joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009580
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1022eaa4], 0
mov byte [0x1022eaa8], 0
mov dword [0x1022eaa0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100095e6
mov eax, dword [0x1022ea98]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10009618
mov eax, 0x1fdd
xor ecx, ecx
mov dword [0x1022eaa0], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10009618
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1022ea98], 0x1fdd
mov eax, dword [0x1022eaa0]
add eax, 1
mov dword [0x1022eaa0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100095e6
jmp 0x100095cd
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
add ecx, 0xfffff6b9
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x1022eaac], 0
mov edi, dword [0x1022eaa4]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1022eaac], esi
mov dword [0x1022ea9c], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x1022eaa4], edx
mov dword [0x1022ea98], ecx
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ebx + ecx]
mov byte [0x1022eaa8], cl
mov dword [0x1022ea9c], 0xe30
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x1022ea9c]
add ecx, 0xfffffd81
mov dword [0x1022ea98], ecx
mov cl, byte [0x1022eaa8]
mov edx, dword [0x1022eaa4]
mov byte [ebx + edx], cl
mov edx, dword [0x1022eaa0]
add edx, 1
mov dword [0x1022eaa0], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x100095bd
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000a780
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1022ea98], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000a7ee
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000a874
jmp 0x1000a887
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000a896
jmp 0x1000a887
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1000a81b
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x1000a7ee
mov eax, dword [ebp - 0x20]
mov dword [0x1022ea9c], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1000a887
mov dword [0x1022ea9c], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1000a887
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000a887
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000a7b6
jmp 0x1000a887
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000a7ce
xor eax, eax
mov dword [0x1022ea9c], 0x1864
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x1000ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1022eaa0], 0
mov dword [0x1022eaa4], 0
mov dword [0x1022eab0], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1000adee
jmp 0x1000acea
mov eax, dword [0x1022eaa0]
mov ecx, dword [0x1022eaa4]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jmp 0x1000acfb
jmp 0x1000adee
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000acfb
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov edi, ecx
add edi, 1
add edx, 1
mov dword [0x1022ea98], 0x1e8a
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1022eaa0], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1022eaa4], edx
mov dword [0x1022ea98], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1022eaa8], cl
mov dword [0x1022ea9c], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1022eaa8]
mov edx, dword [0x1022eaa4]
mov byte [ebx + edx], cl
mov edx, dword [0x1022eaa0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1022eaa4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1022eab0], ecx
mov dword [0x1022ea98], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
mov ch, byte [edx + esi]
mov dword [0x1022ea9c], 0xbad
mov dword [0x1022ea98], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x20], edi
je 0x1000ace5
jmp 0x1000accc
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000ae00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x1022ea98], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10009710
lea ecx, [0x10009480]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x30], edx
mov dword [esp + 0x4c], 0x171400
mov edx, dword [0x1022ea84]
mov dword [esp + 0x54], edx
mov edx, dword [0x1022ea88]
mov dword [esp + 0x48], edx
mov edx, dword [0x1022ea8c]
mov dword [esp + 0x60], edx
mov edx, dword [0x1022ea90]
mov dword [esp + 0x68], edx
mov edx, dword [0x1022ea94]
mov dword [esp + 0x34], edx
mov dword [0x1022ea98], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1000aea6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1000aec9
jmp 0x1000aeb5
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1000ae8c
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000aea6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x84], ecx
mov dword [0x1022ea9c], 0x1fcc
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x6c], eax
call fcn.1000a780
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x1000af33
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000a0a0
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1022ea98], 0x1ed4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3a6327fd
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x528145bc
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x505390ad
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
xor esi, esi
push 0x5053147c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], esi
mov dword [ecx], esi
call fcn.50538fbc
lea eax, [ebp - 4]
push eax
mov ecx, 0x5055df50
call fcn.5053903c
push 0x5053144c
lea ecx, [ebp - 4]
call fcn.50539017
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push dword [ebp - 4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.vsansi.dll_RegOpenKeyExW]
test eax, eax
jne 0x50539153
push edi
mov edi, dword [sym.imp.vsansi.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 8], esi
push esi
jmp 0x50539142
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x21c]
push eax
call fcn.50538fbc
inc dword [ebp - 8]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0x104
call edi
test eax, eax
je 0x5053911e
pop edi
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x14]
pop esi
leave
ret

Function at 0x5053996a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x505399c2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x5053998f
xor eax, eax
jmp 0x505399c1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x505399b3
cmp esi, eax
jae 0x5053998b
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x505399a5
cmp esi, eax
jae 0x5053998b
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x5053b276
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov ecx, 0x5055df50
call fcn.5053af37
push eax
lea ecx, [ebp - 0xc]
call fcn.5053aef5
push 0x505323c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [ebp - 0xc]
xor edi, edi
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 4], edi
je 0x5053b34f
lea eax, [ebp - 4]
push eax
push 6
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x5053b341
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push esi
call dword [eax + 0x28]
test eax, eax
jl 0x5053b341
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x2c]
call fcn.50559732
test eax, eax
je 0x5053b30f
push 0x505323b4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5053b341
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call dword [sym.imp.vsansi.dll_SHGetPathFromIDListW]
test eax, eax
jl 0x5053b341
lea eax, [ebp - 0x214]
jmp 0x5053b33b
push 0x505323a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5053b341
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x5053b341
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], 0
je 0x5053b34f
push dword [ebp - 4]
call fcn.5053c302
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x2c]
lea ecx, [ebp - 0xc]
call fcn.50556058
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5053d6ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], ecx
jne 0x5053d70b
mov eax, 0x80004003
jmp 0x5053d797
push ebx
push esi
mov esi, dword [sym.imp.vsansi.dll_RegQueryValueExW]
mov dword [eax], edi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ecx]
mov dword [ebp - 0xc], edi
call esi
mov ebx, eax
cmp ebx, edi
jne 0x5053d785
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x5053d793
shr eax, 1
dec eax
push eax
lea ecx, [ebp - 4]
call fcn.5053d5e4
cmp dword [ebp - 4], edi
je 0x5053d79c
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push edi
push edi
push dword [ebp + 8]
push dword [eax]
call esi
mov ebx, eax
cmp ebx, edi
jne 0x5053d77a
lea ecx, [ebp - 4]
call fcn.50538eef
test eax, eax
je 0x5053d77a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov dword [ecx], eax
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebx, edi
jle 0x5053d793
and ebx, 0xffff
or ebx, 0x80070000
mov eax, ebx
pop esi
pop ebx
pop edi
leave
ret 8
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 0x8007000e
jmp 0x5053d795
Function at 0x5053fbe3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov ecx, 0x5055df50
call fcn.5053af37
push eax
lea ecx, [ebp - 4]
call fcn.5053aef5
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
je 0x5053fd1b
cmp word [eax], di
je 0x5053fd1b
push ebx
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ebx, [esi + 0x64]
cmp dword [ebx], edi
mov dword [esi + 0x78], eax
jne 0x5053fc72
push ebx
mov eax, 0x50537188
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
cmp dword [ebx], edi
je 0x5053fc72
push 0x130
push dword [0x5055e284]
mov word [ebp - 0x18], 3
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov ebx, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push edi
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x6c], eax
je 0x5053fcff
push edi
push edi
push edi
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x70], eax
je 0x5053fcff
push 0x10
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
je 0x5053fcae
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x6c]
mov dword [eax], edi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
jmp 0x5053fcb0
xor eax, eax
cmp eax, edi
mov dword [esi + 0x68], eax
je 0x5053fcff
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x2c]
lea eax, [ebp - 8]
push eax
push edi
push dword [esi + 0x68]
push 0x5053f90e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x7c], eax
je 0x5053fcff
push edi
push dword [esi + 0x6c]
mov ecx, 0x5055df50
call fcn.5054fe3d
push 0xffffffffffffffff
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esi + 0x74], 1
jmp 0x5053fd10
mov ecx, dword [esi + 0x68]
cmp ecx, edi
je 0x5053fd10
push 1
call fcn.505424c0
mov dword [esi + 0x68], edi
lea ecx, [ebp - 4]
call fcn.50556058
pop ebx
jmp 0x5053fd23
lea ecx, [ebp - 4]
call fcn.50556058
pop edi
pop esi
leave
ret 4

Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8
Function at 0x50546171
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x5055e284]
push 0xf0
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x50546225
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x50546225
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x50546225
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ax, word [esi]
test ax, ax
je 0x50546224
inc esi
inc esi
mov cx, word [esi]
inc esi
inc esi
mov edx, dword [esi]
add esi, 4
cmp cx, 0x403
mov dword [ebp + 8], edx
jne 0x505461e9
push esi
push 0
push 0x143
jmp 0x50546209
cmp cx, 0x1234
jne 0x5054621b
or dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x28]
push ecx
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], esi
push 0x401
movzx eax, ax
push eax
push dword [ebx + 4]
call edi
cmp eax, 0xffffffff
jne 0x5054621b
and dword [ebp - 4], 0
add esi, dword [ebp + 8]
cmp dword [ebp - 4], 0
jne 0x505461c1
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x5054be80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x50533ed8
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.MSVCR70.dll_swprintf]
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x210]
push eax
push SysReAllocStringLen
call dword [sym.imp.vsansi.dll_RegOpenKeyW]
test eax, eax
jne 0x5054beff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.vsansi.dll_RegQueryValueExW]
test eax, eax
jne 0x5054beff
cmp dword [ebp - 4], eax
je 0x5054beff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x418]
push edx
push 0x50533ec4
push dword [ebp + 0xc]
push eax
call dword [ecx + 0xc]
leave
ret 0xc
Function at 0x5054c6c6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
setg bl
push edi
push 0xbb9
push dword [ebp + 8]
lea ebx, [ebx + ebx - 1]
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov dword [ebp + 0xc], eax
call esi
mov edi, eax
test edi, edi
jl 0x5054c7eb
lea eax, [edi + ebx]
test eax, eax
mov dword [ebp - 4], eax
jl 0x5054c7eb
cmp eax, dword [ebp + 0x10]
jge 0x5054c7eb
push 0xf000
push edi
push 0x102c
push dword [ebp + 0xc]
call esi
and dword [ebp - 0x28], 0
or dword [ebp - 0x20], 0xffffffff
mov ebx, eax
lea eax, [ebp - 0x158]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1005
push dword [ebp + 0xc]
shr ebx, 0xc
dec ebx
mov dword [ebp - 0x30], 0xd
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], 0x100
call esi
test eax, eax
je 0x5054c7eb
push 0
push edi
push 0x1008
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x5054c7eb
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1007
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], edi
call esi
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 0x48], 0xf000
inc eax
shl eax, 0xc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x58]
push eax
push edi
push 0x102b
push dword [ebp + 0xc]
call esi
test edi, edi
jle 0x5054c7e2
mov eax, dword [ebp + 0x10]
dec eax
cmp edi, eax
jge 0x5054c7e2
xor eax, eax
cmp dword [ebp - 8], eax
setge al
add eax, 0xbba
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
jmp 0x5054c7e5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x5054d1cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.5054d0ea
test eax, eax
je 0x5054d25b
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push SysReAllocStringLen
call dword [sym.imp.vsansi.dll_RegOpenKeyExW]
test eax, eax
jne 0x5054d24d
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], 0x200
push dword [ebp - 8]
call dword [sym.imp.vsansi.dll_RegQueryValueExW]
test eax, eax
jne 0x5054d24d
xor esi, esi
inc esi
cmp dword [ebp - 4], esi
jne 0x5054d24d
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x5054d24f
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x5054d25f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.5054d0ea
test eax, eax
je 0x5054d2c9
push esi
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
push SysReAllocStringLen
call dword [sym.imp.vsansi.dll_RegCreateKeyExW]
test eax, eax
jne 0x5054d2bd
push dword [ebp + 0x14]
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jne 0x5054d2bd
inc esi
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x5054d41b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
push dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x5054d46a
inc edi
xor ecx, ecx
test eax, eax
jle 0x5054d488
mov dl, byte [ebp + ecx - 0x18]
cmp dl, 0x30
jl 0x5054d485
cmp dl, 0x39
jg 0x5054d485
inc ecx
cmp ecx, eax
jl 0x5054d470
jmp 0x5054d488
xor edi, edi
inc edi
test edi, edi
je 0x5054d49b
push 0x5053406c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR70.dll_strtol]
add esp, 0xc
test eax, eax
jge 0x5054d4b5
xor edi, edi
inc edi
test edi, edi
mov ecx, dword [ebp + 0x18]
jne 0x5054d4be
mov dword [ecx], eax
mov eax, 0x3e8
cmp dword [ecx], eax
jle 0x5054d4c9
mov dword [ecx], eax
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ecx]
call dword [sym.imp.MSVCR70.dll__itoa]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR70.dll_mbstowcs]
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x20]
mov edi, 0x50533cc4
push 0
push edi
call fcn.5054d25f
cmp dword [esi], 0
mov eax, 0x50534064
jne 0x5054d51e
mov eax, 0x5053405c
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 0x1c]
push 0
push edi
call fcn.5054d25f
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CheckDlgButton]
push dword [esi]
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebx
leave
ret 0x1c