joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push esi
mov esi, dword [ebp + 0xa8]
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.0044f370
xor eax, eax
mov dword [ebp - 0x7c], ebx
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor eax, eax
cmp byte [ebp + 0xac], bl
mov dword [ebp - 0x6c], ebx
sete al
dec eax
and eax, 0xffffffd8
add eax, 0x32
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftDataAccess
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push str.FullInstallVer
push dword [ebp - 0x6c]
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push str._d._d._d._d
push eax
call fcn.0044f2d1
add esp, 0x18
cmp dword [ebp - 0x7c], 2
jl 0x4016ca
jne 0x4016c6
cmp dword [ebp - 0x78], edi
jl 0x4016ca
mov al, 1
jmp 0x4016e5
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push edi
push 2
push str.Database_support_requires_that_MDAC_version__d._d_or_later_be_installed._n_MDAC__d._d_detected._
push 0x30
push esi
call fcn.0040b503
add esp, 0x1c
xor al, al
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0xa0
leave
ret

Function at 0x4016fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sMSJET40.DLL
push eax
call fcn.0044f3ea
xor edi, edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403cc0
add esp, 0x1c
test al, al
jne 0x401793
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sMSJET35.DLL
push eax
call fcn.0044f3ea
push edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403cc0
add esp, 0x1c
cmp word [ebp - 0xc], 4
jae 0x4017b8
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push str.Database_support_requires_that_JET_4.0_or_later_be_installed._n_JET__d._d_detected._
push 0x30
push esi
call fcn.0040b503
add esp, 0x14
xor al, al
jmp 0x4017ba
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044f35b
leave
ret
Function at 0x403cc0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xb4]
push ebx
mov ebx, dword [ebp + 0xa8]
push esi
mov esi, dword [ebp + 0xac]
push edi
mov edi, dword [ebp + 0xb0]
mov dword [ebp - 0x74], eax
test esi, esi
je 0x403d0e
xor eax, eax
mov word [esi + 6], ax
mov word [esi + 4], ax
mov word [esi + 2], ax
mov word [esi], ax
test edi, edi
je 0x403d23
xor eax, eax
mov word [edi + 6], ax
mov word [edi + 4], ax
mov word [edi + 2], ax
mov word [edi], ax
and dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x403d3f
xor al, al
jmp 0x403e2d
push eax
call fcn.00419190
pop ecx
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403e22
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x486590
push dword [ebp - 0x6c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403dbf
mov eax, dword [ebp - 0x7c]
test esi, esi
je 0x403d9c
mov cx, word [eax + 0xa]
mov word [esi], cx
mov cx, word [eax + 8]
mov word [esi + 2], cx
mov cx, word [eax + 0xe]
mov word [esi + 4], cx
mov cx, word [eax + 0xc]
mov word [esi + 6], cx
test edi, edi
je 0x403dbf
mov cx, word [eax + 0x12]
mov word [edi], cx
mov cx, word [eax + 0x10]
mov word [edi + 2], cx
mov cx, word [eax + 0x16]
mov word [edi + 4], cx
mov ax, word [eax + 0x14]
mov word [edi + 6], ax
mov esi, dword [ebp - 0x74]
test esi, esi
je 0x403e22
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x6c]
mov byte [esi], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403e22
mov eax, dword [ebp - 0x74]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x68]
push str.StringFileInfo_04x_04xFileDescription
push eax
call fcn.0044f3ea
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x6c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403e22
push dword [ebp - 0x80]
push esi
call fcn.0044fb30
pop ecx
pop ecx
push dword [ebp - 0x6c]
call fcn.004191bf
pop ecx
mov al, 1
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0xa0
leave
ret
Function at 0x404ba6
Capabilities:
Clear file content
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [eax + ebx - 1], 0x5c
jne 0x404bc6
dec eax
push dword [ebp + 8]
add eax, ebx
push str.System_s.DLL
push eax
call fcn.0044f3ea
add esp, 0xc
push 0x4879e8
push dword [ebp + 8]
push dword [0x4ad678]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x4ad678]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x4ad678]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov edi, 0x4000100
push edi
push 4
push 0
push 3
push 0x40000000
push ebx
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push edi
push 3
push 0
push 3
push SysReAllocString
push ebx
call esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x4074d7
Capabilities:
Create directory

Disassembly:
push 0x5c
push dword [esp + 8]
call fcn.0044ed90
pop ecx
pop ecx
test eax, eax
jne 0x4074eb
xor al, al
ret
push esi
push 0x5c
inc eax
push eax
jmp 0x40751e
push 0
push dword [esp + 0xc]
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov byte [esi], 0x5c
test al, al
jne 0x40751a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40752f
push 0x5c
inc esi
push esi
call fcn.0044ed90
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4074f2
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x407533
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push str.Wallpaper
push eax
mov dword [ebp - 0x210], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [ebp - 0x108]
push eax
mov eax, dword [0x4ad774]
add eax, 0x238
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0044f215
pop ecx
neg eax
pop ecx
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0044f35b
leave
ret
Function at 0x407916
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0x98]
push esi
push edi
mov edi, dword [ebp + 0x94]
push 0x104
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [0x4ad774]
add eax, 0x238
push eax
mov dword [ebp - 0x80], edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x7c]
push 0x25
push eax
call fcn.0044ed90
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x7c]
je 0x4079ae
push 0x25
push eax
call fcn.0044ed90
lea esi, [eax + 1]
push 0x25
push esi
call fcn.0044ed90
add esp, 0x10
test eax, eax
je 0x40798e
mov byte [eax], 0
mov eax, dword [0x4ad774]
push esi
add eax, 0x238
push eax
push str.You_have_selected__s_nas_the_path_for_the_output_bitmap__but_the_nenvironment_variable__s_is_not_defined._n_nUse_the_BitmapLocation_menu_item_to_select_a_new_path.
push 0x30
push edi
call fcn.0040b503
add esp, 0x14
xor al, al
jmp 0x407a25
push eax
call fcn.004074d7
pop ecx
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push edi
push ebx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call fcn.00407027
add esp, 0x10
push edi
mov bl, al
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test bl, bl
je 0x4079aa
cmp dword [0x4ad6a0], 2
mov eax, dword [0x4ad774]
mov edx, dword [eax + 0x340]
mov ecx, dword [eax + 0x344]
mov eax, dword [eax + 0x348]
je 0x407a13
xor ecx, ecx
xor eax, eax
push eax
push ecx
push edx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call fcn.004075b4
add esp, 0x14
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0x8c
leave
ret
Function at 0x40869f
Capabilities:
Compare security identifiers

Disassembly:
push 0x28
push 0x49e4f8
call fcn.00454968
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 5
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x408752
lea eax, [ebp - 0x2c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408752
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call esi
push dword [ebp - 0x30]
call fcn.00419190
pop ecx
mov edi, eax
mov dword [ebp - 0x38], edi
cmp edi, ebx
je 0x408752
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
push edi
push 1
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x408752
push dword [ebp - 0x34]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x25], al
mov dword [ebp - 4], 0xfffffffe
call fcn.00408769
mov al, byte [ebp - 0x25]
call fcn.004549b0
ret
Function at 0x408d6e
Capabilities:
Create service
Delete service
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0xb8]
sub esp, 0x138
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0xb4], eax
mov eax, dword [ebp + 0xc0]
push ebx
push esi
push edi
mov dword [ebp - 0x5c], eax
push 0x104
lea eax, [ebp - 0x50]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x50]
push ecx
push 1
push 3
push 0x110
mov ebx, 0xf01ff
push ebx
mov esi, str.BGInfo
push esi
push esi
push eax
mov dword [ebp - 0x58], eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x54], eax
cmp eax, edi
jne 0x408df2
push ebx
push esi
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x60], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
cmp ebx, edi
je 0x408e3f
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x7c], 1
je 0x408e3f
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408e1f
push dword [ebp - 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x58]
call esi
mov ecx, dword [ebp + 0xb4]
xor eax, eax
cmp ebx, edi
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0xb8
leave
ret

Function at 0x408e6e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [esi], bl
jne 0x408ebe
call fcn.0040869f
test al, al
je 0x408ebe
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], str.BGInfo
mov dword [ebp - 0xc], 0x408b6d
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x408eb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
je 0x408ebe
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [ebp + 0xc], bl
je 0x408ee0
push esi
call fcn.00408d6e
pop ecx
test al, al
jne 0x408eb7
push str.Unable_to_relaunch_as_a_service._n_nThis_operation_requires_that_BGInfo_be_run_under_an_Administrator_account.
push 0x10
push ebx
call fcn.0040b503
add esp, 0xc
jmp 0x408eb7
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x4090d1
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
cmp dword [esi + 0x124], ebx
je 0x40919a
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
lea eax, [esi + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x78]
push eax
push 0x2001f
push ebx
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409199
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x90]
push eax
push ebx
mov dword [ebp - 0x7c], edi
push ebx
mov edi, str.Wallpaper
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x90]
push eax
call fcn.0044f215
pop ecx
pop ecx
test eax, eax
jne 0x409190
lea ebx, [esi + 0x1c]
push ebx
call fcn.0044fc30
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push edi
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push dword [ebp - 0x80]
add esi, 0x238
push esi
call fcn.0044fb30
pop ecx
pop ecx
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0x198
leave
ret 4
Function at 0x409261
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1b0]
push ebx
push esi
mov esi, dword [ebp + 0x1ac]
push edi
xor ebx, ebx
push 0x103
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x9d]
push ebx
push eax
mov dword [ebp - 0x6c], esi
mov byte [ebp + 0x9c], bl
call fcn.0044f370
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x9c]
push eax
push ebx
push ebx
push str.Wallpaper
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], 0x104
call esi
push 4
pop edi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.WallpaperPos
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
call esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push str.Background
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
call esi
push 0x104
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [ebp + 0x1b4]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x6c]
call fcn.00412a93
add esp, 0xc
test al, al
je 0x40939e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push str.WallpaperUser
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
call esi
cmp dword [ebp - 0x78], ebx
je 0x40939c
lea eax, [ebp + 0x9c]
push eax
call fcn.0044fc30
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ecx
inc eax
push eax
lea eax, [ebp + 0x9c]
push eax
push 1
push ebx
push str.Wallpaper
push dword [ebp - 0x6c]
call esi
push edi
lea eax, [ebp - 0x74]
push eax
push edi
push ebx
push str.WallpaperPos
push dword [ebp - 0x6c]
call esi
push edi
lea eax, [ebp - 0x7c]
push eax
push edi
push ebx
push str.Background
push dword [ebp - 0x6c]
call esi
mov al, 1
mov ecx, dword [ebp + 0x1a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0x1a4
leave
ret
Function at 0x409516
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x130]
cmp byte [esi], 0
mov dword [ebp - 0x80], eax
jne 0x40954d
xor al, al
jmp 0x4095b8
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp + 0x88]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x3b
push esi
call fcn.0044ed90
pop ecx
pop ecx
test eax, eax
je 0x409584
lea eax, [ebp + 0x88]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0044fb30
pop ecx
pop ecx
jmp 0x409598
push 0
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [edi + 0x234], 0
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call fcn.0040351f
add esp, 0xc
mov al, 1
pop ebx
mov ecx, dword [ebp + 0x18c]
pop edi
xor ecx, ebp
pop esi
call fcn.0044f35b
add ebp, 0x190
leave
ret 4
Function at 0x409ed6
Capabilities:
Delete registry key
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call fcn.004093b6
test al, al
jne 0x409f1e
mov eax, dword [esi]
test eax, eax
jne 0x409ef0
mov eax, 0x488ba8
push eax
push str.The_configuration__s_has_changed._n_nDo_you_want_to_save_the_changes_
push 0x33
push dword [esp + 0x14]
call fcn.0040b503
add esp, 0x10
cmp eax, 2
jne 0x409f0d
xor al, al
jmp 0x409f20
cmp eax, 6
jne 0x409f1e
pop esi
mov ecx, dword [0x4ad774]
jmp fcn.00409bba
mov al, 1
pop esi
ret 4
Function at 0x40b3ed
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov eax, dword [0x4ad76c]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x40b4ab
push esi
push 0x48b3c0
push eax
call fcn.00455ae5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40b4aa
push 0x103
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.0044f370
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x124], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x1c]
push eax
call fcn.00455a05
lea eax, [ebp - 0x10]
push eax
call fcn.0045593d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x120]
push eax
push str._s__s__s:_n
push esi
call fcn.004556f4
push edi
push str._s_n_n
push esi
call fcn.004556f4
push esi
call fcn.00455678
add esp, 0x2c
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5b3
je 0x40b4ec
call fcn.00408794
test al, al
je 0x40b4ec
cmp byte [0x4ad768], 0
je 0x40b4d5
test byte [ebp + 0xc], 0xf
jne 0x40b4d5
xor eax, eax
inc eax
jmp 0x40b4f6
push dword [ebp + 0xc]
push str.BGInfo
push edi
push dword [ebp - 0x128]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40b4f6
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0044f35b
leave
ret
Function at 0x40d013
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push str.MAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.MAPIResolveName
push ebx
call esi
push str.MAPISendMail
push ebx
mov edi, eax
call esi
push str.MAPIFreeBuffer
push ebx
mov dword [ebp - 8], eax
call esi
push str.MAPILogon
push ebx
mov dword [ebp - 0xc], eax
call esi
push str.MAPILogoff
push ebx
mov dword [ebp - 0x10], eax
call esi
xor esi, esi
mov dword [ebp - 0x14], eax
cmp edi, esi
je 0x40d132
cmp dword [ebp - 8], esi
je 0x40d132
cmp dword [ebp - 0xc], esi
je 0x40d132
lea eax, [ebp - 4]
push eax
push esi
push 0x20000
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [ebp - 0x10]
cmp eax, esi
je 0x40d0b2
push str.MAPI_error__MAPILogon_
push eax
push 0x30
push dword [ebp + 8]
call fcn.0040b551
add esp, 0x10
jmp 0x40d144
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2c
xor edi, edi
lea eax, [ebp - 0x58]
push esi
inc edi
push eax
mov dword [ebp - 0x24], str.Bryce_Cogswell
mov dword [ebp - 0x20], str.cogswell_winternals.com
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x5c], esi
call fcn.0044f370
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x54], eax
push esi
lea eax, [ebp - 0x2c]
push 9
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x58], str.BGInfo_bug_report
push dword [ebp - 4]
mov dword [ebp - 0x3c], edi
call dword [ebp - 8]
cmp eax, esi
je 0x40d11c
push str.MAPI_error__MAPISendMail_
jmp 0x40d09f
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x40d146
push str.No_MAPI_client_found
push 0x30
push dword [ebp + 8]
call fcn.0040b503
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
leave
ret