joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405260
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x4053c4
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x4052fb
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x405335
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x40536f
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], 1
je 0x4053c0
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5bbd64]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x405400
test byte [0x5bbc68], 8
mov ecx, 0x11
mov esi, 0x5bbc50
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x40541e
lea edi, [esp + 0x20]
mov dword [esp + 0x30], 1
call fcn.004f94b0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundEnumerateW
jmp 0x405400
Function at 0x405430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x405598
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x4054cf
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x405509
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x405547
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x405594
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5bbd64]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4055dd
mov al, byte [0x5bbc68]
test al, 4
mov ecx, 0x11
mov esi, 0x5bbc50
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4055fb
mov ecx, 1
test cl, al
mov dword [esp + 0x2c], ecx
je 0x4055d2
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.004f94b0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundEnumerateW
jmp 0x4055dd
Function at 0x405610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x405776
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov eax, 1
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x4056b5
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
mov eax, 1
cmp esi, 0xffffffff
mov dword [esp + 0x6c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x4056eb
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x405725
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x405772
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5bbd64]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4057bb
mov al, byte [0x5bbc68]
test al, 2
mov ecx, 0x11
mov esi, 0x5bbc50
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4057d9
mov ecx, 1
test cl, al
mov dword [esp + 0x28], ecx
je 0x4057b0
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.004f94b0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
test al, 1
je 0x4057e7
mov dword [esp + 0x24], 1
jmp 0x4057b0
mov eax, DirectSoundEnumerateW
jmp 0x4057bb
Function at 0x4136f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x547678
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x58]
push 2
push 2
push 0x19
push 0x20
push 0x20
add ecx, 0x248
call fcn.005076c7
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
xor esi, esi
push 0x5b6d24
mov dword [esp + 0x18], vtable.ATL::CImage.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call edi
add dword [0x5b6d3c], 1
push 0x5b6d24
call ebp
mov dword [esp + 0x14], vtable.CImageEx.0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ebx
call fcn.00503137
mov ecx, dword [esi + 0x5ae4f0]
mov eax, dword [eax + 8]
push 1
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0046c310
mov eax, dword [esp + 0x18]
push eax
call fcn.00503f21
cmp eax, ebx
jne 0x4137ce
xor eax, eax
jmp 0x4137d1
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x58]
mov ecx, dword [ecx + 0x24c]
push 0xffffff
push eax
push ecx
call fcn.00503137
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.00416bf0
or ecx, 0xffffffff
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x14], vtable.ATL::CImage.0
je 0x413833
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ecx
mov byte [esp + 0x35], bl
mov byte [esp + 0x34], bl
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x5b6d24
call edi
sub dword [0x5b6d3c], 1
jne 0x413866
push 0x5b6d24
call edi
mov eax, dword [0x5b6d20]
cmp eax, ebx
je 0x413859
push eax
call sub.gdiplus.dll_GdiplusShutdown
push 0x5b6d24
mov dword [0x5b6d20], ebx
call ebp
push 0x5b6d24
call ebp
add esi, 0x10
cmp esi, 0x60
jb 0x413740
mov eax, 1
mov dword [0x5b6e9c], eax
mov dword [0x5ae4cc], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x414040
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5447cb
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
xor esi, esi
push 0x3fe
lea eax, [esp + 0x1a]
push esi
push eax
mov word [esp + 0x20], si
call fcn.00523750
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41414d
mov word [esp + 0x21a], si
call fcn.00505193
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4140cd
push 0x80004005
call fcn.00402900
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push str.SoundRecorder.exe
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push str._s_s
push edx
mov dword [esp + 0x430], esi
call fcn.00402c70
mov esi, dword [esp + 0x1c]
add esp, 0xc
add esi, 0xfffffff0
mov dword [esp + 0x14], esp
mov edi, esp
push esi
call fcn.00404600
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00426150
mov edi, eax
add esp, 4
mov dword [esp + 0x420], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414149
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
jmp 0x41414f
xor eax, eax
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0052151a
add esp, 0x418
ret
Function at 0x415cd0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [esp + 0x10], ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
je 0x415dae
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, ebx
jne 0x415d3d
mov edi, dword [esp + 0x18]
push 0x564f30
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push 0x564f30
push 1
push ebx
push str.RTSndMgr.cpl
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x415e55
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0x18]
call fcn.00416a60
lea edx, [esp + 0x18]
push edx
push 0x2001f
push ebx
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x2c], ebx
call edi
cmp eax, ebx
jne 0x415e39
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x415d85
push ecx
call ebp
cmp eax, ebx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], edi
jne 0x415e39
push str.RTSndMgr.cpl
lea eax, [esp + 0x14]
push eax
mov esi, 0x564f30
call fcn.00416ab0
jmp 0x415e55
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, ebx
jne 0x415ddb
mov edi, dword [esp + 0x18]
push str.RTSndMgr.cpl
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x415e55
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0x18]
call fcn.00416a60
lea edx, [esp + 0x18]
push edx
push 0x2001f
push ebx
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x2c], ebx
call edi
cmp eax, ebx
jne 0x415e39
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x415e1f
push ecx
call ebp
cmp eax, ebx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], edi
jne 0x415e39
push str.RTSndMgr.cpl
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x415e55
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov edx, 0x20006
lea esi, [esp + 0x18]
call fcn.00416a60
mov edi, dword [esp + 0x10]
cmp edi, ebx
je 0x415e5c
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 4
Function at 0x416b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416bae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x416b7f
cmp eax, 2
jne 0x416b9a
test esi, esi
mov eax, dword [esp]
je 0x416ba8
test eax, eax
je 0x416ba3
test al, 1
jne 0x416b9a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x416ba8
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x41ea90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x547400
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x30]
call fcn.0050375a
lea eax, [esp + 0x60]
push eax
xor ebx, ebx
mov dword [esp + 0x84], ebx
mov ecx, dword [esi + 4]
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
push eax
lea ecx, [esp + 0x34]
call fcn.00503c68
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x34]
push esi
push edx
call fcn.00503fb4
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], eax
call fcn.0050375a
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBrush.0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], vtable.CBitmap.0
push ebx
mov byte [esp + 0x84], 3
call edi
push eax
lea ecx, [esp + 0x44]
call fcn.00503c68
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x2c]
call fcn.00503f2f
push 0xc0c0c0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x24]
call fcn.00503f2f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.00503fb4
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x58], edx
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x44]
mov ebp, dword [sym.imp.GDI32.dll_GetPixel]
push 1
push 1
push ecx
call ebp
lea ecx, [esp + 0x20]
mov ebx, eax
call fcn.00503f82
test esi, esi
je 0x41ebcc
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x44]
push esi
push edx
call fcn.00503fb4
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
xor edi, edi
cmp dword [esp + 0x64], edi
mov dword [esp + 0x18], eax
jle 0x41ec28
mov eax, dword [esp + 0x68]
xor esi, esi
test eax, eax
jle 0x41ec1f
mov eax, dword [esp + 0x34]
push esi
push edi
push eax
call ebp
cmp eax, ebx
jne 0x41ec14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
push ecx
push esi
push edi
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x68]
add esi, 1
cmp esi, eax
jl 0x41ebf5
add edi, 1
cmp edi, dword [esp + 0x64]
jl 0x41ebef
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41ec33
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.00503fb4
mov byte [esp + 0x80], 2
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CBitmap.0
call fcn.00402b40
mov byte [esp + 0x80], 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.CBrush.0
call fcn.00402b40
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 0
call fcn.00503ce2
lea ecx, [esp + 0x30]
mov dword [esp + 0x80], 0xffffffff
call fcn.00503ce2
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x41f4a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5473b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5ab720]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CBrush.0
mov dword [esp + 0x30], 0
cmp dword [0x5b7688], 7
jne 0x41f510
call fcn.0041fe20
test eax, eax
jne 0x41f510
push 0xf
jmp 0x41f512
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x38], 0
jne 0x41f537
fld qword [0x585248]
sub esp, 8
mov ecx, eax
fstp qword [esp]
call fcn.0041b270
add esp, 8
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.00503f2f
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.00503f82
cmp dword [0x5b7688], 2
jl 0x41f581
mov edx, dword [esi + 4]
push 0xf
push 2
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawEdge]
cmp dword [esp + 0x3c], 0
jne 0x41f5a2
push 0
push 7
call ebx
mov ecx, dword [edi]
push eax
mov eax, dword [edi + 4]
add eax, 4
push eax
add ecx, 4
call fcn.0041e0b0
jmp 0x41f5b9
push 7
call ebx
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
add ecx, 4
push ecx
add ebx, 5
mov ecx, eax
call fcn.0041dfa0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBrush.0
call fcn.00402b40
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 8

Function at 0x41fbb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.00503137
movzx ebx, word [esp + 0x14]
mov edi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 2
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x41fbe8
push 2
push ebx
xor edi, edi
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x41fbe8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41fbe1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41fbe1
call fcn.0041fb70
cmp ax, 0x10
jne 0x41fbe1
push 0
push esi
push edi
call fcn.005096d8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41fe20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x258
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x254], eax
cmp dword [0x5bbd6c], 0
jne 0x41fefd
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [0x5bbd6c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fefd
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fef3
push esi
push edi
mov ecx, 0xb
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x41fef1
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi*2 + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41fef1
mov dword [0x5bbd68], 1
pop edi
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x254]
mov eax, dword [0x5bbd68]
xor ecx, esp
call fcn.0052151a
add esp, 0x258
ret

Function at 0x421460
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x5b76a8], 0
je 0x421471
mov eax, 1
pop ecx
ret
cmp dword [0x5b76b0], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 4], 0
jne 0x421498
push 0
push 0
push 0
push 0
call esi
mov dword [0x5b76b0], eax
cmp dword [0x5b76b4], 0
jne 0x4214b0
push 0
push 0
push 0
push 0
call esi
mov dword [0x5b76b4], eax
cmp dword [0x5b76b8], 0
jne 0x4214c8
push 0
push 0
push 0
push 0
call esi
mov dword [0x5b76b8], eax
cmp dword [0x5b76bc], 0
jne 0x4214e0
push 0
push 0
push 0
push 0
call esi
mov dword [0x5b76bc], eax
cmp dword [0x5b76ac], 0
jne 0x4214ff
push 0
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x5b76ac], eax
jne 0x4214ff
pop esi
pop ecx
ret
call fcn.00504604
test eax, eax
je 0x421515
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
test eax, eax
jne 0x421519
xor eax, eax
jmp 0x42151c
mov eax, dword [eax + 0x20]
lea ecx, [esp + 4]
push ecx
push 0
push 0x5b76a8
push 0x4217c0
push 0
push 0
mov dword [0x5b77ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5b76a8], eax
mov eax, 1
pop esi
pop ecx
ret