joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x164], eax
push esi
push edi
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x54], 6
jae 0x403213
xor esi, esi
push esi
call fcn.00496400
add esp, 4
jmp 0x403240
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
lea edi, [esp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.00498410
xor eax, eax
xor ecx, ecx
cmp eax, esi
sete cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret

Function at 0x403260
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x4033c4
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x4032fb
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x403335
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x40336f
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], 1
je 0x4033c0
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c9e94]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403400
test byte [0x5c9d98], 8
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x40341e
lea edi, [esp + 0x20]
mov dword [esp + 0x30], 1
call fcn.00498410
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate
jmp 0x403400
Function at 0x403430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x403598
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x4034cf
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x403509
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x403547
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x403594
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c9e94]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4035dd
mov al, byte [0x5c9d98]
test al, 4
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4035fb
mov ecx, 1
test cl, al
mov dword [esp + 0x2c], ecx
je 0x4035d2
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.00498410
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate
jmp 0x4035dd
Function at 0x403610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x403776
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov eax, 1
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x4036b5
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
mov eax, 1
cmp esi, 0xffffffff
mov dword [esp + 0x6c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x4036eb
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x403725
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x403772
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c9e94]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4037bb
mov al, byte [0x5c9d98]
test al, 2
mov ecx, 0x11
mov esi, 0x5c9d80
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4037d9
mov ecx, 1
test cl, al
mov dword [esp + 0x28], ecx
je 0x4037b0
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.00498410
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
test al, 1
je 0x4037e7
mov dword [esp + 0x24], 1
jmp 0x4037b0
mov eax, DirectSoundCreate
jmp 0x4037bb
Function at 0x40c390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c3a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c3e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40c3e0
lea ebx, [ebx]
cmp esi, eax
jae 0x40c3e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40c3d0
cmp esi, eax
jb 0x40c3ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40dd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x554a58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x58]
push 2
push 2
push 0x19
push 0x20
push 0x20
add ecx, 0x23c
call fcn.0050f110
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
xor esi, esi
push 0x5c9690
mov dword [esp + 0x18], vtable.ATL::CImage.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call edi
add dword [0x5c96a8], 1
push 0x5c9690
call ebp
mov dword [esp + 0x14], vtable.CImageEx.0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ebx
call fcn.0050b8e1
mov ecx, dword [esi + 0x5c1050]
mov eax, dword [eax + 8]
push 1
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00443e90
mov eax, dword [esp + 0x18]
push eax
call fcn.0050c6ad
cmp eax, ebx
jne 0x40de5e
xor eax, eax
jmp 0x40de61
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x58]
mov ecx, dword [ecx + 0x240]
push 0xffffff
push eax
push ecx
call fcn.0050b8e1
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.00410160
or ecx, 0xffffffff
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x14], vtable.ATL::CImage.0
je 0x40dec3
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ecx
mov byte [esp + 0x35], bl
mov byte [esp + 0x34], bl
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x5c9690
call edi
sub dword [0x5c96a8], 1
jne 0x40def6
push 0x5c9690
call edi
mov eax, dword [0x5c968c]
cmp eax, ebx
je 0x40dee9
push eax
call sub.gdiplus.dll_GdiplusShutdown
push 0x5c9690
mov dword [0x5c968c], ebx
call ebp
push 0x5c9690
call ebp
add esi, 0x10
cmp esi, 0x60
jb 0x40ddd0
mov eax, 1
mov dword [0x5c9a2c], eax
mov dword [0x5c0924], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x40f940
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [esp + 0x10], ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
je 0x40fa0f
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, ebx
jne 0x40f9ad
mov esi, dword [esp + 0x18]
push 0x5703b8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push 0x5703b8
push 1
push ebx
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40faac
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
lea esi, [esp + 0x14]
call fcn.0040ff70
lea edx, [esp + 0x18]
push edx
push 0x2001f
push ebx
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x2c], ebx
call edi
cmp eax, ebx
jne 0x40fa95
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x40f9f0
push ecx
call ebp
cmp eax, ebx
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], esi
jne 0x40fa95
lea eax, [esp + 0x10]
push eax
call fcn.0040ffe0
jmp 0x40faac
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, ebx
jne 0x40fa3c
mov esi, dword [esp + 0x18]
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40faac
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
lea esi, [esp + 0x14]
call fcn.0040ff70
lea edx, [esp + 0x18]
push edx
push 0x2001f
push ebx
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x2c], ebx
call edi
cmp eax, ebx
jne 0x40fa95
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x40fa7b
push ecx
call ebp
cmp eax, ebx
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], esi
jne 0x40fa95
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40faac
push reloc.DSOUND.dll_DirectSoundCreate
mov edx, str.Control_Paneldont_load
lea esi, [esp + 0x14]
call fcn.0040ff70
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x40fab3
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 4
Function at 0x410060
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4100ce
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x41009f
cmp eax, 2
jne 0x4100ba
test esi, esi
mov eax, dword [esp]
je 0x4100c8
test eax, eax
je 0x4100c3
test al, 1
jne 0x4100ba
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4100c8
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x417e60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5548b0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x30]
call fcn.0050bee6
lea eax, [esp + 0x60]
push eax
xor ebx, ebx
mov dword [esp + 0x84], ebx
mov ecx, dword [esi + 4]
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
push eax
lea ecx, [esp + 0x34]
call fcn.0050c3f4
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x34]
push esi
push edx
call fcn.0050c740
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], eax
call fcn.0050bee6
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBrush.0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], vtable.CBitmap.0
push ebx
mov byte [esp + 0x84], 3
call edi
push eax
lea ecx, [esp + 0x44]
call fcn.0050c3f4
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x2c]
call fcn.0050c6bb
push 0xc0c0c0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x24]
call fcn.0050c6bb
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.0050c740
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x58], edx
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x44]
mov ebp, dword [sym.imp.GDI32.dll_GetPixel]
push 1
push 1
push ecx
call ebp
lea ecx, [esp + 0x20]
mov ebx, eax
call fcn.0050c70e
test esi, esi
je 0x417f9c
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x44]
push esi
push edx
call fcn.0050c740
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
xor edi, edi
cmp dword [esp + 0x64], edi
mov dword [esp + 0x18], eax
jle 0x417ff8
mov eax, dword [esp + 0x68]
xor esi, esi
test eax, eax
jle 0x417fef
mov eax, dword [esp + 0x34]
push esi
push edi
push eax
call ebp
cmp eax, ebx
jne 0x417fe4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
push ecx
push esi
push edi
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x68]
add esi, 1
cmp esi, eax
jl 0x417fc5
add edi, 1
cmp edi, dword [esp + 0x64]
jl 0x417fbf
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x418003
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.0050c740
mov byte [esp + 0x80], 2
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CBitmap.0
call fcn.004029b0
mov byte [esp + 0x80], 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.CBrush.0
call fcn.004029b0
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 0
call fcn.0050c46e
lea ecx, [esp + 0x30]
mov dword [esp + 0x80], 0xffffffff
call fcn.0050c46e
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x418870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x554828
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CBrush.0
mov dword [esp + 0x30], 0
cmp dword [0x5c9bf8], 7
jne 0x4188e0
call fcn.004191f0
test eax, eax
jne 0x4188e0
push 0xf
jmp 0x4188e2
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x38], 0
jne 0x418907
fld qword [0x587878]
sub esp, 8
mov ecx, eax
fstp qword [esp]
call fcn.00414700
add esp, 8
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.0050c6bb
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.0050c70e
cmp dword [0x5c9bf8], 2
jl 0x418951
mov edx, dword [esi + 4]
push 0xf
push 2
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawEdge]
cmp dword [esp + 0x3c], 0
jne 0x418972
push 0
push 7
call ebx
mov ecx, dword [edi]
push eax
mov eax, dword [edi + 4]
add eax, 4
push eax
add ecx, 4
call fcn.00417480
jmp 0x418989
push 7
call ebx
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
add ecx, 4
push ecx
add ebx, 5
mov ecx, eax
call fcn.00417370
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBrush.0
call fcn.004029b0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 8

Function at 0x418f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0050b8e1
movzx ebx, word [esp + 0x14]
mov edi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 2
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x418fb8
push 2
push ebx
xor edi, edi
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x418fb8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x418fb1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x418fb1
call fcn.00418f40
cmp ax, 0x10
jne 0x418fb1
push 0
push esi
push edi
call fcn.00511bf2
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4191f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x258
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x254], eax
cmp dword [0x5c9fcc], 0
jne 0x4192cd
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [0x5c9fcc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4192cd
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4192c3
push esi
push edi
mov ecx, 0xb
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x4192c1
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi*2 + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4192c1
mov dword [0x5c9fc8], 1
pop edi
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x254]
mov eax, dword [0x5c9fc8]
xor ecx, esp
call fcn.0052944d
add esp, 0x258
ret

Function at 0x41a9e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55477a
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.CCommon.0
lea ebx, [esi + 0x1c]
xor ebp, ebp
mov dword [ebx + 4], ebp
mov eax, 0xffff
mov dword [ebx + 8], eax
mov dword [ebx + 0x24], ebp
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], ebp
mov dword [ebx + 0x30], ebp
mov dword [esi + 0x10c], eax
lea eax, [esi + 0x110]
push eax
call fcn.0048e280
mov dword [esp + 0x1c], ebp
mov dword [esi + method.CCommandLineInfo.virtual_0], vtable.CLanguageMgr.0
mov dword [esi + 0x3c4], 1
mov word [esi + 0x3ca], bp
mov word [esi + 0x3c8], bp
lea edi, [esi + 0x3cc]
call fcn.00446db0
lea ecx, [esi + 0x17fc]
push ecx
mov byte [esp + 0x20], 2
call fcn.00464fc0
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push 0xf0
mov dword [esi + 0x10], eax
push ebp
mov dword [esi + 0x14], eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0052d8f0
add esp, 0xc
mov dword [esi + 0x3bc], ebp
mov dword [esi + 0x17f8], ebp
mov dword [esi + 0x1840], ebp
mov dword [esi + 0x184c], 1
mov dword [esi + 0x1844], 0xffffffff
mov dword [esi + 0x1848], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4