joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407fe0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x23c]
xor ebp, ebp
push edi
test esi, esi
je 0x40807e
push esi
or ebp, 0xffffffff
call dword [sym.imp.MSVCRT.dll_rewind]
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x248]
add esp, 4
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
test ebx, ebx
jle 0x408047
push esi
lea eax, [esp + 0x14]
push 0x22b
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
je 0x40808d
inc edi
cmp edi, ebx
jl 0x40802a
mov edi, dword [sym.imp.MSVCRT.dll_fgetc]
mov bl, 0x10
push esi
call edi
add esp, 4
cmp eax, 0xffffffff
je 0x408074
xor eax, ebp
and eax, 0xff
shr ebp, 8
mov ecx, dword [eax*4 + 0x5743b0]
mov al, byte [esi + 0xc]
xor ebp, ecx
test bl, al
je 0x40804f
push esi
call dword [sym.imp.MSVCRT.dll_rewind]
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
not eax
pop ebx
add esp, 0x22c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret

Function at 0x408a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54abc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x5585f8
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.00547fe6
mov dword [ebx], 0x5585e4
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.00547fe6
or eax, 0xffffffff
push 0x5c5668
mov dword [ebx], 0x5585a8
push edi
mov dword [esi], 0x5585bc
mov dword [esi + 0x4c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0xc0c0c0
mov dword [esi + 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x50], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40ade0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54adfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x558690
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x40ae70
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x40ae37
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x40ae61
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40ae76
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40ae76
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x558628
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x558614
mov dword [esp + 0x1c], 0xffffffff
call fcn.005480e2
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40dae0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x54b210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], 0x558650
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], edi
push eax
push edi
push edi
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x40db4d
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
lea edx, [esp + 0x20]
mov ecx, esi
lea eax, [ebp + 2]
push eax
push edi
push edx
call sub.MFC42.DLL_CDC::MoveTo
mov edx, dword [esp + 0x10]
mov ebx, ebp
sub ebx, edx
mov ecx, esi
lea eax, [ebx + 5]
push eax
push edi
mov dword [esp + 0x40], eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 3]
lea ecx, [edi + 1]
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [ebx + 6]
mov ecx, esi
mov dword [esp + 0x44], eax
push eax
lea eax, [edi + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [ebp + 4]
lea eax, [edi + 2]
push ecx
lea edx, [esp + 0x24]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [ebx + 7]
mov ecx, esi
push eax
lea eax, [edi + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 3]
lea ecx, [edi + 3]
push eax
push ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov edx, dword [esp + 0x44]
lea eax, [edi + 3]
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 2]
lea ecx, [edi + 4]
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov ecx, dword [esp + 0x38]
lea eax, [edi + 4]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
lea edx, [ebp + 1]
lea eax, [edi + 5]
push edx
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea ecx, [ebx + 4]
lea eax, [edi + 5]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
add edi, 6
push ebp
lea edx, [esp + 0x24]
push edi
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
add ebx, 3
mov ecx, esi
push ebx
push edi
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esp + 0x14]
mov ecx, esi
push eax
call sub.MFC42.DLL_CDC::SelectObject
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x18], 0x558628
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x14
Function at 0x40f340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x54b3f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0x558664
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00408ba0
test eax, eax
je 0x40f39e
push 0xf
jmp 0x40f3a0
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x40f3c1
push 0x3fe33333
push 0x33333333
push eax
call fcn.00409b80
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
call fcn.00408b90
test eax, eax
je 0x40f419
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x40f43f
push 0
push 7
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.0040dae0
jmp 0x40f459
push 7
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.0040d9c0
mov dword [esp + 0x10], 0x558628
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x40fbc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
and esi, 0xffff
push 2
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40fbfd
xor ebx, ebx
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40fbfd
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40fc0e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x40fc1e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.0040fb50
add esp, 4
cmp ax, 0x10
je 0x40fc34
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push edi
push ebx
call sub.MFC42.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4111c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x5c568c]
sub esp, 0x134
test eax, eax
jne 0x411295
lea eax, [esp]
mov dword [0x5c568c], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411295
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411288
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x411288
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x411288
mov dword [0x5c5688], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x5c5688]
add esp, 0x134
ret

Function at 0x415700
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54b917
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
lea eax, [esp + 0x18]
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esi, 0x9c
lea ecx, [esp + 0x10]
push esi
call sub.MFC42.DLL_CString::CString_2
mov esi, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x124], 0
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push 0x577438
lea edx, [esp + 0xc]
push eax
push edx
mov byte [esp + 0x130], 1
call sub.MFC42.DLL_operator_3
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x12c], 2
push eax
call sub.MFC42.DLL_operator
push str.101162.ini
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x130], 3
call sub.MFC42.DLL_operator_3
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x124], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], 5
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x418530
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x54bc2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x294
push ebx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 0x108]
xor ebx, ebx
push eax
push 2
mov dword [esp + 0x2a8], ebx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x4185c6
lea ecx, [esp + 8]
push 0xff
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x4185c0
lea edx, [esp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
je 0x4185c0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x2a8]
lea eax, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator
mov bl, 1
call dword [sym.imp.WSOCK32.dll_WSACleanup]
lea ecx, [esp + 4]
mov dword [esp + 0x2a0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x298]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x2a0
ret

Function at 0x418600
Capabilities:
Get hostname

Disassembly:
push ecx
push ebx
push esi
push 0x10
mov dword [esp + 0xc], 0x10
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
lea eax, [esp + 8]
xor bl, bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x41863c
mov ecx, dword [esp + 8]
push esi
mov byte [esi + ecx], bl
mov ecx, dword [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov bl, 1
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, bl
pop esi
pop ebx
pop ecx
ret
Function at 0x418b80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [esp + 0x120]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 4], ebx
jne 0x418bad
lea eax, [esp + 4]
push eax
push 0x20019
push ebx
push str.SoftwareRocscienceDips
jmp 0x418c98
cmp eax, 1
jne 0x418bc7
lea ecx, [esp + 4]
push ecx
push 0x20019
push ebx
push str.SoftwareRocscienceExamine3D
jmp 0x418c98
cmp eax, 2
jne 0x418be1
lea edx, [esp + 4]
push edx
push 0x20019
push ebx
push str.SoftwareRocsciencePhase2_5.0
jmp 0x418c98
cmp eax, 3
jne 0x418bfb
lea eax, [esp + 4]
push eax
push 0x20019
push ebx
push str.SoftwareRocscienceRocFall
jmp 0x418c98
cmp eax, 4
jne 0x418c15
lea ecx, [esp + 4]
push ecx
push 0x20019
push ebx
push str.SoftwareRocscienceRocPlane_2.0
jmp 0x418c98
cmp eax, 5
jne 0x418c2c
lea edx, [esp + 4]
push edx
push 0x20019
push ebx
push str.SoftwareRocscienceRocSupport
jmp 0x418c98
cmp eax, 6
jne 0x418c43
lea eax, [esp + 4]
push eax
push 0x20019
push ebx
push str.SoftwareRocscienceSlide_5.0
jmp 0x418c98
cmp eax, 7
jne 0x418c5a
lea ecx, [esp + 4]
push ecx
push 0x20019
push ebx
push str.SoftwareRocscienceSwedge
jmp 0x418c98
cmp eax, 8
jne 0x418c71
lea edx, [esp + 4]
push edx
push 0x20019
push ebx
push str.SoftwareRocscienceUnwedge_3.0
jmp 0x418c98
cmp eax, 9
jne 0x418c88
lea eax, [esp + 4]
push eax
push 0x20019
push ebx
push str.SoftwareRocscienceRocData_3.0
jmp 0x418c98
lea ecx, [esp + 4]
push ecx
push 0x20019
push ebx
push str.SoftwareRocscience
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x418d01
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push str.License
push edx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418cf6
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x12c]
mov byte [esp + eax + 0x14], bl
call sub.MFC42.DLL_CString::operator_1
mov bl, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x11c
ret
Function at 0x43d7f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x3c
push esi
push edi
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
xor esi, esi
push eax
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareRocscienceSwedgeSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43d896
mov eax, dword [esp + 0x48]
mov esi, 1
test eax, eax
mov dword [esp + 8], esi
je 0x43d84e
lea edx, [esp + 0x10]
push 0x57dce0
push edx
jmp 0x43d858
lea eax, [esp + 0x10]
push 0x57bd8c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 8]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.DoubleBuffer
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x3c
ret

Function at 0x43d8a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareRocscienceSwedgeSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43d94d
mov eax, dword [esi + 0x368]
mov dword [esp + 0xc], 1
cmp eax, 1
je 0x43d8fb
cmp eax, 2
jne 0x43d942
push eax
lea edx, [esp + 0x18]
push 0x57bb4c
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [esp + 0x10]
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
push ebx
push 0x57dd08
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x43d942
mov ebx, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x43d960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
lea eax, [esp]
push esi
push edi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareRocscienceSwedgeSettings
mov edi, ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43d9fd
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push 0x57dd08
push ecx
mov dword [esp + 0x24], 0x32
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43d9f2
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push 0x57bb4c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x43d9f2
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x43d9e7
cmp eax, 2
jne 0x43d9f2
mov dword [edi + 0x368], eax
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x44
ret
Function at 0x43df60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push str.SoftwareRocscienceSwedgeSettings
push 0x80000001
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43dfee
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.DoubleBuffer
push ecx
mov dword [esp + 0x20], 0x32
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43dfe3
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0x57bb4c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, esi
jne 0x43dfe3
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x44
ret
Function at 0x445090
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54cda2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov ebx, ecx
push eax
push 0xab
mov dword [esp + 0x14], ebx
call fcn.004ec100
lea edi, [ebx + 0xdc]
xor esi, esi
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.0054825c
mov dword [edi], 0x558ca4
lea edi, [ebx + 0x11c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.0054825c
mov dword [edi], 0x558be4
lea edi, [ebx + 0x15c]
mov byte [esp + 0x18], 2
mov ecx, edi
call fcn.0054825c
mov dword [edi], 0x558be4
lea edi, [ebx + 0x19c]
mov byte [esp + 0x18], 3
mov ecx, edi
call fcn.0054825c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [edi], 0x558be4
lea edi, [ebx + 0x228]
lea edx, [eax + eax*2]
mov dword [edi + 0x50], esi
mov dword [edi + 0x48], esi
mov dword [edi + 0x40], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x10], esi
mov dword [edi + 8], esi
mov dword [edi], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x4c], esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x34], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x24], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0xc], esi
mov byte [edi + 0x58], 0
mov dword [ebx + 0x1e0], esi
mov dword [ebx + 0x1e8], esi
mov dword [ebx + 0x1f0], esi
mov dword [ebx + 0x1f8], esi
mov dword [ebx + 0x200], esi
mov dword [ebx + 0x210], esi
mov dword [ebx], 0x558b0c
mov dword [ebx + 0x60], 0x558b08
mov dword [ebx + 0x1e4], esi
mov dword [ebx + 0x1ec], esi
mov dword [ebx + 0x1f4], esi
mov dword [ebx + 0x1fc], esi
mov dword [ebx + 0x204], esi
mov dword [ebx + 0x208], 0xffffffff
mov dword [ebx + 0x214], esi
mov dword [ebx + 0x218], esi
mov dword [ebx + 0x21c], ecx
mov dword [ebx + 0x220], eax
mov esi, dword [ecx + 0xd64]
shl edx, 5
add esi, edx
mov al, byte [ebp + 0x10]
mov ecx, 0x18
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov byte [ebx + 0x290], al
pop edi
mov dword [ebx + 0x208], 0
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10