joyce8/EMBER2024-capa huggingface dataset:
Function at 0x597520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
push 0x4d41524b
push esi
call sym.vidcap60.exe__iff_FindChunkFromStart_12
test eax, eax
jl 0x597643
lea ecx, [esp + 4]
push ecx
push esi
call sym.vidcap60.exe__iff_ReadWORD_8
test eax, eax
jl 0x597643
cmp word [esp + 4], 0
push ebx
push ebp
push edi
je 0x59763b
mov ebp, dword [esp + 0x2c]
jmp 0x597570
mov esi, dword [esp + 0x28]
lea esp, [esp]
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x59763b
push 0
lea edx, [esp + 0x1c]
push edx
push 7
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 7
jne 0x59764a
mov eax, ebp
lea edi, [ebp + 2]
lea ecx, [ecx]
mov cl, byte [eax + 1]
mov edx, eax
mov bl, byte [edx]
lea esi, [eax + 1]
add eax, 2
cmp eax, edi
mov byte [esi], bl
mov byte [edx], cl
jb 0x5975a0
mov ecx, edi
lea edi, [ecx + 4]
lea ebx, [ebx]
mov dl, byte [ecx + 3]
mov eax, ecx
mov bl, byte [eax]
lea esi, [ecx + 3]
add ecx, 4
cmp ecx, edi
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [eax], dl
mov dl, byte [eax + 2]
mov byte [eax + 2], bl
mov byte [eax + 1], dl
jb 0x5975c0
mov ax, word [esp + 0x30]
cmp word [ebp], ax
je 0x597659
movzx ebx, byte [ebp + 6]
test bl, 1
jne 0x5975f6
inc ebx
push 1
mov eax, ebx
cdq
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x30]
push eax
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0xfffffff9
sub ecx, ebx
add eax, 0xffff
add edx, ecx
test ax, ax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jne 0x597568
pop edi
pop ebp
mov eax, 0x8004e00a
pop ebx
pop esi
add esp, 0x14
ret 0xc
pop edi
pop ebp
pop ebx
mov eax, 0x8004e080
pop esi
add esp, 0x14
ret 0xc
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x14
ret 0xc
Function at 0x5a0bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5a0ca5
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esi, [ebp - 0x10]
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, ecx
shr ecx, 2
and ebx, 3
cmp ecx, 0
je 0x5a0c6c
prefetchnta byte [esi + 0x40]
movaps xmm1, xmmword [esi]
movaps xmm2, xmmword [esi + 0x10]
prefetchnta byte [esi + 0x60]
movaps xmm3, xmmword [esi + 0x20]
movaps xmm4, xmmword [esi + 0x30]
mulps xmm1, xmm0
mulps xmm2, xmm0
mulps xmm3, xmm0
mulps xmm4, xmm0
cvttps2pi mm0, xmm1
cvttps2pi mm1, xmm2
cvttps2pi mm2, xmm3
cvttps2pi mm3, xmm4
shufps xmm1, xmm1, 0x4e
shufps xmm2, xmm2, 0x4e
shufps xmm3, xmm3, 0x4e
shufps xmm4, xmm4, 0x4e
cvttps2pi mm4, xmm1
cvttps2pi mm5, xmm2
cvttps2pi mm6, xmm3
cvttps2pi mm7, xmm4
packssdw mm0, mm4
packssdw mm1, mm5
packssdw mm2, mm6
packssdw mm3, mm7
packsswb mm0, mm1
packsswb mm2, mm3
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
pxor mm2, mm1
movntq qword [edi], mm0
movntq qword [edi + 8], mm2
lea edi, [edi + 0x10]
lea esi, [esi + 0x40]
dec ecx
jne 0x5a0bef
cmp ebx, 0
je 0x5a0ca0
movaps xmm1, xmmword [esi]
mulps xmm1, xmm0
cvttps2pi mm0, xmm1
shufps xmm1, xmm1, 0x4e
cvttps2pi mm2, xmm1
packssdw mm0, mm2
packsswb mm0, mm0
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
movd dword [edi], mm0
lea edi, [edi + 4]
lea esi, [esi + 0x10]
dec ebx
jmp 0x5a0c6c
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5a0cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5a0d7f
fld qword [ebp + 0x14]
push ebx
push esi
fst qword [ebp - 0x10]
fstp qword [ebp - 8]
push edi
lea esi, [ebp - 0x10]
movupd xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, ecx
shr ecx, 2
and ebx, 3
cmp ecx, 0
je 0x5a0d47
prefetchnta byte [esi + 0x40]
movapd xmm1, xmmword [esi]
movapd xmm2, xmmword [esi + 0x10]
prefetchnta byte [esi + 0x60]
movapd xmm3, xmmword [esi + 0x20]
movapd xmm4, xmmword [esi + 0x30]
mulpd xmm1, xmm0
mulpd xmm2, xmm0
mulpd xmm3, xmm0
mulpd xmm4, xmm0
cvttpd2pi mm0, xmm1
cvttpd2pi mm1, xmm2
cvttpd2pi mm2, xmm3
cvttpd2pi mm3, xmm4
packssdw mm0, mm1
packssdw mm2, mm3
packsswb mm0, mm2
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
movntq qword [edi], mm0
lea edi, [edi + 8]
lea esi, [esi + 0x40]
dec ecx
jne 0x5a0cea
cmp ebx, 0
je 0x5a0d7a
movapd xmm1, xmmword [esi]
mulpd xmm1, xmm0
cvttpd2pi mm0, xmm1
packssdw mm0, mm0
packsswb mm0, mm0
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
movd eax, mm0
mov word [edi], ax
lea edi, [edi + 2]
lea esi, [esi + 0x10]
dec ebx
jmp 0x5a0d47
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5a0d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5a0e5f
fld qword [ebp + 0x14]
push ebx
push esi
fst qword [ebp - 0x10]
fstp qword [ebp - 8]
push edi
lea esi, [ebp - 0x10]
movupd xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, ecx
shr ecx, 2
and ebx, 3
cmp ecx, 0
je 0x5a0e27
prefetchnta byte [esi + 0x40]
movupd xmm1, xmmword [esi]
movupd xmm2, xmmword [esi + 0x10]
prefetchnta byte [esi + 0x60]
movupd xmm3, xmmword [esi + 0x20]
movupd xmm4, xmmword [esi + 0x30]
mulpd xmm1, xmm0
mulpd xmm2, xmm0
mulpd xmm3, xmm0
mulpd xmm4, xmm0
cvttpd2pi mm0, xmm1
cvttpd2pi mm1, xmm2
cvttpd2pi mm2, xmm3
cvttpd2pi mm3, xmm4
packssdw mm0, mm1
packssdw mm2, mm3
packsswb mm0, mm2
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
movntq qword [edi], mm0
lea edi, [edi + 8]
lea esi, [esi + 0x40]
dec ecx
jne 0x5a0dca
cmp ebx, 0
je 0x5a0e5a
movupd xmm1, xmmword [esi]
mulpd xmm1, xmm0
cvttpd2pi mm0, xmm1
packssdw mm0, mm0
packsswb mm0, mm0
pcmpeqw mm1, mm1
psllw mm1, 7
packsswb mm1, mm1
pxor mm0, mm1
movd eax, mm0
mov word [edi], ax
lea edi, [edi + 2]
lea esi, [esi + 0x10]
dec ebx
jmp 0x5a0e27
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5b5d90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
add ecx, 0xd0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, 0x80004005
call esi
test eax, eax
jne 0x5b5e11
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0x20019
push eax
push str.License
push edx
call esi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5b5e0a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
lea eax, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.keyRegFile
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b5e03
xor edi, edi
mov eax, dword [esp + 8]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov eax, edi
pop edi
pop esi
add esp, 8
ret 8

Function at 0x5b5e20
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push eax
push 0x20019
xor esi, esi
push esi
add ecx, 0xd0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x5b5e8b
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0x20006
push eax
push str.License
push edx
call edi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5b5e84
mov eax, dword [esp + 8]
push str.keyRegFile
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call edi
mov edx, dword [esp + 0xc]
push edx
call edi
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x5b6c80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
push ebp
mov ebp, dword [esp + 0x220]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
push 0
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], 0x200
mov edi, 0x80070005
mov word [ebp], 0
call esi
test eax, eax
jne 0x5b6d37
push eax
lea edx, [esp + 0x14]
push edx
push eax
push 0x20019
push eax
push eax
push eax
mov eax, dword [esp + 0x30]
push str.License
push eax
call esi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5b6d30
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x228]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b6d29
shr ebx, 1
push ebx
lea eax, [esp + 0x24]
push eax
push ebp
xor edi, edi
call fcn.004049b0
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 8

Function at 0x5b6f40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x20019
push 0
push 0
push 0
add ecx, 0xd0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x5b6fd7
mov edx, dword [esp + 8]
push edi
push eax
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x20019
push eax
push eax
push eax
push str.License
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x5b6fc2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
test esi, esi
pop edi
jne 0x5b6fd7
xor eax, eax
pop esi
add esp, 8
ret 0x10
mov eax, 0x80004005
pop esi
add esp, 8
ret 0x10
Function at 0x5b6ff0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 4
push 0
push 0
push 0
add ecx, 0xd0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x5b7084
mov edx, dword [esp + 8]
push edi
push eax
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x20006
push eax
push eax
push eax
push str.License
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x5b706f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
test esi, esi
pop edi
jne 0x5b7084
xor eax, eax
pop esi
add esp, 8
ret 0x10
mov eax, 0x80004005
pop esi
add esp, 8
ret 0x10

Function at 0x5b7260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x22c
mov eax, 4
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x234]
push eax
lea ecx, [esp + 0x18]
push 0x5f72c4
push ecx
call esi
push str.Shared_InformationPlug_Ins_PrefParentID
push str.SoftwareSony_Creative_Software_
lea edx, [esp + 0x3c]
push 0x5d4ee8
push edx
call esi
add esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x34]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x5b7305
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b72fa
mov ecx, dword [esp + 0x238]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x22c
ret 8
Function at 0x5b7320
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [esp + 0x230]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea ecx, [esp + 0x1c]
push 0x5f72c4
push ecx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 4
call esi
push str.Shared_InformationPlug_Ins_PrefParentID
push str.SoftwareSony_Creative_Software_
lea edx, [esp + 0x40]
push 0x5d4ee8
push edx
call esi
mov eax, dword [esp + 0x25c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x1c
test eax, eax
je 0x5b73e1
lea eax, [esp + 8]
push eax
push 0x20019
xor esi, esi
push esi
lea ecx, [esp + 0x38]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5b73e1
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b73c6
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call ebx
test esi, esi
je 0x5b73e1
pop esi
mov eax, 1
pop ebx
add esp, 0x22c
ret 0xc
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x48]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x5b743a
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x240]
push edx
push 4
push eax
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call ebx
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
add esp, 0x22c
ret 0xc
Function at 0x5b7660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa24
push ebx
push esi
push edi
mov eax, 0x200
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x628]
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
push str.Shared_InformationUser_Information
push str.SoftwareSony_Creative_Software_
stosw word es:[edi], ax
lea eax, [esp + 0x830]
push 0x5d4ee8
push eax
mov ebx, 0x80004005
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
lea edx, [esp + 0x844]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5b77f1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.First_Name
push eax
call esi
test eax, eax
jne 0x5b7724
xor ebx, ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x62c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0x5f71a0
push ecx
call esi
test eax, eax
jne 0x5b774a
xor ebx, ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5b7787
lea edx, [esp + 0x628]
push edx
lea eax, [esp + 0x224]
push eax
call fcn.005c43d6
lea ecx, [esp + 0x228]
push 0x5e6a1c
push ecx
call fcn.005c4506
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x234]
push eax
jmp 0x5b77bb
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x224]
push edx
call fcn.005c43d6
lea eax, [esp + 0x228]
push 0x5e6a1c
push eax
call fcn.005c4506
lea ecx, [esp + 0x638]
push ecx
lea edx, [esp + 0x234]
push edx
call fcn.005c4506
mov esi, dword [ebp + 0xc]
add esp, 0x18
test esi, esi
jle 0x5b77e6
mov edi, dword [ebp + 8]
push esi
lea eax, [esp + 0x224]
push eax
push edi
call fcn.005c43dc
add esp, 0xc
mov word [edi + esi*2 - 2], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5b7850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
push ebx
push esi
push edi
push str.Shared_InformationUser_Information
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x1c]
push str.SoftwareSony_Creative_Software_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push 0x5d4ee8
push eax
mov ebx, 0x80004005
mov dword [esp + 0x20], 0x200
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
lea edx, [esp + 0x234]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5b7914
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.Company_Name
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b7909
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test esi, esi
jle 0x5b7909
mov edi, dword [ebp + 8]
push esi
lea ecx, [esp + 0x1c]
push ecx
push edi
call fcn.005c43dc
add esp, 0xc
mov word [edi + esi*2 - 2], bx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5b80b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
push str.54678
xor ebp, ebp
push ebp
mov ecx, edi
mov dword [esp + 0x2c], 4
call fcn.005b6380
mov esi, eax
cmp esi, ebp
jl 0x5b811e
mov ecx, dword [esp + 0xc]
push 7
lea eax, [esp + 0x30]
push eax
push ecx
mov word [esp + 0x44], bp
call fcn.005c26c0
mov eax, dword [esp + 0x50]
mov dx, word [esp + 0x36]
mov cx, word [esp + 0x38]
mov word [eax + 4], bp
pop edi
mov word [eax], dx
mov word [eax + 2], cx
mov eax, esi
pop esi
pop ebp
add esp, 0x40
ret 8
push ebx
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebp
lea eax, [edi + 0xd0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [esp + 0x54]
jne 0x5b82a7
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebp
push str.License
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5b829c
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push ebp
lea eax, [edi + 0x13a8]
push eax
push ecx
mov dword [esp + 0x38], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b81f2
mov edx, dword [esp + 0x28]
push 0x9a8b7c6d
push edx
call fcn.005bee20
cmp dword [esp + 0x2c], eax
jne 0x5b81e8
mov edi, dword [edi + 0x90]
mov esi, dword [esp + 0x28]
push 7
lea eax, [esp + 0x34]
xor edi, esi
push eax
push edi
mov word [esp + 0x48], bp
mov dword [esp + 0x1c], edi
call fcn.005c26c0
mov cx, word [esp + 0x3a]
mov dx, word [esp + 0x3c]
mov word [ebx], cx
mov word [ebx + 2], dx
xor esi, esi
jmp 0x5b828d
mov esi, 0x80070057
jmp 0x5b8291
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [esp + 0x3e]
movzx ecx, word [esp + 0x34]
movzx eax, word [esp + 0x3c]
add ecx, edx
movzx edx, word [esp + 0x3a]
add ecx, eax
movzx eax, word [esp + 0x36]
add ecx, edx
movzx edx, word [esp + 0x32]
add ecx, eax
movzx eax, word [esp + 0x30]
add ecx, edx
add ecx, eax
push ecx
call fcn.005c4c8c
add esp, 4
call fcn.005c4c32
cdq
mov ecx, 0x3ff
idiv ecx
push 1
push 1
push 4
mov ecx, edi
mov dword [esp + 0x60], edx
lea edx, [esp + 0x60]
push edx
push 4
push str.54678
push ebp
call fcn.005b6530
mov esi, eax
cmp esi, ebp
jl 0x5b8291
mov ecx, dword [esp + 0x54]
push 7
lea eax, [esp + 0x44]
push eax
push ecx
mov word [esp + 0x58], bp
call fcn.005c26c0
mov dx, word [esp + 0x4a]
mov ax, word [esp + 0x4c]
mov word [ebx], dx
mov word [ebx + 2], ax
mov word [ebx + 4], bp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
jge 0x5b82ae
mov word [ebx], bp
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x40
ret 8
Function at 0x5b8980
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
mov ecx, 4
push edi
mov dword [esp + 0xc], ecx
je 0x5b89e3
cmp dword [eax + 0x14], ecx
jne 0x5b89e3
mov eax, dword [esi + 0xf84]
test eax, eax
jne 0x5b89b4
pop edi
pop esi
mov eax, 0x80070057
pop ebp
add esp, 0x48
ret 4
push eax
lea eax, [esp + 0x28]
push 0x5f70c0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebp, dword [esp + 0x64]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push ebp
lea edx, [esp + 0x18]
push edx
push 0x5f7378
lea eax, [esp + 0x34]
push eax
jmp 0x5b89f9
mov ebp, dword [esp + 0x58]
lea ecx, [esp + 0xc]
push ecx
push ebp
lea edx, [esp + 0x18]
push edx
push 0x5f7378
push 0
mov ecx, esi
call fcn.005b6380
mov edi, eax
test edi, edi
jge 0x5b8abd
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
lea ecx, [esi + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x5b8abc
lea edx, [esp + 0x18]
push edx
push 0x20019
push eax
mov eax, dword [esp + 0x28]
push str.License
push eax
call ebx
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5b8ab5
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esi + 0xfa8]
push ecx
push edx
mov dword [esp + 0x74], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b8aae
mov eax, dword [esp + 0x20]
push 0x9a8b7c6d
push eax
call fcn.005bee20
cmp dword [esp + 0x24], eax
jne 0x5b8aa9
mov ecx, dword [esi + 0x90]
xor ecx, dword [esp + 0x20]
mov dword [ebp], ecx
xor edi, edi
jmp 0x5b8aae
mov edi, 0x80070057
mov edx, dword [esp + 0x18]
push edx
call ebx
mov eax, dword [esp + 0x1c]
push eax
call ebx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x48
ret 4