte [eax + 4], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x16
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x18], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
push ecx
call fcn.00402c50
add esp, 8
lea edx, [esp + 0x18]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x104]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x80000000
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4033fa
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
push ecx
call fcn.00402c50
add esp, 8
lea edx, [esp + 0x18]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x208]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x80000000
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4033fa
mov eax, 1
mov word [ebx + 0x410], ax
mov word [ebx + 0x412], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x404340
Capabilities:
Read .ini file

Disassembly:
call fcn.00405130
push eax
push str.Custom_d
push 0x41fda8
call fcn.00410860
add esp, 0xc
push str.DeskToppers.ini
push 0x27
push 0x41f980
push str.Fred
push str.TypeName
push 0x41fda8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret