joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15dfa40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x15dfa6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x15dfa6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x161dfea
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [esp + ecx - 0xdc]
mov ebx, dword [ebx + ecx*2 - 0x1d8]
shr edi, 0xf3
bswap ecx
ja fcn.016198a3
movzx ecx, cl
mov dword [esp + edi - 0x1a8], edi
add dword [esp + ecx*4 + 4], 0x2b207
lea ebx, [ebx + edi - 0x11cfb038]
bswap edi
and dword [esp + 0x18], 0x2290bc24
xor cx, cx
xchg dword [esp + ecx*2 + 0x1c], ebx
mov edi, dword [esp + ecx + 0xc]
and byte [esp + ecx*2 + 0x18], ch
shr byte [esp + ecx + 0x18], 0xd6
shl dword [esp + ecx*8 + 0x18], 0x36
lea esp, [esp + ecx*2 + 4]
ret

Function at 0x1624647
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x16ea911
dec ecx
add esi, 2
inc cx
shr edi, cl
dec eax
mov dword [esp], 0x8a022384
inc bp
mov dword [esi], edi
dec eax
lea esp, [esp + 8]
jmp fcn.01617700
ja fcn.016f28f1
push edi
add dword [esp + 4], 0x62ae9
mov ebx, dword [esp + ebx*2 - 0x33029f0]
mov dword [esp + 0xc], edx
jno 0x16b4c47
pop ds
xchg esi, eax
invalid

Function at 0x1624dcd
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [esp + 0xc]
mov ebp, dword [ebp]
mov dword [esp + 0xc], edi
push edi
push esi
jl 0x1633123

Function at 0x16277bb
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 4], ecx
mov dword [esp], ecx
push ecx
pushfd
mov ecx, 0x671fd99b
bswap ecx
add ecx, 0x11359b02
lea ecx, [ecx*4 + 0x66ba888d]
not cx
call fcn.0166910f

Function at 0x162b635
Capabilities:
Packed with generic packer

Disassembly:
ror di, 0xc3
movzx edi, byte [ecx]
xor edi, edx
jmp 0x16bcc1a

Function at 0x162c3ae
Capabilities:
Encode data using base64

Disassembly:
ja 0x171192b
add dword [esp], 0x70fd2
shl byte [esp + ebx*2 - 0x1bbfc], 0xdd
jns 0x16404b4
lea esp, [esp + 8]
jmp fcn.01696485
push ebp
movzx bx, byte [esp + ebx*2 - 0x1bbf7]
je 0x162632f

Function at 0x16362da
Capabilities:
Encode data using base64

Disassembly:
mov ebp, 0xb49b81b4
add ebp, esi
add dword [esp + 4], 0x77950
shr dword [esp + esi - 0xc1af63], 0xc1
mov dword [esp + esi - 0xc1af6f], esi
je 0x1619ad6
add dword [esp + esi*8 - 0x60d7ba4], esi
mov ebp, esi
and word [esp + esi - 0xc1af6f], si
setns byte [esp + esi*2 - 0x1835ee6]
jns 0x171ab3b
mov ebp, dword [esp + esi - 0xc1af73]
mov ebp, dword [ebp + esi - 0xc1af77]
sub esi, esi
test dword [esp + esi + 8], esi
js 0x170d651
call fcn.0164037b
Function at 0x1647032
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [eax*8 - 0x75d86067]
mov eax, dword [esp + ebx - 0x3a3d3ca4]
mov eax, dword [eax + ebx - 0x3a3d3ca8]
seto byte [esp + ebx - 0x3a3d3c94]
je 0x1626a15
mov dword [esp + ebp - 0x3a3d3ca4], ebp
setns byte [esp + ebx - 0x3a3d3c84]
lea eax, [eax - 0x5470ffdd]
cmovs ebx, ebp
jle 0x163c7ef
mov dword [esp + ebp - 0x3a3d3ca4], 0x8499c12c
shl ebp, 0xa1
shr byte [esp + ebx - 0x3a3d3ca4], 0x8e
push edx
js 0x1619be1
xchg dword [esp + ebx*2 - 0x747a790c], eax
mov ebp, dword [esp + ebx*2 - 0x747a792c]
cmp byte [esp + ebx - 0x3a3d3c90], bh
push dword [esp + ebx - 0x3a3d3c6c]
popfd
mov ebx, dword [esp + ebx*2 - 0x747a7924]
lea esp, [esp + 0x40]
ret

Function at 0x1649ac9
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 8], 0xe28e3e1d
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp + 0x20], edx
add edi, edx
lea ebp, [esp + 4]
lea eax, [ebp - 0xec]
mov dword [esp], 0x5424a587
shr byte [esp + 3], 0x81
mov esp, eax

Function at 0x164ec97
Capabilities:
Packed with generic packer

Disassembly:
push edx
mov edx, 0x779660b2
lea eax, [eax + edx - 0x779660b1]
add edx, 0x3914da1
and edx, 0xc88a6f93
jl 0x1616f30
bswap edx
mov dword [esp + edx*2 - 0x265c047c], eax
not dx
jge 0x1672f2d
nop
call fcn.016ecded
mov edi, 0x7091382b
mov ecx, dword [ebp + edi - 0x7091382b]
movzx eax, di
mov esi, edi
not ax
lea ebp, [ebp + eax*2 - 0x18fa4]
mov edi, ecx
lea edx, [esi*4 - 0x3fc9b6b]
jmp 0x1649af7

Function at 0x1652722
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + esi*2 - 0x7745d830]
not esi
mov edx, dword [esp + edx*2 - 0x35929928]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]

Function at 0x16547fd
Capabilities:
Encode data using xor

Disassembly:
pushfd
cmp ebx, 0x3112ad3b
jae 0x16d23aa
sub byte [ecx + 0x2e], bl
iretd

Function at 0x165640e
Capabilities:
Encode data using base64

Disassembly:
call fcn.0169ddaa
xor edx, dword [eax]
pushal
lcall 0x8bc7, 0xd1335ba
push ebp
add al, 0x8a
dec ebp
or cl, ch
dec edx
out 0xc, eax
add byte [eax + 0x793325a3], bh
movsx ecx, ax
mov ax, word [esi + ecx*2 - 0x4b46]
shl ecx, cl
or ecx, 0xb1235613
mov cl, byte [esi + 2]
call fcn.0170667f
mov dword [esp + 0x24], ecx
jl 0x16d31cd
call fcn.0169d739
invalid
test edx, edx
not dx
movsx dx, dl
mov dword [esp + edx + 0x420a0001], edx
lea eax, [eax + 0x6e045921]
bswap edx
setbe byte [esp + edx + 0xa43]
shr word [esp + edx*2 + 0x1486], 0x36
je 0x1637713
movzx ax, byte [edi]
mov ecx, 0xd917412c
mov dword [esp], ecx
mov cl, byte [edi + 2]
add edi, 2
jmp 0x16dfa18
shr al, cl
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.0165b0c8
Function at 0x165abbc
Capabilities:
Packed with generic packer

Disassembly:
jge fcn.016c2c76
setne byte [esp + 0x14]
ja 0x16b7f1b
mov eax, 0x4c1710bb
ror al, 0xc7
mov edx, dword [edi + eax - 0x4c171077]
and al, 0x98
mov eax, dword [edi + eax - 0x4c17100c]
jne 0x165f670
mov dword [esp + 0x10], ebx
add bx, bx
push ecx
xchg dword [esp + 0x24], eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xc], 0x3e836207
jle 0x1622e52
shr byte [esp + 0x14], 0x2f
or word [esp + 0xc], 0x11af
mov ecx, 0xfeb1a08b
jge 0x16956d9
mov eax, dword [esi]
call fcn.0167322f

Function at 0x16690cb
Capabilities:
Encode data using base64

Disassembly:
add ecx, dword [esp + ecx - 0x1fe0320]
not ecx
bswap ecx
xchg dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x14]
cmp dword [esp + edi*2 - 0x3fc0660], edi
jns 0x1685cfb
neg di
jb 0x16ff2fb
mov di, word [ebp]
mov eax, 0x57a88b84
rol eax, 0x2d
mov ax, word [ebp + eax*4 - 0x45c22bd2]
jb 0x168da0b
mov ebp, 0x8db9f016
push ebp
push 0xd32c88be
not byte [esp + edi - 0x7482d433]
call fcn.01728324
add ebp, 2
call fcn.01679819
mov edi, dword [ebp]
call fcn.016e372d
shl bp, 0x98
js 0x1667177
lea ebx, [ebx + ebx*8 + 0x1435de99]
push ebx
shr ebp, 0xc6
add dword [esp + 0x18], 0x7f7df
or dword [esp], ebx
xor dword [esp], 0xf13c5e07
call fcn.016f96ec
mov word [eax], cx
lea esp, [esp + 4]
jmp fcn.016b8a8f
lea edi, [edi + edi*8 - 0x26dd535b]
mov edi, dword [esp + 0x18]
shl dword [esp + 8], 0x64
neg dword [esp + 8]
add byte [esp + 0x20], 0xa4
neg dword [esp + 8]
cmp byte [esp + 8], 1
jge 0x16c335f

Function at 0x166d517
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebx
mov ebx, 0x362d3296
movzx ebx, byte [eax + ebx - 0x362d3296]
jmp fcn.016ce75d

Function at 0x1686fe0
Capabilities:
Packed with generic packer

Disassembly:
js fcn.0168aa5c
and word [esp + ebx - 0x270c6805], bx
mov esi, dword [esp + edx - 0x7bd1bc50]
call fcn.017169ea

Function at 0x168aa5c
Capabilities:
Packed with generic packer

Disassembly:
jo 0x16a1b0d
or dword [esp + 0x14], 0x3015660a
not dword [esp + 0x18]

Function at 0x168d88a
Capabilities:
Packed with generic packer

Disassembly:
shr esi, 0xa3
mov esi, dword [esp + esi - 0x1b73cfd2]
ja 0x16d8b14
add dword [esp + 0x10], 0xffa60310
call fcn.016f96a2
stosb byte es:[edi], al
clc
in al, dx
mov bl, 0xf5
and dword fs:[ebp + 0x59b84da4], 0x49
invalid

Function at 0x169aa5e
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + eax - 0x5aefff0]
mov eax, dword [eax + edi*2 - 0xb5f856c]
jg 0x171ab34
test word [esp + edi - 0x5afc2ae], 0x4c8b
mov dword [esp + edi - 0x5afc2a6], edi
call int.016bf975
call fcn.01682778

Function at 0x16a2715
Capabilities:
Packed with generic packer

Disassembly:
not dword [esp + 0x20]
cmp dword [esp + 0x18], 0xe131338f
ja 0x16af14e
push dword [esp + 0x28]
popfd
lea esp, [esp + 0x2c]
Function at 0x16ae7e8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x7e151011
xor si, 0x2f0f
test esi, 0x908433b2
push ebp
xchg dword [esp + esi - 0x7e153f12], edx
jne 0x16e4fe5
and byte [ecx], 0xde
test al, 0xc1
enter 0xffffffffffff8c8d, 0xc
mov ecx, 0x45c3459a
sub eax, 0xb693daec
xlatb
pop es
invalid
xchg dword [esp + edi - 0x39331d15], ecx
mov edi, dword [esp + edi*2 - 0x72663a5e]
jae 0x1629484
or word [esp + 0x14], 0x852b
xor byte [esp + 0x14], 0x14
jne 0x16bd626
mov eax, dword [0x4f62cd9]
push 0x21af99d7
invalid
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
ret
neg esi
mov ebp, 0x4993f7a5
cmp ebp, 0xc397b3bb
push edx
call fcn.016c8f1a
ficomp dword [esp + edx*2 + 0x5f0da395]
cdq
pop ebx
shr byte [edi], 1
mov ecx, 0x10e97f4f
jmp 0xd10b9542

Function at 0x16b671e
Capabilities:
Encode data using xor

Disassembly:
call fcn.01671c62
syscall
inc ecx
push edx
pushfd
dec ecx
mov edx, 0xf6b0f189
sbb bh, byte [ecx]
adc ebp, dword [edi - 0x18]
mov edx, ebp
add eax, 0x6890f00
mov ebp, 0x4481ffff
invalid
inc esp
and al, 4
loope 0x16b679e
add al, byte [eax]
sub byte [ecx + ebx*4 - 0x73f0a161], 0x54

Function at 0x16c5c47
Capabilities:
Encode data using xor

Disassembly:
jge 0x162ab79
cmovae edx, dword [esp + edx + 0x40509008]
add dword [esp + edx + 0x40508fec], 0xffaa8e75
mov edx, dword [esp + edx + 0x4050900c]
call fcn.016a2715
leave
jge 0x162ac11
jnp 0x162ab9e
pop es
add cl, cl
pop eax
xor byte [ebp - 0x3a], al
mov edi, esp
adc dword [ecx], esp
xlatb
out 0x11, eax
and edi, edx
jle 0x162ab94
mov ebp, dword fs:[esi]
add eax, 0x720aac7d
je 0x162abd4
retf
add byte [eax], al
js 0x162ab95
in al, dx
push edx
sub eax, ebp
ja 0x162ac08
stosd dword es:[edi], eax
invalid
add byte [eax], al
js 0x162ac08
add al, al
sub al, 0xaf
out dx, eax
fisttp word [edx + 0x2a2f9d73]
stosd dword es:[edi], eax
invalid
das
sub ch, byte [ebx + 0x7fffffff]
js 0x162ac3a
mov byte [edi], dl
inc esi
sub ch, byte [ebx + 0x17fffff]
std
aas
push cs
clc
push eax
add eax, 0x906687a4
and byte [ebp + 0x7c], dh
pop ds
salc
loopne 0x162ac04
test esp, edx
aaa
dec esi
mov eax, 0x9ffc6df8
insd dword es:[edi], dx
cld
lahf
inc esi
jo 0x162ac50
inc ebp
or al, 0xef
push ds
call 0xc0b6f159
push eax
into
or byte [eax], al
invalid
mov ebx, 0xd4e0f20d
cld
inc ebp
aam 0x33
adc eax, 0x46808a14
loope 0x162aca4
outsd dx, dword [esi]
and byte [esi + 0x4f], cl
pushal
aaa
leave
xchg ebx, eax
test dword [edx + 0x1cb39c58], ebp
push edx
salc
push esp
add byte [eax], al
lodsb al, byte [esi]
dec ebp
salc
or byte [ecx - 0x2a34b21a], 0x1d
mov byte [ecx - 0x46], bl
mov bl, 5
dec ebp
fdiv st(1)
shr byte [ebx - 0x56df8aa3], cl
retf 0x2513
push ss
shr byte [esp + esi - 0x151a3480], 8
test word [esp + esi*4 - 0x5468d244], 0x52ab
mov esi, dword [esp + esi*4 - 0x5468d258]
jne 0x161d722

Function at 0x16ea38f
Capabilities:
Packed with generic packer

Disassembly:
jle fcn.0162781c
test cx, 0xd324
ja 0x162eea7
not ecx
xor ecx, dword [esp + 8]
xchg dword [esp + ecx - 0x98918d8], esi
mov ecx, dword [esp + ecx - 0x98918e0]
neg byte [esp + 8]
or dword [esp + 8], 0x90944929
add dword [esp + 8], 0x568fdb13
call fcn.01727888
Function at 0x16fd6f4
Capabilities:
Encode data using xor

Disassembly:
call fcn.016e6fa9
mov byte [esp + esi*4 - 0x3984c], 7
mov esi, dword [esp + esi*2 - 0x1cc00]
jns 0x1701049
hlt
neg dword [esp + 0x40]
call fcn.0168c760
add esp, ebp
jb 0x170104d
in al, dx
inc ebx
mov ebp, 0x3c42d33c
lds ebx, [eax]
or esp, edi
inc edx
cmp al, 0xc5
sbb byte [esi], bh
or esp, edi
mov edi, 0x88746a7
stc
xlatb
jle 0x1701016
cli
jb 0x17010ae
and al, 0x4c
xchg ebp, eax
mov dword [0x450c0533], eax
pushal
int1
mov eax, 0x3a0d5c78
bound eax, qword [eax]
add byte [eax], al
add byte [edx + edi*8 - 0x24], dh
inc eax
mov esi, 0xc05dc5bd
push ds
push edi
or cl, byte [ecx + 0x3ac08168]
je 0x170105b
popfd
lahf
mov dh, 0x40
clc
lodsd eax, dword [esi]
adc al, 0x37
xchg byte [eax - 0x20], dh
cmc
aam 0xf7
mov dh, pe_nt_image_headers32
rol byte [ebp - 0x24], 1
dec ebx
cmp dword [0x3a052462], edi
mov ebx, 0x77b144ad
rcl byte [edx]
out dx, al
inc ecx
mov edi, 0x2600e11e
scasd eax, dword es:[edi]
sub ch, byte [ebx + ecx - 7]
cmp eax, 0xa27d9c75
xor al, 0xcd
aam 0x99
lahf
cwde
jp 0x17010da
inc ecx
cmp ah, byte [edx]
add byte [edx + 0x3aabca0b], dh
push ebp
sub esi, dword [edx + ebx*4 - 0x3ad990c6]
inc esp
lcall 0x42ca, 0x7c7596cf
push edi
sbb eax, 0x5f0a3a8c
push ss
cmc
mov esp, 0x7e77228a
sbb eax, 0x2fba7244
dec esi
insd dword es:[edi], dx
xchg esp, eax
bound ebx, qword [edx + 0xf]
inc byte [ecx + 0x51]
push ecx
jne 0x163de8b

Function at 0x1708fb6
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jne 0x16d3e0c
mov ebx, 0xd3081129
pop ebx

Function at 0x171858f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + ebp*2 + 0x75a00014]
jne 0x16222ac
add dword [esp + ebp*2 + 0x75a00008], 0xffa92518
add bp, 0xba0
js 0x1691850
or bp, 0x2dbb
shl bp, 0x22
mov ebp, dword [esp + ebp + 0x3acf4120]
js 0x161abd6
js 0x16eb902
call fcn.016fb925
mov edx, 0xc6b781b0
mov eax, dword [edi]
movzx dx, byte [eax]
jmp 0x1708f3f
shr di, 0x74
and bl, 0x35
mov edi, dword [esp + ebx - 0xdf284e8]
jb 0x1615475
xor bx, word [esp + ebx*2 - 0x1be509ea]
shl bl, 0x71
call fcn.0167bcb4
push 0x5c15cb12
lea esp, [esp + 4]
jmp 0x162eea8
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
ret
add edi, 2
call fcn.016c5802
xchg dword [esp + ebx - 0x3ffffd8], esi
mov ebp, dword [esp + edi*4 - 0x3905c]
movzx edi, byte [esp + ebx - 0x3ffffec]
or ebx, 0xe08a9825
mov ebx, dword [esp + 0x14]
add word [esp + ebx*2 - 0x1be50a7c], 0x278a
jae 0x16531b5

Function at 0x1723126
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
call 0x161bf68
push edi
mov ecx, dword [esi]
shl di, 0x41
push edi
mov di, word ss:[ecx]
adc esi, 2
jmp 0x16b21df
jbe 0x16c7c93
mov edi, 0xab2c4d80
lea ecx, [edi + edi*2 - 0x5f7e19c6]
jmp 0x16c9d65
Function at 0x1723182
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
je 0x17231e2
push 0x9f245c81
add word [esp + 2], 0x9e81
mov dword [esp], ebx
movzx ebx, byte [esi]
push 0x32b2cdb6
xor ebx, ecx
shl dword [esp], 0xff
sub byte [esp + 3], 0x95
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x1497f70]
neg dword [esp]
shr ecx, 8
xor ecx, ebx
inc esi
xor ecx, 0x1582c589
and dword [esp], 0x9c06ba01
dec eax
lea esp, [esp + 4]
jne 0x172319b
mov ebx, 0xe0a98fb9
pop ebx
push 0x3c337881
not dword [esp]
not ecx
call fcn.01616782
call fcn.016dfd08
push 0x7a31d882
add edi, 2
and al, cl
not al
mov word [edi], ax
jmp 0x16667c5

Function at 0x10001370
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
push 1
push 0x23
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dl, 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], dl
je 0x100013c7
mov edi, 0x10003068
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x57
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x11], 0x77
mov byte [esp + 0x12], 0x73
mov byte [esp + 0x13], dl
mov byte [esp + 0x14], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002aaee
pop dword [ebp - 0x34]
mov eax, 0xf4e9b98c
sub eax, 0xe4e70e9e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x90a691c4
sub dword [ebp - 0x44], 0x42544c79
mov dword [ebp - 0x40], 0x5ab45c3b
add dword [ebp - 0x40], 0xd77ef00a
mov dword [ebp - 0x3c], 0x3bcca212
add dword [ebp - 0x3c], 0x107fa21c
mov dword [ebp - 0x38], 0x3487fc81
add dword [ebp - 0x38], 0xcb78037f
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe2ea8190
sub eax, 0xd2e7c158
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9eeb9a4c
add dword [ebp - 0x44], 0xd586cf0a
mov dword [ebp - 0x40], 0x414a8c9c
sub dword [ebp - 0x40], 0xffde2b27
mov dword [ebp - 0x3c], 0x415d23bd
add dword [ebp - 0x3c], 0x221248af
mov dword [ebp - 0x38], 0x42f060ba
add dword [ebp - 0x38], 0xbd0f9f46
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe0b7aefb
add eax, 0x2f4b112d
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36500
push 0
call eax
mov ecx, 0x6558e2e8
add ecx, 0x9aa76479
mov edi, eax
mov edx, 0x10039600
add edx, dword [ebp - 0x34]
mov esi, 0x1ba2ac40
add esi, 0xc306eaf6
mov ebx, dword [edx]
xor dword [ebp - 0x20], ebx
xor ebx, esi
xor dword [ebp - 0x18], edx
mov dword [edi], ebx
sub dword [ebp - 0x2c], 0x2a39fc81
add edi, 0x8ef5cdcb
add edi, 0x710a3239
add edx, 0x3281be28
sub edx, 0x3281be24
loop 0x1002ac0a
add eax, 0x9dfca159
sub eax, 0x9dfb9102
mov ebx, eax
add eax, 0x674c12b9
add eax, 0x98b3ed4c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x90
push edi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x14]
push eax
push str.SYSTEMCurrentControlSetControlUtcRS232Device
push str._s_d_
push ecx
mov dword [esp + 0x18], 0xffffffff
call fcn.004035a8
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x14]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x401b45
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.COMPORT
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0x90
ret

Function at 0x401b60
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x24
lea eax, [esp]
push esi
push edi
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlUtc_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push edi
push str.RS232_DEVICE_d
push ecx
mov esi, eax
call fcn.004035a8
add esp, 0xc
call fcn.00402c70
test esi, esi
jne 0x401bf1
cmp eax, 0x7d0
je 0x401bd6
cmp eax, 0x7d3
je 0x401bd6
cmp eax, 0x7d6
je 0x401bd6
cmp eax, 0x7d7
je 0x401bd6
cmp eax, 0x190
je 0x401bd6
test edi, edi
jne 0x401be6
mov edx, dword [esp + 8]
push str.RS232_DEVICE0
push edx
jmp 0x401be0
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x24
ret
Function at 0x401c00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x144
push ebp
push esi
mov esi, dword [esp + 0x150]
push edi
mov ecx, 0x10
xor eax, eax
mov edi, esi
mov ebp, 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebp
push eax
push 0x20019
push 0
push str.HARDWAREDEVICEMAPSERIALCOMM
push 0x80000002
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401c55
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x144
ret
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x24]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x28]
xor ebx, ebx
push edx
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x20]
push ebx
lea edx, [esp + 0x100]
push ecx
push edx
push ebx
push eax
mov byte [esp + 0x38], 0
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, eax
cmp ebp, 0x103
je 0x401db0
mov dword [esp + 0x20], esi
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x8c]
lea esi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x8c]
mov edx, ecx
push 3
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x90]
and ecx, 3
push 0x409144
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00403570
add esp, 0xc
test eax, eax
jne 0x401d37
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x401d37
lea ecx, [esp + 0x8f]
push ecx
call fcn.00403557
mov edx, dword [esp + 0x24]
add esp, 4
mov dword [edx], eax
mov al, byte [esp + 0x18]
inc al
mov byte [esp + 0x18], al
mov ecx, dword [esp + 0x20]
inc ebx
add ecx, 4
cmp ebp, 0x103
mov dword [esp + 0x20], ecx
je 0x401db0
cmp ebx, 0x10
ja 0x401db0
mov eax, 0x64
mov ecx, 0x19
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, eax
cmp ebp, 0x103
jne 0x401cbb
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
and eax, 0xff
pop ebp
add esp, 0x144
ret