joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476f4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x48d280]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x476f97
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x47f91c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
test esi, esi
jne 0x47f948
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x47f964
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x47fa65
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x47f9f3
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004770f0
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x47f97f
test esi, esi
jbe 0x47fa65
lea edx, [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp esi, ebx
mov edx, 0x10
sub edx, esi
lea eax, [ebp + esi - 0x18]
xor ecx, ecx
call fcn.004035e0
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004770f0
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47faac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
test esi, esi
jne 0x47fad8
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x47faf4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x47fbf5
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x47fb83
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.00478298
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x47fb0f
test esi, esi
jbe 0x47fbf5
lea edx, [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp esi, ebx
mov edx, 0x10
sub edx, esi
lea eax, [ebp + esi - 0x18]
xor ecx, ecx
call fcn.004035e0
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.00478298
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47fc3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
test esi, esi
jne 0x47fc68
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x47fc84
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x47fd85
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x47fd13
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004797c0
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x47fc9f
test esi, esi
jbe 0x47fd85
lea edx, [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp esi, ebx
mov edx, 0x10
sub edx, esi
lea eax, [ebp + esi - 0x18]
xor ecx, ecx
call fcn.004035e0
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x14]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0xc]
xor dword [edx], eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004797c0
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47fdcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47ff06
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x47fe0b
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x47fe27
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x47fef0
mov eax, esi
and eax, 0xf
test eax, eax
jbe 0x47fe59
lea edx, [ebp - 0x4c]
mov eax, 0x476d40
call fcn.00406a68
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x476ce8]
call fcn.0040c660
call fcn.00404518
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x47fef0
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0047b968
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x28]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x24]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x20]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0x1c]
xor dword [edx], eax
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x47fe70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ff0d
lea eax, [ebp - 0x4c]
call fcn.00404b68
ret
Function at 0x47ff54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48008e
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x47ff93
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x47ffaf
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x480078
mov eax, esi
and eax, 0xf
test eax, eax
jbe 0x47ffe1
lea edx, [ebp - 0x4c]
mov eax, 0x476d40
call fcn.00406a68
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x476ce8]
call fcn.0040c660
call fcn.00404518
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x480078
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0047cb10
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x28]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x24]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x20]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0x1c]
xor dword [edx], eax
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x47fff8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480095
lea eax, [ebp - 0x4c]
call fcn.00404b68
ret
Function at 0x4800dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x480216
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x48011b
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00475d1c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
jmp 0x480137
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00475cfc
pop edx
sub edx, eax
mov eax, esi
call fcn.00476d48
mov esi, eax
test esi, esi
je 0x480200
mov eax, esi
and eax, 0xf
test eax, eax
jbe 0x480169
lea edx, [ebp - 0x4c]
mov eax, 0x476d40
call fcn.00406a68
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x476ce8]
call fcn.0040c660
call fcn.00404518
mov eax, dword [ebp + 0xc]
push esi
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp esi, 0x10
jb 0x480200
lea edx, [ebp - 0x18]
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0047e038
lea eax, [ebp - 0x38]
mov eax, dword [eax]
lea edx, [ebp - 0x28]
xor dword [edx], eax
lea eax, [ebp - 0x34]
mov eax, dword [eax]
lea edx, [ebp - 0x24]
xor dword [edx], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
lea edx, [ebp - 0x20]
xor dword [edx], eax
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
lea edx, [ebp - 0x1c]
xor dword [edx], eax
lea edx, [ebp - 0x28]
mov ecx, 0x10
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
cmp ebx, 0x10
push esi
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
sub esi, 0x10
cmp esi, 0x10
jae 0x480180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48021d
lea eax, [ebp - 0x4c]
call fcn.00404b68
ret
Function at 0x483a9c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x483ba8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.00483a34
mov esi, eax
test esi, esi
jle 0x483b8d
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405060
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x483b8d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x483b26
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405060
cmp dword [ebp - 8], 0
jne 0x483b5f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x483b84
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483baf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b8c
ret
Function at 0x483bbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x483cf1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.00483a34
mov esi, eax
test esi, esi
jle 0x483cd6
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405060
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x483cd6
mov edi, dword [ebp - 4]
test edi, edi
je 0x483c40
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405060
cmp dword [ebp - 8], 0
jne 0x483c5d
xor edi, edi
jmp 0x483c67
mov eax, dword [ebp - 8]
call fcn.00404ff8
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x483ccd
mov eax, dword [ebp - 0x18]
call fcn.00402e84
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x483cc6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x483cbd
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x483ccd
mov eax, esi
call fcn.00402ea0
jmp 0x483ccd
mov eax, esi
call fcn.00402ea0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483cf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b8c
ret
Function at 0x483e4c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x483f13
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.00483a34
mov esi, eax
test esi, esi
jle 0x483ef8
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405060
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x483ef8
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x483ec5
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405060
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483f1a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b8c
ret