joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb8dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb8dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb8dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb8dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb8dd94
push eax
push esi
call fcn.00b9020b
add esp, 8
pop esi
ret 0x10

Function at 0xb8dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb8de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb8de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xba6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b8fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb8ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb8de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb8dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb8deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xba6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b8fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb8deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb8de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb8e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb8e131
push esi
call fcn.00b91145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b80080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb8e131
push 0
push ebp
call fcn.00b803a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b80260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb8e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b802f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb8e121
push 0xba6918
push edi
call fcn.00b8f3f0
push eax
push ebx
push esi
call fcn.00b8df60
push 0xba68f8
push edi
call fcn.00b8f3f0
push eax
push ebx
push esi
call fcn.00b8df60
push 0xba68d8
push edi
call fcn.00b8f3f0
push eax
push ebx
push esi
call fcn.00b8df60
push 0xba68c0
push edi
call fcn.00b8f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b8df60
push 0xba68a0
push edi
call fcn.00b8f3f0
push eax
push ebx
push esi
call fcn.00b8df60
push 0xba6888
push edi
call fcn.00b8f3f0
push eax
push ebx
push esi
call fcn.00b8df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb8f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b8f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b8f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b8f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b8f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb8fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb8fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xba187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb8fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb8fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffffc8
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
mov al, 0xd7
jne 0x406fa7
dec esi
add eax, 0xc9f440be
add byte [edx + 0xf303214], cl
invalid
Function at 0x401f00
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x2c
mov edx, dword [0x41844c]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test edx, edx
je 0x402010
mov eax, dword [0x418450]
cmp eax, edi
jle 0x401fd0
mov dword [esp], 0
call sub.gdi32.dll_GetStockObject
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.user32.dll_FillRect
mov eax, dword [0x41844c]
xor edx, edx
sub esp, 0xc
cmp edi, 1
jle 0x401f6d
mov edx, dword [eax + edi*4 - 8]
cmp edx, dword [0x418454]
jge 0x401fc4
mov dword [ebx + 0x28], edx
mov edx, dword [ebx + 0x14]
lea edi, [eax + edi*4 - 4]
mov dword [ebp - 0x1c], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x439
mov dword [esp], esi
call sub.user32.dll_SendMessageW
mov edx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [edi], eax
mov dword [ebx + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x439
mov dword [esp], esi
call sub.user32.dll_SendMessageW
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shl eax, 3
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x401fc4
mov dword [0x41844c], eax
shl dword [0x418450], 1
jmp 0x401f2e
mov dword [0x418450], 0x20
mov eax, dword fs:[0x18]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [0x41844c], eax
sub esp, 0xc
test eax, eax
jne 0x401f2e
jmp 0x401fc4

Function at 0x402da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x4184a4
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
leave
ret

Function at 0x402de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
test eax, eax
je 0x402e2a
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], 0x4184a4
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x402e58
mov dword [0x4184a4], 0x6dd
mov dword [0x4184ac], 0x6dd
mov dword [0x4184a8], 0x589
mov dword [0x4184b0], 0x589
leave
ret
cmp dword [ebp - 0xc], 0x10
jne 0x402e2a
jmp 0x402e52
Function at 0x402e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x418444
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
leave
ret

Function at 0x402ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 4
test eax, eax
je 0x402eea
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], 0x418444
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x402f00
mov dword [0x418444], 1
leave
ret
cmp dword [ebp - 0xc], 4
jne 0x402eea
mov eax, dword [0x418444]
test eax, eax
jle 0x402eea
cmp eax, 2
jle 0x402ef4
mov dword [0x418444], 2
leave
ret
Function at 0x403c20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [0x418440], 1
mov dword [0x418458], 0
mov esi, eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [0x41845c], 0
mov dword [0x4184a0], eax
mov dword [0x418498], 0
mov dword [0x41849c], 0
mov dword [esp + 4], 0x7d4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
mov ecx, 0x3f2
mov edx, 0x5a8
sub esp, 8
mov ebx, eax
xor eax, eax
cmp dword [0x418444], 1
mov dword [esp], 6
setg al
mov edi, eax
mov eax, ebx
add edi, 0x5ab
call fcn.00401b90
mov dword [esp], 7
mov eax, ebx
mov ecx, 0x3f9
mov edx, 0x5a9
call fcn.00401b90
mov dword [esp], 8
mov eax, ebx
mov ecx, 0x3fa
mov edx, 0x5aa
call fcn.00401b90
mov dword [esp], 9
mov edx, edi
mov eax, ebx
mov ecx, 0x3fb
call fcn.00401b90
mov dword [esp], 0xa
mov eax, ebx
mov ecx, 0x3fc
mov edx, 0x5ad
call fcn.00401b90
mov dword [esp], 0xb
mov eax, ebx
mov ecx, 0x3fd
mov edx, 0x5ae
call fcn.00401b90
mov dword [esp], 0xc
mov ecx, 0x3e8
mov eax, ebx
mov edx, 0x5af
call fcn.00401b90
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x41142e
mov dword [esp], 0
call sub.user32.dll_CreateWindowExW
mov dword [ebp - 0x7c], 0x50
mov dword [ebp - 0x5c], eax
sub esp, 0x30
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x371
mov dword [ebp - 0x74], 0x140
mov dword [ebp - 0x54], 0x16
mov dword [ebp - 0x44], 0x16
mov dword [ebp - 0x58], 0x5a
mov dword [ebp - 0x50], 0x5a
mov dword [ebp - 0x38], 0x64
mov dword [ebp - 0x48], 0xd
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x40a
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x7e0
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50300000
mov dword [esp + 8], 0
mov dword [esp + 4], str.PrtPreview
mov dword [esp], 0
call sub.user32.dll_CreateWindowExW
sub esp, 0x30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403e80
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0x7e0
mov dword [esp], ebx
call sub.user32.dll_GetDlgItem
mov edx, dword [0x41844c]
mov dword [0x418468], 0
mov dword [0x41846c], 0
sub esp, 8
mov edi, eax
mov dword [0x418440], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x41849c]
mov dword [0x41844c], 0
mov dword [0x418450], 0
sub esp, 0xc
test eax, eax
jle 0x403f10
mov eax, dword [0x418448]
mov dword [0x418444], eax
mov eax, dword [0x418458]
test eax, eax
je 0x403f53
mov dword [esp + 4], 7
mov dword [esp], eax
call sub.gdi32.dll_GetCurrentObject
mov esi, eax
mov eax, dword [0x418458]
sub esp, 8
mov dword [esp], eax
call sub.gdi32.dll_DeleteDC
sub esp, 4
mov dword [esp], esi
call sub.gdi32.dll_DeleteObject
mov dword [0x418458], 0
sub esp, 4
mov eax, dword [0x41845c]
test eax, eax
je 0x403f96
mov dword [esp + 4], 7
mov dword [esp], eax
call sub.gdi32.dll_GetCurrentObject
mov esi, eax
mov eax, dword [0x41845c]
sub esp, 8
mov dword [esp], eax
call sub.gdi32.dll_DeleteDC
sub esp, 4
mov dword [esp], esi
call sub.gdi32.dll_DeleteObject
mov dword [0x41845c], 0
sub esp, 4
mov dword [esp], ebx
mov ebx, 6
mov dword [esp + 4], 0x7d4
call sub.user32.dll_GetDlgItem
sub esp, 8
mov esi, eax
mov dword [esp + 8], ebx
add ebx, 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x410
mov dword [esp], esi
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x402
mov dword [esp], esi
call sub.user32.dll_SendMessageW
sub esp, 0x10
cmp ebx, 0xe
jne 0x403fb0
mov dword [esp], edi
call sub.user32.dll_DestroyWindow
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404de0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x5c
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x404e00
sub edx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad
sar edx, 1
cmp word [edi], 0
mov eax, edx
je 0x404e2f
mov eax, edi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x404e20
sub eax, edi
sar eax, 1
add eax, edx
lea eax, [eax + eax + 4]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x404f90
lea esi, [esi]
movzx edx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x404e68
cmp word [ebx], 0
mov edx, ebx
je 0x404e91
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x404e88
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebp + eax - 0x1c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404e98
cmp word [ebx], 0
mov edx, ebx
je 0x404ec1
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x404eb8
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404ec8
test esi, esi
je 0x404f58
mov dword [esp + 0x20], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
sub esp, 0x24
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
mov esi, eax
jmp 0x404f24
lea esp, [ebp - 0xc]
mov esi, 1
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x404fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x30
mov dword [ebp - 0xc], 0
call fcn.00404de0
test eax, eax
je 0x404fd0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
mov dword [esp + 0x14], 4
add ebx, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x405060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [eax*4]
lea eax, [ebp - 0x24]
lea esi, [ecx + ebx]
mov ecx, edx
lea edx, [ebp - 0x20]
sub esp, 0x3c
add ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 0x20], 0
call fcn.00404de0
test eax, eax
jne 0x4050bf
cmp dword [ebp - 0x20], 2
je 0x4050d0
mov dword [esi], 0xf
xor eax, eax
test edi, edi
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
lea edx, [ebp - 0x1c]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x405118
mov dword [esi], 0xf
cmp eax, 2
jne 0x4050a8
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x4050b1
jmp 0x4050a8
Function at 0x405160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
sub esp, 0x68
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
call fcn.00404de0
test eax, eax
je 0x4051c0
mov ecx, str.Settings
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
call fcn.00404de0
test eax, eax
je 0x4051a0
leave
ret
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.00402e60
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
leave
ret
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.user32.dll_GetWindowPlacement
xor eax, eax
sub esp, 8
cmp dword [ebp - 0x2c], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
lea eax, [ebp - 0x38]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp], eax
call fcn.00402da0
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x405181

Function at 0x405270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
call fcn.00404de0
test eax, eax
je 0x4052d0
test ebx, ebx
je 0x4052ba
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40529b
cmp dword [ebp - 0xc], 0x10
jne 0x40529b
jmp 0x4052ba

Function at 0x405310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
call fcn.00404de0
test eax, eax
je 0x405358
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40533b
cmp dword [ebp - 0xc], 4
jne 0x40533b
jmp 0x405341