joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e20b0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x4e20c0
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4e20bd
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x4e20e0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4e2118
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4e210e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4e211a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4e2100
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4e2660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xa729a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xa729bc]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x4e26b5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4e26ae
test esi, esi
je 0x4e26ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4e2690
mov dword [esp], 0xa729a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4e2940
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4e2974
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0xa729c4], eax
call fcn.004f2b80
test eax, eax
sete al
movzx eax, al
mov dword [0x555bb4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e2963

Function at 0x4e2a10
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [0xa729c4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4e2a30
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4e2a90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x555bb4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x4e2b40
test eax, eax
jne 0x4e2ae0
mov eax, dword [0xa729c8]
mov dword [0xa729c8], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0xa729c4]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xa729c4]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4e2ac5
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.004e2980
mov eax, dword [0x555bb4]
jmp 0x4e2ab4

Function at 0x4e2b50
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 8
mov edx, dword [0x555bb4]
mov eax, dword [esp + 0x10]
test edx, edx
mov ebx, dword [eax]
js 0x4e2b80
test edx, edx
jne 0x4e2b73
mov dword [0xa729c8], ebx
add esp, 8
pop ebx
ret
add esp, 8
mov eax, ebx
pop ebx
jmp fcn.004e2a10
call fcn.004e2980
mov edx, dword [0x555bb4]
jmp 0x4e2b64

Function at 0x4e2d80
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x555bb4]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x4e2e63
test eax, eax
mov esi, dword [0xa729c8]
jne 0x4e2e01
test esi, esi
mov dword [esp + 0x2c], esi
je 0x4e2df5
mov ecx, esi
lea ebx, [esp + 0x2c]
nop
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4e2de7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x4e2e30
cmp eax, 8
jne 0x4e2e57
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x2c], ecx
jne 0x4e2db0
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0xa729c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4e2da1
mov eax, dword [esp + 0x2c]
mov edx, ebx
mov dword [edi + 0xc], 0
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.004e28a0
cmp eax, 7
jne 0x4e2dfa
mov eax, ebx
call fcn.004e2a40
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.004e2980
mov eax, dword [0x555bb4]
jmp 0x4e2d97
Function at 0x4e2f30
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x555bb4]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x4e2fab
test edx, edx
mov esi, dword [0xa729c8]
jne 0x4e2f85
mov ecx, dword [ebx + 0xc]
mov eax, ebx
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
test ecx, ecx
jne 0x4e2f75
call fcn.004e28a0
cmp eax, 7
je 0x4e2f7c
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.004e2b90
jmp 0x4e2f66
mov eax, esi
nop
call fcn.004e2a40
mov esi, dword [0xa729c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x4e2f4e
call fcn.004e2980
mov edx, dword [0x555bb4]
jmp 0x4e2f44

Function at 0x4e2fc0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4e2ff2
mov dword [esp], ebx
call fcn.004e2d80
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x555bb4]
test edx, edx
js 0x4e3060
test edx, edx
mov esi, dword [0xa729c8]
jne 0x4e3030
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], esi
call fcn.004e2b90
cmp eax, 7
je 0x4e3020
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.004e2a40
lea esi, [esi]
mov esi, dword [0xa729c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4e3006
call fcn.004e2980
mov edx, dword [0x555bb4]
jmp 0x4e2ffc

Function at 0x4e35b0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x4e35f0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4e3615
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4012b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4012fe
cmp dword [esp + 0x28], 4
jne 0x401308
add esp, 0x3c
ret
mov eax, 0xb
add esp, 0x3c
ret

Function at 0x401390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4013f0
cmp dword [esp + 0x28], 4
jne 0x4013f0
xor eax, eax
mov edx, dword [esp + 0x24]
test edx, edx
setne al
add esp, 0x3c
ret
mov eax, dword [esp + 0x48]
add esp, 0x3c
ret

Function at 0x401400
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
mov ebp, dword [esi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x40146d
mov eax, dword [esp + 0x2c]
lea edx, [eax - 1]
cmp edx, 1
ja 0x401478
mov ecx, dword [esi]
test ecx, ecx
je 0x4014e8
lea edi, [ebp - 1]
mov ecx, dword [esp + 0x58]
cmp eax, 2
mov byte [ecx + edi], 0
je 0x401488
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov ebx, 0xb
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4132b0]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov ebp, eax
test eax, eax
je 0x401518
mov eax, dword [esp + 0x58]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
push edx
push edx
je 0x4014f8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
lea ecx, [eax - 1]
cmp ecx, edi
jae 0x401518
mov dword [esi], eax
jmp 0x40146d
add esp, 0x3c
mov ebx, 2
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4132b0]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea esi, [esi]
mov ebx, 8
jmp 0x40146d
Function at 0x401650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [0x4132a8]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x4016d9
mov eax, ebx
mov dword [esp + 8], 6
shr eax, 4
mov dword [esp], edi
inc eax
and eax, 0xffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
test eax, eax
je 0x4016d9
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
push ecx
push ecx
je 0x4016d9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
push edx
je 0x4016d9
mov edi, ebx
and edi, 0xf
je 0x4016ce
xor edx, edx
lea esi, [esi]
xor ecx, ecx
inc edx
mov cx, word [eax]
cmp edi, edx
lea eax, [eax + ecx*2 + 2]
jne 0x4016c0
xor ecx, ecx
mov cx, word [eax]
mov eax, ecx
test eax, eax
jne 0x4016e8
mov dword [esi], 0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
lea edi, [eax + 1]
mov eax, dword [0x4132b0]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x4016d9
mov dword [esp + 8], eax
mov eax, dword [0x4132a8]
mov dword [esp + 0xc], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadStringA]
sub esp, 0x10
test eax, eax
jg 0x4016e1
mov eax, dword [esi]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x4132b0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x4016d9

Function at 0x401c90
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelAppearanceClassicSchemes
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x401d13
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SelectedScheme
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
add esp, 0x38
pop ebx
ret
Function at 0x401de0
Capabilities:
Delete registry key

Disassembly:
push esi
push ebx
mov ebx, edx
sub esp, 0x74
lea esi, [esp + 0x2b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Control_PanelAppearanceClassicSchemes
mov dword [esp + 4], str._s_s
mov dword [esp], esi
call dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 0x28
jg 0x401e18
xor esi, esi
add esp, 0x74
mov eax, esi
pop ebx
pop esi
ret
lea eax, [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10000
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
sub esp, 0x14
test eax, eax
jne 0x401e0f
mov eax, dword [esp + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
push edx
sete al
push edx
and eax, 0xff
mov esi, eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
push ecx
add esp, 0x74
pop ebx
pop esi
ret

Function at 0x402130
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
lea eax, [esp + 0x28]
mov ebx, dword [esp + 0x70]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelAppearanceClassicSchemes
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x402190
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x2c]
lea esi, [esp + 0x33]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str.SelectedScheme
mov dword [esp], eax
mov dword [esp + 0x2c], 0x1d
call fcn.00401400
test eax, eax
je 0x402227
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str.SelectedStyle
mov dword [esp], eax
mov dword [esp + 0x2c], 0x1d
call fcn.00401400
test eax, eax
jne 0x402181
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SelectedScheme
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
je 0x402280
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
push ecx
je 0x402181
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x402252
mov ebx, dword [ebx]
test ebx, ebx
je 0x402181
mov dword [esp + 4], esi
mov eax, dword [ebx + 8]
mov dword [esp], eax
call edi
test eax, eax
push edx
push edx
jne 0x402248
mov dword [ebp], ebx
mov dword [esp], ebx
call fcn.00402040
mov dword [ebp + 4], eax
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
mov dword [esp + 4], str.SelectedStyle
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
jmp 0x402227
Function at 0x4034d0
Capabilities:
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0xc4]
lea ebx, [esp + 0x5b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Control_PanelAppearanceClassicSchemes
mov dword [esp + 4], str._s_s
mov dword [esp], ebx
call ebp
cmp eax, 0x28
jg 0x403518
add esp, 0xac
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x48]
mov dword [esp + 4], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
mov ebx, eax
test eax, eax
jne 0x403509
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x3c], 1
lea edi, [esp + 0x53]
lea esi, [eax + 0x190]
lea esi, cs:[esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Color_d
mov dword [esp], edi
call ebp
cmp eax, 5
jle 0x4035e2
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
sete al
mov edx, dword [esp + 0x3c]
and eax, 0xff
and edx, eax
mov dword [esp + 0x3c], edx
inc ebx
add esi, 4
cmp ebx, 0x1d
jne 0x403588
mov eax, dword [esp + 0xc0]
xor ebx, ebx
mov eax, dword [eax + 0x208]
mov dword [esp + 0x14], 4
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Gradients
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
sete bl
mov eax, dword [esp + 0x3c]
and ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, ebx
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x66c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelAppearanceSchemes
mov dword [esp], 0x80000001
call ebx
sub esp, 0x14
test eax, eax
je 0x403a90
add esp, 0x66c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x24c]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40e428
mov dword [esp], 0x80000001
call ebx
sub esp, 0x14
test eax, eax
je 0x403c88
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x44], 0
mov dword [esp + 0x2c], eax
xor ebp, ebp
lea ebx, [esp + 0x148]
nop
lea eax, [esp + 0x40]
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 0x38], 0x104
mov dword [esp + 0x40], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
inc ebp
sub esp, 0x20
test eax, eax
jne 0x403c60
cmp dword [esp + 0x3c], 3
jne 0x403ae0
cmp dword [esp + 0x40], 0x208
jne 0x403ae0
cmp byte [esp + 0x24c], 4
mov byte [esp + 0x24b], 0
mov byte [esp + 0x164], 0
jne 0x403ae0
lea eax, [esp + 0x250]
mov dword [esp + 8], 0x154
mov dword [esp + 4], eax
lea eax, [esp + 0x454]
mov dword [esp], eax
lea esi, [esp + 0x3a4]
call fcn.004011d0
lea eax, [esp + 0x5a8]
mov edi, eax
mov ecx, 0xf
lea eax, [esp + 0x5e4]
mov dword [esp + 0x454], 0x154
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea esi, [esp + 0x3e0]
mov ecx, 0x1d
mov eax, 1
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x650]
cmp dword [esp + 0x5ec], edx
jne 0x403bf1
mov eax, dword [esp + 0x654]
cmp dword [esp + 0x5f0], eax
setne al
and eax, 0xff
mov dword [esp + 0x65c], eax
lea eax, [esp + 0x454]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004034d0
test eax, eax
je 0x403ae0
lea eax, [esp + 0x454]
mov dword [esp + 8], 0x40e120
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00403660
test eax, eax
je 0x403ae0
lea eax, [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
push edx
push edx
jne 0x403ae0
mov eax, ebx
call fcn.00401c90
jmp 0x403ae0
cmp eax, 0x103
jne 0x403ae0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
call eax
push eax
add esp, 0x66c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x454]
mov dword [esp + 4], str.Current
mov dword [esp + 0xc], eax
lea eax, [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24c]
mov dword [esp], eax
mov dword [esp + 0x454], 0x104
call fcn.00401400
test eax, eax
je 0x403cc6
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x24c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], eax
call eax
push ecx
jmp 0x403ad5