joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcc4000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcc4131
push esi
call fcn.00cc7145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00cb6080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcc4131
push 0
push ebp
call fcn.00cb63a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00cb6260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcc408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00cb62f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcc4121
push 0xcdc918
push edi
call fcn.00cc53f0
push eax
push ebx
push esi
call fcn.00cc3f60
push 0xcdc8f8
push edi
call fcn.00cc53f0
push eax
push ebx
push esi
call fcn.00cc3f60
push 0xcdc8d8
push edi
call fcn.00cc53f0
push eax
push ebx
push esi
call fcn.00cc3f60
push 0xcdc8c0
push edi
call fcn.00cc53f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00cc3f60
push 0xcdc8a0
push edi
call fcn.00cc53f0
push eax
push ebx
push esi
call fcn.00cc3f60
push 0xcdc888
push edi
call fcn.00cc53f0
push eax
push ebx
push esi
call fcn.00cc3f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcc51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cc5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cc5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cc5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cc5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcc5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcc5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcd787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcc5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcc5c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4131e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
push esi
push edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor edx, edx
mov cl, byte [edx + eax]
mov byte [ebp + edx - 8], cl
mov cl, byte [edx + eax]
mov byte [edx + esi], cl
inc edx
cmp edx, 8
jl reloc.gdi32.dll_SetWorldTransform
push esi
push eax
call fcn.00412d35
xor eax, eax
lea edx, [eax + esi]
mov cl, byte [eax + edi]
xor byte [edx], cl
inc eax
cmp eax, 8
jl reloc.gdi32.dll_SetWorldTransform
xor eax, eax
mov dl, byte [ebp + eax - 8]
mov byte [eax + edi], dl
inc eax
cmp eax, 8
jl reloc.gdi32.dll_SetWorldTransform
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10019e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0x6d
jne 0x10019e89
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
jne 0x10019e80
mov esi, esp
push 5
push 0
push 0
mov edx, dword [ebp - 8]
add edx, 0x7c
push edx
push 0x1015eb84
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.10097d90
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop esi
add esp, 8
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10027e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
push edi
push ecx
lea edi, [ebp - 0x268]
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 1
mov ecx, 0x101b8ec0
call fcn.10029c70
mov dword [ebp - 0x10], eax
mov esi, esp
push 0xf0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10027fed
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10027fed
mov esi, esp
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10027fed
cmp dword [ebp - 0xc], 0
je 0x10027fed
mov edx, dword [ebp - 0x1c]
movzx eax, word [edx]
test eax, eax
je 0x10027fed
mov ecx, dword [ebp - 0x1c]
mov dx, word [ecx]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dx, word [ecx]
mov word [ebp - 0x24], dx
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
movzx ecx, word [ebp - 0x24]
cmp ecx, 0x403
jne 0x10027f64
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x130]
call fcn.1001bb00
lea ecx, [ebp - 0x130]
call fcn.10020f80
push eax
push 0
push 0x143
movzx eax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.10031e70
cmp eax, 0xffffffff
jne 0x10027f57
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x130]
call fcn.1001e930
jmp 0x10027fdf
movzx ecx, word [ebp - 0x24]
cmp ecx, 0x1234
jne 0x10027fdf
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x158], 0xffffffff
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x264]
call fcn.1001bb00
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
call fcn.10020f80
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0x264]
call fcn.1001e930
lea eax, [ebp - 0x15c]
push eax
push 0
push 0x40b
movzx ecx, word [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.10031e70
cmp eax, 0xffffffff
jne 0x10027fdf
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x10027ebe
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10028020]
call fcn.10097d30
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x268
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10028990
mov ecx, dword [ebp + 0x10]
call fcn.100372d0
mov esi, esp
push eax
mov ecx, dword [ebp + 0xc]
call fcn.100372d0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002c66e
xor al, al
jmp 0x1002c74b
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1002c695
xor al, al
jmp 0x1002c74b
mov esi, esp
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1002c6bc
xor al, al
jmp 0x1002c74b
mov esi, esp
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002c6dc
xor al, al
jmp 0x1002c74b
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp esi, esp
call fcn.10097d90
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x1002c702
xor al, al
jmp 0x1002c74b
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1002c749
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1009bef0
add esp, 0xc
mov esi, esp
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp esi, esp
call fcn.10097d90
mov al, 1
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004f970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144811
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x54
push ebx
push esi
push edi
lea edi, [ebp - 0x64]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, esp
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipepipe_dplreg
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x1004fa5e
mov dword [ebp - 0x20], 2
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
cmp esi, esp
call fcn.10097d90
test eax, eax
je 0x1004fa4b
push str.shutdown
lea ecx, [ebp - 0x44]
call fcn.1000a5e0
mov dword [ebp - 0x50], 0
mov esi, esp
push 0
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x44]
call fcn.1000f160
push eax
lea ecx, [ebp - 0x44]
call fcn.1000ec90
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.10097d90
lea ecx, [ebp - 0x44]
call fcn.1000b3d0
mov esi, esp
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10097d90
cmp dword [ebp + 8], 0
jne 0x1004fa6b
mov eax, 2
jmp 0x1004fad3
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x1004faa0
mov esi, esp
push 1
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [edx]
call eax
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x64], eax
jmp 0x1004faa7
mov dword [ebp - 0x64], 0
jmp 0x1004fabc
mov dword [ebp - 4], 0xffffffff
jmp 0x1004fad1
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1004fb0c]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x64
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret
Function at 0x10052eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144c43
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push esi
push edi
lea edi, [ebp - 0x8c]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x14], 3
jne 0x10052f4b
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10052eb0
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 0
je 0x10052f35
lea ecx, [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10052eb0
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp + 0x18], 0
je 0x10052f43
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
jmp 0x10053081
mov ecx, dword [str.DivXProductConfig]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
push 0x1f4
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.1005b9c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.1000b3d0
lea ecx, [ebp - 0x2c]
call fcn.1005bdc0
movzx eax, al
test eax, eax
jne 0x10052fbf
cmp dword [ebp + 0x18], 0
je 0x10052f9c
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1005bd60
mov eax, dword [ebp - 0x88]
jmp 0x10053081
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x60], 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.10054350
add esp, 0xc
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x10053055
mov esi, esp
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10006750
push eax
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1005302c
mov dword [ebp - 0x74], 0
jmp 0x10053042
cmp dword [ebp - 0x78], 5
jne 0x1005303b
mov dword [ebp - 0x74], 2
jmp 0x10053042
mov dword [ebp - 0x74], 1
mov esi, esp
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10097d90
cmp dword [ebp + 0x18], 0
je 0x10053063
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1005bd60
mov eax, dword [ebp - 0x8c]
push edx
mov ecx, ebp
push eax
lea edx, [0x100530bc]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x8c
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret
Function at 0x10053140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144c82
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push esi
push edi
lea edi, [ebp - 0x8c]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x14], 3
jne 0x100531db
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10053140
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 0
je 0x100531c5
lea ecx, [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10053140
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp + 0x18], 0
je 0x100531d3
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
jmp 0x10053311
mov ecx, dword [str.DivXProductConfig]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
push 0x1f4
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.1005b9c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.1000b3d0
lea ecx, [ebp - 0x2c]
call fcn.1005bdc0
movzx eax, al
test eax, eax
jne 0x1005324f
cmp dword [ebp + 0x18], 0
je 0x1005322c
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1005bd60
mov eax, dword [ebp - 0x88]
jmp 0x10053311
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x60], 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.10054350
add esp, 0xc
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x100532e5
mov esi, esp
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10006750
push eax
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x100532bc
mov dword [ebp - 0x74], 0
jmp 0x100532d2
cmp dword [ebp - 0x78], 5
jne 0x100532cb
mov dword [ebp - 0x74], 2
jmp 0x100532d2
mov dword [ebp - 0x74], 1
mov esi, esp
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10097d90
cmp dword [ebp + 0x18], 0
je 0x100532f3
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1005bd60
mov eax, dword [ebp - 0x8c]
push edx
mov ecx, ebp
push eax
lea edx, [0x1005334c]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x8c
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret
Function at 0x10053510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144cfd
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
lea edi, [ebp - 0x58]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.DivXProductConfig]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
push 0x1f4
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1005b9c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.1000b3d0
lea ecx, [ebp - 0x1c]
call fcn.1005bdc0
movzx edx, al
test edx, edx
jne 0x100535ad
cmp dword [ebp + 0x18], 0
je 0x10053599
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
jmp 0x10053667
mov dword [ebp - 0x40], 1
mov ecx, dword [ebp + 0x10]
call fcn.10055340
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.10054130
add esp, 0xc
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x1005364a
mov esi, esp
mov edx, dword [ebp - 0x44]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10006750
push eax
mov eax, dword [ebp - 0x40]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10006750
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x10053621
mov dword [ebp - 0x48], 0
jmp 0x10053637
cmp dword [ebp - 0x4c], 5
jne 0x10053630
mov dword [ebp - 0x48], 2
jmp 0x10053637
mov dword [ebp - 0x48], 1
mov esi, esp
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10097d90
cmp dword [ebp + 0x18], 0
je 0x10053658
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
push edx
mov ecx, ebp
push eax
lea edx, [0x100536a0]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x58
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret
Function at 0x100536d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144d39
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
lea edi, [ebp - 0x58]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.DivXProductConfig]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
push 0x1f4
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1005b9c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.1000b3d0
lea ecx, [ebp - 0x1c]
call fcn.1005bdc0
movzx edx, al
test edx, edx
jne 0x1005376d
cmp dword [ebp + 0x18], 0
je 0x10053759
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
jmp 0x1005381a
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x44], 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.10054130
add esp, 0xc
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x100537fd
mov esi, esp
mov ecx, dword [ebp - 0x44]
push ecx
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x40]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10006750
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x100537d4
mov dword [ebp - 0x48], 0
jmp 0x100537ea
cmp dword [ebp - 0x4c], 5
jne 0x100537e3
mov dword [ebp - 0x48], 2
jmp 0x100537ea
mov dword [ebp - 0x48], 1
mov esi, esp
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10097d90
cmp dword [ebp + 0x18], 0
je 0x1005380b
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
push edx
mov ecx, ebp
push eax
lea edx, [0x10053850]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x58
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret