joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69b59400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0xc], 0x434d594b
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
jne 0x69b59678
fld qword [ebp - 0x20]
fldz
fcompi st(1)
ja 0x69b59608
fld dword [0x69b82468]
fxch st(1)
fcompi st(1)
fstp st(0)
ja 0x69b5960a
jmp 0x69b59458
fstp st(0)
lea esi, [esi]
mov dword [esp], esi
call fcn.69b4ad90
mov ebx, eax
test eax, eax
je 0x69b5966a
mov dword [esp], eax
mov dword [esp + 4], 0x9999999a
mov dword [esp + 8], 0x40119999
call fcn.69b4b880
mov dword [esp + 4], 0x6c696e6b
mov dword [esp], ebx
call fcn.69b4b850
mov dword [esp + 4], 0x434d594b
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x434d594b
mov dword [esp], ebx
call fcn.69b4b810
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.69b4b6b0
mov dword [esp + 8], 4
mov dword [esp + 4], 4
mov dword [esp], esi
call fcn.69b6cf60
mov edi, eax
test eax, eax
je 0x69b59660
mov dword [esp], 0x434d594b
call fcn.69b79910
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x11
mov dword [esp], esi
mov dword [ebp - 0x24], eax
call fcn.69b6bdc0
mov edx, eax
test eax, eax
je 0x69b59658
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x69b58920
mov dword [esp], edx
mov dword [ebp - 0x28], edx
call fcn.69b6c120
test eax, eax
je 0x69b59658
mov eax, dword [ebp - 0x24]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.69b6b990
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.69b6d330
test eax, eax
je 0x69b59658
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 8], edx
call fcn.69b6d330
test eax, eax
je 0x69b59658
mov eax, dword [ebp - 0x24]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.69b6b990
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.69b6d330
test eax, eax
je 0x69b59658
mov edx, 0x69b82140
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b59658
mov dword [esp + 8], edi
mov dword [esp + 4], 0x41324230
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b59658
mov edx, str.ink_limiting_built_in
mov eax, ebx
call fcn.69b58bb0
test eax, eax
je 0x69b59658
mov dword [esp], edi
call fcn.69b6d0e0
jmp 0x69b5966a
fstp st(0)
mov dword [esp + 8], str.InkLimiting:_Limit_should_be_between_0..400
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.69b49c40
fld qword [ebp - 0x20]
fldz
fld st(0)
fcompi st(2)
ja 0x69b59648
fstp st(0)
fld dword [0x69b82468]
fld st(0)
fxch st(2)
fcompi st(2)
fstp st(1)
jbe 0x69b59450
jmp 0x69b5964a
fstp st(1)
fstp qword [ebp - 0x20]
jmp 0x69b59458
mov dword [esp], edi
call fcn.69b6d0e0
mov dword [esp], ebx
xor ebx, ebx
call fcn.69b4c230
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
xor ebx, ebx
mov dword [esp + 8], str.InkLimiting:_Only_CMYK_currently_supported
mov dword [esp + 4], 9
call fcn.69b49c40
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x69b596d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x69b59800
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.69b58e00
mov ebx, eax
test eax, eax
je 0x69b597f0
mov dword [esp], eax
mov dword [esp + 4], 0xcccccccd
mov dword [esp + 8], 0x4000cccc
call fcn.69b4b880
mov dword [esp + 4], 0x61627374
mov dword [esp], ebx
call fcn.69b4b850
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b810
mov edx, str.Lab_identity_built_in
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b597f0
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6cf60
mov esi, eax
test eax, eax
je 0x69b597e8
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6c380
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.69b6d330
test eax, eax
je 0x69b597e0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x41324230
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b597e0
mov dword [esp], esi
call fcn.69b6d0e0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.69b6d0e0
mov dword [esp], ebx
call fcn.69b4c230
add esp, 0x1c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.69b5a940
jmp 0x69b596e7

Function at 0x69b59830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x69b59958
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.69b58e00
mov ebx, eax
test eax, eax
je 0x69b5992b
mov dword [esp], eax
mov dword [esp + 4], 0x9999999a
mov dword [esp + 8], 0x40119999
call fcn.69b4b880
mov dword [esp + 4], 0x61627374
mov dword [esp], ebx
call fcn.69b4b850
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b810
mov edx, str.Lab_identity_built_in
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b59940
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6cf60
mov esi, eax
test eax, eax
je 0x69b59940
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6b990
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.69b6d330
test eax, eax
je 0x69b59938
mov dword [esp + 8], esi
mov dword [esp + 4], 0x41324230
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b59938
mov dword [esp], esi
call fcn.69b6d0e0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.69b6d0e0
mov dword [esp], ebx
xor ebx, ebx
call fcn.69b4c230
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.69b5a940
jmp 0x69b59847
Function at 0x69b59990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
call fcn.69b5a940
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.69b58e00
mov ebx, eax
test eax, eax
je 0x69b59a85
mov dword [esp], eax
mov dword [esp + 4], 0x9999999a
mov dword [esp + 8], 0x40119999
call fcn.69b4b880
mov dword [esp + 4], 0x61627374
mov dword [esp], ebx
call fcn.69b4b850
mov dword [esp + 4], 0x58595a20
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x58595a20
mov dword [esp], ebx
call fcn.69b4b810
mov edx, str.XYZ_identity_built_in
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b59a98
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6cf60
mov esi, eax
test eax, eax
je 0x69b59a98
mov dword [esp + 4], 3
mov dword [esp], edi
call fcn.69b6b990
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.69b6d330
test eax, eax
je 0x69b59a90
mov dword [esp + 8], esi
mov dword [esp + 4], 0x41324230
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b59a90
mov dword [esp], esi
call fcn.69b6d0e0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.69b6d0e0
mov dword [esp], ebx
xor ebx, ebx
call fcn.69b4c230
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x69b59c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
fld qword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x34]
fstp qword [ebp - 0x70]
fld qword [ebp + 0x18]
fstp qword [ebp - 0x68]
fld qword [ebp + 0x20]
fstp qword [ebp - 0x60]
fld qword [ebp + 0x28]
fstp qword [ebp - 0x58]
cmp dword [ebp + 0x30], eax
jne 0x69b59de0
mov dword [ebp - 0x50], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.69b4ad90
mov ebx, eax
test eax, eax
je 0x69b59dd0
mov dword [esp], eax
mov dword [esp + 4], 0x61627374
call fcn.69b4b850
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b810
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.69b4b6b0
mov eax, dword [ebp + 8]
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.69b6cf60
lea edx, [ebp - 0x70]
mov esi, eax
lea eax, [ebp - 0xac]
test esi, esi
je 0x69b59dc8
lea esi, [esi]
mov dword [eax], edi
add eax, 4
cmp edx, eax
jne 0x69b59cf0
lea eax, [ebp - 0xac]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 3
mov dword [esp], eax
call fcn.69b6bb70
mov edi, eax
test eax, eax
je 0x69b59dc0
lea edx, [ebp - 0x70]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0x69b58c90
mov dword [esp], eax
call fcn.69b6c120
test eax, eax
je 0x69b59dc0
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.69b6d330
test eax, eax
je 0x69b59dc0
mov edx, str.BCHS_built_in
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b59dd0
call fcn.69b5a930
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x77747074
call fcn.69b4c910
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], 0x41324230
call fcn.69b4c910
mov dword [esp], esi
call fcn.69b6d0e0
add esp, 0xec
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.69b6d0e0
mov dword [esp], ebx
call fcn.69b4c230
add esp, 0xec
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x30]
xor edx, edx
lea ebx, [ebp - 0xc8]
mov dword [ebp - 0x50], 1
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xd0], eax
fild qword [ebp - 0xd0]
mov dword [esp], ebx
fstp qword [esp + 4]
call fcn.69b5a970
lea eax, [ebp - 0x48]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.69b77840
mov eax, dword [ebp + 0x34]
xor edx, edx
mov dword [esp], ebx
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xd0], eax
fild qword [ebp - 0xd0]
fstp qword [esp + 4]
call fcn.69b5a970
lea eax, [ebp - 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.69b77840
jmp 0x69b59c6a
Function at 0x69b59eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
fld1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
fstp qword [ebp - 0x30]
mov esi, dword [ebp + 8]
fldz
mov dword [ebp - 0x40], 0
fst qword [ebp - 0x28]
mov dword [esp], esi
fstp qword [ebp - 0x20]
call fcn.69b4ad90
mov ebx, eax
test eax, eax
je 0x69b5a075
mov dword [esp], eax
mov dword [esp + 4], 0x9999999a
mov dword [esp + 8], 0x40119999
call fcn.69b4b880
mov edx, str.NULL_profile_built_in
mov eax, ebx
call fcn.69b58ab0
test eax, eax
je 0x69b5a088
mov dword [esp + 4], 0x70727472
mov dword [esp], ebx
call fcn.69b4b850
mov dword [esp + 4], 0x47524159
mov dword [esp], ebx
call fcn.69b4b830
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call fcn.69b4b810
mov dword [esp + 8], 1
mov dword [esp + 4], 3
mov dword [esp], esi
call fcn.69b6cf60
mov edi, eax
test eax, eax
je 0x69b5a088
lea eax, [ebp - 0x40]
mov dword [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.69b61570
lea ecx, [ebp - 0x3c]
mov dword [esp + 4], 3
mov dword [esp + 8], ecx
mov dword [esp], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
call fcn.69b6b830
lea ecx, [ebp - 0x3c]
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp], esi
mov dword [ebp - 0x4c], eax
call fcn.69b6b830
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.69b618b0
mov edx, dword [ebp - 0x4c]
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 8], edx
call fcn.69b6d330
test eax, eax
je 0x69b5a080
lea eax, [ebp - 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.69b6b9c0
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.69b6d330
test eax, eax
je 0x69b5a080
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.69b6d330
test eax, eax
je 0x69b5a080
mov dword [esp + 8], edi
mov dword [esp + 4], 0x42324130
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b5a080
call fcn.69b5a930
mov dword [esp + 4], 0x77747074
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.69b4c910
test eax, eax
je 0x69b5a080
mov dword [esp], edi
call fcn.69b6d0e0
add esp, 0x6c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call fcn.69b6d0e0
mov dword [esp], ebx
xor ebx, ebx
call fcn.69b4c230
add esp, 0x6c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x69b695d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
mov dword [esp + 4], 0x7258595a
call fcn.69b4c580
mov dword [esp], ebx
mov dword [esp + 4], 0x6758595a
mov esi, eax
call fcn.69b4c580
mov dword [esp], ebx
mov dword [esp + 4], 0x6258595a
mov edi, eax
call fcn.69b4c580
test esi, esi
sete cl
test edi, edi
mov ebx, eax
sete al
or cl, al
jne 0x69b696a0
test ebx, ebx
je 0x69b696a0
fld qword [ebx]
mov eax, dword [ebp - 0x1c]
fstp qword [esp + 0x14]
fld qword [edi]
fstp qword [esp + 0xc]
fld qword [esi]
mov dword [esp], eax
fstp qword [esp + 4]
call fcn.69b6d910
fld qword [ebx + 8]
mov eax, dword [ebp - 0x1c]
add eax, 0x18
fstp qword [esp + 0x14]
fld qword [edi + 8]
fstp qword [esp + 0xc]
fld qword [esi + 8]
mov dword [esp], eax
fstp qword [esp + 4]
call fcn.69b6d910
fld qword [ebx + 0x10]
mov eax, dword [ebp - 0x1c]
fstp qword [esp + 0x14]
fld qword [edi + 0x10]
lea edi, [eax + 0x30]
fstp qword [esp + 0xc]
fld qword [esi + 0x10]
mov dword [esp], edi
fstp qword [esp + 4]
call fcn.69b6d910
add esp, 0x3c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4061dc
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40618e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4061ac
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40620a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
add byte [eax], al
and byte [ecx + 0x1065], al
invalid
invalid
add byte [eax], al
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4061f1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4061fa
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x406204
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4061e6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406170
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x406257
dec eax
je 0x40624e
sub eax, 3
je 0x406245
mov dword [ebp - 4], 0x40
jmp 0x406274
mov dword [ebp - 4], 4
jmp 0x40625a
mov dword [ebp - 4], 0x20
jmp 0x40625a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4062a6
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x406226
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00405ab7
add byte [esi + 0x31], al
leave
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x4062b2
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
test dword [esp + edi*8 - 0x17af0001], ebp
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405a7c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
dec dword [edi]
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00405ac7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405a7c
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00405ac7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405a7c
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00405ab7
jle 0x40653f
push edi
cwde
invalid
movsd dword es:[edi], dword [esi]
int3
cli
Function at 0x40950b
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
sub eax, 0x11
push esi
je 0x409532
dec eax
je 0x409524
xor eax, eax
jmp 0x40965f
call fcn.0040946b
mov dword [ebp - 4], 0x4030e0
jmp 0x40953e
call fcn.0040946b
mov dword [ebp - 4], 0x4030d0
mov esi, eax
neg esi
sbb esi, esi
push ebx
and esi, 6
push edi
inc esi
call fcn.0040946b
test eax, eax
je 0x4095a5
cmp dword [ebp + 0x18], 2
jle 0x409580
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyA]
test eax, eax
jne 0x40965a
push dword [ebp - 4]
push 0x4030b0
jmp 0x4095f0
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyA]
test eax, eax
jne 0x40965a
push dword [ebp - 4]
push 0x403090
jmp 0x4095f0
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x4095c5
cmp byte [ecx], 0x2c
jne 0x4095b3
mov byte [ecx], bl
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4095b8
sub eax, edi
lea ecx, [ecx + eax + 1]
cmp byte [ecx], bl
jne 0x4095ac
push 0xf003f
push 1
push ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4095ff
push 0x403070
push 0x4012c4
push 0x403054
call fcn.00405833
add esp, 0xc
jmp 0x40964f
cmp dword [ebp + 0x18], 3
jle 0x409625
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409653
push dword [ebp - 4]
push 0x4030b0
jmp 0x40963b
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x409653
push dword [ebp - 4]
push 0x403090
push 0x403054
call fcn.00405833
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40965d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409734
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xf003f
push 1
push 0
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
test esi, esi
je 0x40978d
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x409786
push dword [ebp + 0x10]
push 0x40315c
push 0x403138
call fcn.0040586f
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x40978f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ebp
ret