joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f78
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001f90
call fcn.01005164
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1004fb5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004fb5
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1004fcd
cmp eax, 0x20b
je 0x1004fba
mov dword [ebp - 0x1c], ebx
jmp 0x1004fe1
cmp dword [ecx + 0x84], 0xe
jbe 0x1004fb5
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1004fdb
cmp dword [ecx + 0x74], 0xe
jbe 0x1004fb5
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100c544], 0xffffffff
or dword [0x100c548], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100b2d0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100b2cc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100c54c], eax
call fcn.0100515e
cmp dword [0x100b010], ebx
jne 0x100503c
push fcn.0100515e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100514c
push 0x100114c
push 0x1001148
call sub.msvcrt.dll__initterm
mov eax, dword [0x100b2c8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100b2c4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001144
push 0x1001140
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x10050d2
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10050a6
cmp al, 0x22
jne 0x1005098
cmp byte [esi], 0x22
jne 0x10050af
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10050b9
cmp al, 0x20
jbe 0x10050ab
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x10050dd
movzx eax, word [ebp - 0x48]
jmp 0x10050e0
cmp byte [esi], 0x20
jbe 0x10050af
inc esi
mov dword [ebp - 0x34], esi
jmp 0x10050d2
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x10050fd
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005132
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100519d
ret
Function at 0x10064ad
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x10064e8
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x10064c5
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1006504
dec esi
je 0x10064fd
dec esi
jne 0x1006509
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x4012f0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xfb8
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0xfb4], eax
cmp dword [0x54ad60], 0
je 0x4013cf
push 0x54ad20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0xfbc]
lea eax, [esp + 0xfc0]
push eax
push ecx
lea edx, [esp + 0x7e8]
push edx
call fcn.004cea44
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
lea ecx, [esp + 0x7e0]
push ecx
movzx ecx, word [esp + 0xe]
push edx
movzx edx, word [esp + 0x10]
push eax
push ecx
push edx
push str._02d:_02d:_02d:_03d___s_n
lea eax, [esp + 0x28]
push 0x3e6
push eax
call fcn.004cea73
add esp, 0x20
cmp dword [0x53e3d4], 0
je 0x4013b9
mov eax, dword [0x54ad5c]
test eax, eax
jne 0x40139d
call section..text
mov eax, dword [0x54ad5c]
test eax, eax
je 0x4013cf
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004ceaae
mov edx, dword [0x54ad5c]
push edx
call fcn.004cecd4
add esp, 0xc
jmp 0x4013c4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x54ad20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xfb4]
xor ecx, esp
call fcn.004cf0b8
add esp, 0xfb8
ret

Function at 0x401d10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401d29
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d64
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401d60
lea ebx, [ebx]
cmp esi, eax
jae 0x401d64
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401d50
cmp esi, eax
jb 0x401d6a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x408680
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f299b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.004bd5c1
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x54], vtable.CEngineInterface.0
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
lea eax, [esi + 0xa8]
mov byte [esp + 0x1c], 1
push eax
mov dword [esi], vtable.CGuiEngine.0
mov dword [esi + 0x54], vtable.CGuiEngine.1.0
call fcn.0042e2c0
mov byte [esp + 0x1c], 2
lea ecx, [esi + 0x150]
push ecx
mov dword [esi + 0x124], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x134], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x13c], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x144], edi
call fcn.00430b50
mov ebx, 0xa
mov dword [esi + method.CCommandLineInfo.virtual_0], vtable.CMap_int__int__class_CWnd___class_CWnd__.0
mov dword [esi + 0x218], edi
mov dword [esi + 0x21c], 0x11
mov dword [esi + 0x220], edi
mov dword [esi + 0x224], edi
mov dword [esi + 0x228], edi
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], edi
mov dword [esi + 0x234], edi
mov dword [esi + 0x238], 0x64
lea edx, [esi + 0x23c]
push edx
mov byte [esp + 0x20], 4
call fcn.00437eb0
lea eax, [esi + 0x4bc]
push eax
mov byte [esp + 0x20], 5
call fcn.00436bc0
lea ecx, [esi + 0x540]
push ecx
mov byte [esp + 0x20], 6
call fcn.00435a20
lea edx, [esi + 0x610]
push edx
mov byte [esp + 0x20], 7
call fcn.004379b0
lea eax, [esi + 0x668]
push eax
mov byte [esp + 0x20], 8
call fcn.00438e20
lea ecx, [esi + 0x68c]
push ecx
mov byte [esp + 0x20], 9
call fcn.0042db30
mov byte [esp + 0x1c], bl
mov dword [esi + 0x7b0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0x7a4], edi
mov dword [esi + 0x7a8], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0x788], edi
mov dword [esi + 0x774], edi
push 0x40
lea edx, [esi + 0x60]
push edi
push edx
mov dword [esi + 0x78c], edi
mov dword [esi + 0x778], ebx
mov dword [esi + 0x77c], edi
mov dword [esi + 0x780], edi
mov dword [esi + 0x784], edi
mov dword [esi + 0x790], edi
mov dword [esi + 0x794], 1
mov dword [esi + 0x798], 0xffffffff
mov dword [esi + 0x79c], edi
call fcn.004d1c40
add esp, 0xc
push edi
push edi
push edi
push edi
call fcn.004c10f8
push eax
lea ecx, [esp + 0x14]
call fcn.00401b10
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push DirectSoundCreate
mov byte [esp + 0x3c], 0xb
mov eax, dword [esp + 0x30]
push str.Realtek_HD_Audio_New_GUI
push eax
push edi
mov ecx, esi
call fcn.004c0479
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40acf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
mov esi, eax
test esi, esi
je 0x40ad47
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004d1c40
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40ad4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
add esp, 0x5c
ret
cmp dword [esp + 0x64], 0
je 0x40ad62
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov eax, 1
pop esi
add esp, 0x5c
ret
Function at 0x40e120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x507bfc
mov ebx, ecx
push eax
xor edi, edi
push ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x40e1b9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x40e1b9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40e1b9
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40e1b9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40e22d
push ebp
push esi
push eax
call fcn.004d9220
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x40e1b9
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
push edx
push ebx
call fcn.0040ec10
test eax, eax
jge 0x40e1ed
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40e1d1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x10], 0
test edi, edi
je 0x40e1e3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call fcn.0042bda0
test eax, eax
je 0x40e218
cmp dword [esp + 0x1c], 0
je 0x40e209
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ebd0
jmp 0x40e212
mov eax, dword [ebx + 4]
push eax
call fcn.0040eb90
mov dword [ebx + 0x30], eax
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x40e231
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x40e245
call fcn.0040e290
call fcn.0042bda0
test eax, eax
je 0x40e27a
xor eax, eax
test esi, esi
setne al
mov edi, ebx
lea eax, [eax*4 + 3]
push eax
call fcn.0040e420
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x40e27a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [ebx + 0x30], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 8
Function at 0x411f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ed5dd
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 8], vtable.CMemDCCtrl.0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov byte [esp + 0x18], 1
lea ebx, [esi + 0x30]
mov ecx, ebx
mov dword [esi], vtable.CPngCtrlV2.1.0
mov dword [esi + 8], vtable.CPngCtrlV2.0
call fcn.004c93a6
mov dword [ebx], vtable.CTypedPtrArray_class_CPtrArray__class_Gdiplus::Bitmap__.0
lea ebx, [esi + 0x44]
mov ecx, ebx
mov byte [esp + 0x18], 2
call fcn.004c93a6
mov dword [ebx], vtable.CTypedPtrArray_class_CPtrArray__class_CImageEx__.0
lea ebx, [esi + 0x58]
mov ecx, ebx
mov byte [esp + 0x18], 3
call fcn.004c93a6
mov dword [ebx], vtable.CTypedPtrArray_class_CPtrArray__class_CPoint__.0
lea ebx, [esi + 0x6c]
mov ecx, ebx
mov byte [esp + 0x18], 4
call fcn.004c93a6
mov dword [ebx], vtable.CTypedPtrArray_class_CPtrArray__class_CPoint__.0
lea ebx, [esi + 0x80]
mov ecx, ebx
mov byte [esp + 0x18], 5
call fcn.004c93a6
mov dword [ebx], vtable.CTypedPtrArray_class_CPtrArray__class_CSize__.0
lea ecx, [esi + 0x94]
mov byte [esp + 0x18], 6
call fcn.004c5bc0
and word [esi + 0x2c], 0xffc0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 4], edi
mov dword [esi + 0x24], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x413890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 0x507bfc
push eax
xor ebx, ebx
push ebp
xor esi, esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x413930
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x413930
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x413930
mov ebp, dword [esp + 0x14]
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x413930
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x413977
push ebp
push edi
push eax
call fcn.004d9220
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x413930
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413948
push eax
call fcn.0040ebd0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x413964
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413948
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x10], 0
test esi, esi
je 0x41395a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call fcn.00413680
add esp, 4
test ebx, ebx
mov esi, eax
je 0x413997
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x42ac40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f53d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CBrush.0
mov dword [esp + 0x30], 0
cmp dword [0x54b89c], 7
jne 0x42acb0
call fcn.0042b2d0
test eax, eax
jne 0x42acb0
push 0xf
jmp 0x42acb2
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x38], 0
jne 0x42acd7
fld qword [0x517eb0]
sub esp, 8
mov ecx, eax
fstp qword [esp]
call fcn.00427ad0
add esp, 8
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.004c1f11
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.004c1f64
cmp dword [0x54b89c], 2
jl 0x42ad21
mov edx, dword [esi + 4]
push 0xf
push 2
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawEdge]
cmp dword [esp + 0x3c], 0
jne 0x42ad42
push 0
push 7
call ebx
mov ecx, dword [edi]
push eax
mov eax, dword [edi + 4]
add eax, 4
push eax
add ecx, 4
call fcn.0042a220
jmp 0x42ad59
push 7
call ebx
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
add ecx, 4
push ecx
add ebx, 5
mov ecx, eax
call fcn.0042a110
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBrush.0
call fcn.004054d0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 8
Function at 0x42b2d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x258
mov eax, dword [0x536ed4]
xor eax, esp
mov dword [esp + 0x254], eax
cmp dword [0x54be08], 0
jne 0x42b3ad
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [0x54be08], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b3ad
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b3a3
push esi
push edi
mov ecx, 0xb
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x42b3a1
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi*2 + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42b3a1
mov dword [0x54be04], 1
pop edi
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x254]
mov eax, dword [0x54be04]
xor ecx, esp
call fcn.004cf0b8
add esp, 0x258
ret
Function at 0x42be60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x10
call edi
mov esi, eax
push 0x11
mov dword [esp + 0x18], esi
call edi
cmp esi, ebx
mov ecx, eax
mov dword [esp + 0x18], ecx
jge 0x42be9b
fild dword [esp + 0x14]
fidiv dword [esp + 0x28]
fstp dword [0x53bd6c]
cmp ecx, ebp
jge 0x42bead
fild dword [esp + 0x18]
fidiv dword [esp + 0x2c]
fstp dword [0x53c064]
fld dword [0x53c064]
fld dword [0x53bd6c]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x42bed2
fstp st(0)
fst dword [0x53bd6c]
fld dword [0x53bd6c]
jmp 0x42beeb
fcom st(1)
fnstsw ax
test ah, 5
jp 0x42beeb
fstp st(1)
fst dword [0x53c064]
fld dword [0x53c064]
fxch st(1)
fld1
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x42bfb2
fstp st(0)
fld dword [0x517e8c]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x42bf92
cmp ecx, 0x258
jle 0x42bf92
fld dword [0x517e88]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42bf30
fstp st(0)
fld dword [0x517e84]
jmp 0x42bf9a
fld dword [0x517e80]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42bf49
fstp st(0)
fld dword [0x517e7c]
jmp 0x42bf9a
fld dword [0x517e78]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42bf62
fstp st(0)
fld dword [0x517e74]
jmp 0x42bf9a
fcom qword [0x517d78]
fnstsw ax
test ah, 0x41
jne 0x42bf79
fstp st(0)
fld dword [0x517df0]
jmp 0x42bf9a
fld dword [0x517e70]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42bfa6
fstp st(0)
fld dword [0x517e6c]
jmp 0x42bf9a
fstp st(0)
fld dword [0x517e68]
fstp dword [0x53c064]
fld dword [0x53c064]
fst dword [0x53bd6c]
fld dword [0x53bd6c]
fmul dword [0x53b26c]
sub esp, 0x10
fstp dword [0x53b26c]
fld dword [0x53b7ec]
fmul st(1)
fstp dword [0x53b7ec]
fstp qword [esp + 8]
fld dword [0x53b7ec]
fstp qword [esp]
push ebp
push ebx
push ecx
push esi
push str.CDpiScaler::InitUIScaleFactor:_FullScreen__d_X__d__RealWindowSize__d_X__d__DPI__.2f__UIScale__.2f
call fcn.004012f0
add esp, 0x24
lea eax, [esp + 0x2c]
push eax
push 0x20006
push 0
push str.SoftwareRealtekAudioGUI_INFORMATION
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42c073
fld dword [0x53c064]
mov esi, dword [esp + 0x2c]
fadd qword [0x517d28]
push 4
fnstcw word [esp + 0x2c]
movzx eax, word [esp + 0x2c]
fmul qword [0x517d10]
or eax, 0xc00
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x2c]
push edx
fldcw word [esp + 0x20]
push 4
push 0
push str.CplScalingFactor
push esi
fistp qword [esp + 0x30]
mov ecx, dword [esp + 0x30]
fldcw word [esp + 0x40]
mov dword [esp + 0x40], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x42c073
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42caf0
Capabilities:
Terminate thread

Disassembly:
cmp dword [esi + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x42cb44
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push ecx
call edi
mov edx, dword [esi + 8]
push 0x2710
push edx
call edi
cmp eax, 0x102
pop edi
jne 0x42cb37
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi]
test eax, eax
je 0x42cb53
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x42cb64
push eax
call ebx
mov dword [esi + 4], 0
pop ebx
ret

Function at 0x436210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4f499a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x536ed4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, edx
test ecx, ecx
jne 0x43624f
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [edi + 0xcc]
test eax, eax
je 0x43623a
push 0x507bfc
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x43623a
mov eax, dword [edi + 0xcc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x43623a
mov ecx, dword [edi + 0xcc]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x43623a
push 0x28
call fcn.004bb012
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x4362c5
push 0x400
mov ecx, eax
call fcn.004ca0be
mov esi, eax
jmp 0x4362c7
xor esi, esi
test esi, esi
mov dword [esp + 0x1c], 0xffffffff
je 0x43623a
push 0
push ebx
push edi
mov ecx, esi
call fcn.004ca0ee
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x436de0
Capabilities:
Identify system language via api

Disassembly:
mov word [esi + 0x7c], 0x409
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
test cx, cx
je 0x436dfd
call fcn.00436e80
mov word [esi + 0x7c], ax
mov ax, word [esi + 0x7c]
push 0
push str.Language
push str.General
mov ecx, 0x54b0b0
mov word [esi + 8], ax
mov dword [esi + 4], 1
call fcn.004c539d
movzx ecx, ax
test cx, cx
je 0x436e3a
call fcn.00436e80
mov word [esi + 8], ax
mov dword [esi + 4], 0
cmp dword [esi + 4], 0
je 0x436e50
mov dword [esi + 0x80], 0x20
mov eax, 1
ret
movzx ecx, word [esi + 8]
xor eax, eax
cmp word [eax*8 + 0x53cafc], cx
je 0x436e6e
add eax, 1
cmp eax, 0x21
jb 0x436e56
mov eax, 1
ret
mov dword [esi + 0x80], eax
mov eax, 1
ret