joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68ef2285
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5c528
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [edi + 4]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [esp + 0x14], eax
lea esi, [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.68ef2521
mov eax, dword [eax]
cmp eax, ebx
jge 0x68ef22e4
call fcn.68ef254a
push eax
push ebx
lea eax, [esp + 0x18]
push eax
call sym.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::Set_class_GCStr___wchar_t_const___unsigned_long_int_
lea esi, [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.68ef2521
mov ecx, dword [eax]
mov eax, dword [edi + 4]
push ecx
push dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esi], eax
or dword [esp + 0x28], 0xffffffff
cmp ebx, ebx
je 0x68ef232e
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef2e71
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0xd8]
test eax, eax
push esi
jne 0x68ef2ed3
mov ecx, dword [ecx + 0xd4]
push 2
lea eax, [ebp - 4]
push eax
push 0x100c
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x68ef2ec3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef2eac
call esi
jmp 0x68ef2eb8
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756c
call fcn.68ef1014
movzx eax, word [ebp - 4]
sub eax, 0x2f
cdq
push 7
pop ecx
idiv ecx
mov eax, edx
inc eax
pop esi
leave
ret

Function at 0x68ef332b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 0xd4]
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x100d
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x68ef3373
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef335c
call esi
jmp 0x68ef3368
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756e
call fcn.68ef1014
movzx eax, word [ebp - 4]
sub eax, 0x30
sub eax, 0
je 0x68ef338d
dec eax
je 0x68ef3389
dec eax
jne 0x68ef338d
mov al, 4
jmp 0x68ef338f
mov al, 7
jmp 0x68ef338f
mov al, 1
pop esi
leave
ret
Function at 0x68ef59e1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 2
lea eax, [ebp - 0x18]
push eax
push 0x23
push dword [ebp + 8]
call edi
test eax, eax
jne 0x68ef5a31
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef5a1a
call esi
jmp 0x68ef5a26
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7664
call fcn.68ef1014
cmp word [ebp - 0x18], 0x30
je 0x68ef5a3c
xor al, al
jmp 0x68ef5a56
push 9
lea eax, [ebp - 0x18]
push eax
push 0x28
push dword [ebp + 8]
call edi
test eax, eax
je 0x68ef5a38
xor eax, eax
cmp word [ebp - 0x18], ax
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.68f53fd7
leave
ret 4

Function at 0x68ef6100
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 0x5a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef6161
lea eax, [esp + 0xc]
jmp 0x68ef6163
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6194
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef61ba
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef621b
lea eax, [esp + 0xc]
jmp 0x68ef621d
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef624e
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef6274
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef62d5
lea eax, [esp + 0xc]
jmp 0x68ef62d7
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6308
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef6340
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef63a1
lea eax, [esp + 0xc]
jmp 0x68ef63a3
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef63d4
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef63fa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef645b
lea eax, [esp + 0xc]
jmp 0x68ef645d
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef648e
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x68ef64b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d475
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
push 0x80
lea ecx, [esp + 0x10]
push ecx
push 0x59
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x68ef6515
lea eax, [esp + 0xc]
jmp 0x68ef6517
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::constructor_wchar_t_const__
and dword [esp + 0x120], 0
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
or dword [esp + 0x120], 0xffffffff
cmp dword [esp + 8], 0
je 0x68ef6548
lea ecx, [esp + 8]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef656e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5d43c
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [esp + 0x14], eax
mov edi, 0x80
push edi
lea eax, [esp + 0x120]
push eax
mov ebx, ecx
push 0x59
push dword [ebx]
call esi
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push 0x5a
push dword [ebx]
call esi
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x230], esi
cmp dword [esp + 0x18], esi
jle 0x68ef6617
cmp eax, esi
jle 0x68ef6617
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x18]
push 0x68f70e74
push eax
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0x10
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [edi], eax
or dword [esp + 0x230], 0xffffffff
cmp esi, esi
je 0x68ef663a
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, edi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 4
Function at 0x68ef848f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0xa], 0
push ebx
push edi
jne 0x68ef85bf
cmp byte [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
je 0x68ef84bc
mov eax, dword [ebp + 0xc]
jmp 0x68ef84e8
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call edi
test eax, eax
jne 0x68ef84dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776a
call fcn.68ef1014
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call edi
test eax, eax
jne 0x68ef850c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776b
call fcn.68ef1014
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call edi
test eax, eax
jne 0x68ef8537
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776c
call fcn.68ef1014
movzx eax, word [ebp - 0x18]
push 5
lea ebx, [esi + 0x48]
push ebx
push 0xe
push dword [esi]
sub eax, 0x30
mov dword [esi + 0x18], eax
call edi
test eax, eax
jne 0x68ef8562
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776d
call fcn.68ef1014
push 5
mov dword [esi + 0x1c], ebx
lea ebx, [esi + 0x52]
push ebx
push 0xf
push dword [esi]
call edi
test eax, eax
jne 0x68ef8586
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776e
call fcn.68ef1014
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
mov dword [esi + 0x20], ebx
call edi
test eax, eax
jne 0x68ef85ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e776f
call fcn.68ef1014
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.68f53fd7
leave
ret 8
Function at 0x68ef8640
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0xa], 0
push ebx
push edi
jne 0x68ef87be
cmp byte [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
je 0x68ef866d
mov eax, dword [ebp + 0xc]
jmp 0x68ef8699
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call edi
test eax, eax
jne 0x68ef868e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7771
call fcn.68ef1014
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call edi
test eax, eax
jne 0x68ef86bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7772
call fcn.68ef1014
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [esi]
call edi
test eax, eax
jne 0x68ef86e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7773
call fcn.68ef1014
movzx eax, word [ebp - 0x18]
push 5
lea ebx, [esi + 0x48]
push ebx
push 0x16
push dword [esi]
sub eax, 0x30
mov dword [esi + 0x30], eax
call edi
test eax, eax
jne 0x68ef8713
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7774
call fcn.68ef1014
push 5
mov dword [esi + 0x34], ebx
lea ebx, [esi + 0x52]
push ebx
push 0x17
push dword [esi]
call edi
test eax, eax
jne 0x68ef8737
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7775
call fcn.68ef1014
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x1c
push dword [esi]
mov dword [esi + 0x38], ebx
call edi
test eax, eax
jne 0x68ef875b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7776
call fcn.68ef1014
mov ebx, dword [sym.imp.MSVCR80.dll__wtoi]
lea eax, [ebp - 0x18]
push eax
call ebx
pop ecx
push 0xa
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x1b
push dword [esi]
call edi
test eax, eax
jne 0x68ef878c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7777
call fcn.68ef1014
lea eax, [ebp - 0x18]
push eax
call ebx
pop ecx
push 7
lea ebx, [esi + 0x5c]
push ebx
push 0x14
push dword [esi]
mov dword [esi + 0x40], eax
call edi
test eax, eax
jne 0x68ef87b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e6e7778
call fcn.68ef1014
mov dword [esi + 0x44], ebx
mov byte [esi + 0xa], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.68f53fd7
leave
ret 8
Function at 0x68ef96a4
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x68f5d2a0
call fcn.68f54ccb
mov eax, dword [ebp + 0xc]
push 0xac
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x230], eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x228]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x228], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x68ef970b
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x224], eax
jmp 0x68ef9710
call fcn.68ef99de
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x228], ebx
mov edi, 0x80070000
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x234], 0x105
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x228]
cmp eax, 0x103
je 0x68ef985b
cmp eax, ebx
je 0x68ef9788
call esi
test eax, eax
jg 0x68ef9774
call esi
jmp 0x68ef977d
call esi
and eax, 0xffff
or eax, edi
push eax
push 0x2e6e3033
call fcn.68ef1014
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCRegistryKey::constructor_struct_HKEY_____wchar_t_const___bool_
mov byte [ebp - 4], 1
push 0x20019
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::Open_unsigned_long_int_
test eax, eax
je 0x68ef97d7
call esi
test eax, eax
jg 0x68ef97c3
call esi
jmp 0x68ef97cc
call esi
and eax, 0xffff
or eax, edi
push eax
push 0x2e6e3034
call fcn.68ef1014
push ebx
push str.Index
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::GetValue_unsigned_long_int___wchar_t_const___unsigned_long_int__const
test eax, eax
je 0x68ef9806
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
jmp 0x68ef9721
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp + 8]
jne 0x68ef97f3
mov ebx, dword [ebp - 0x230]
lea eax, [ebp - 0x248]
push eax
call fcn.68ef9c26
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], ebx
je 0x68ef9851
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], ebx
mov al, 1
call fcn.68f54d4e
ret 8
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], ebx
je 0x68ef9879
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], ebx
xor al, al
jmp 0x68ef9853
Function at 0x68ef9f5f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x68ef9fc2
cmp dword [ebp + 0xc], 1
je 0x68ef9f9b
cmp dword [ebp + 0xc], 2
je 0x68ef9f9b
push 0xd
pop eax
jmp 0x68ef9fc2
test edi, edi
mov eax, dword [ebp - 4]
je 0x68ef9fbc
test eax, eax
je 0x68ef9fb8
test al, 1
jne 0x68ef9f96
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x68ef9fbc
jmp 0x68ef9f96
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x68f028c5
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor ecx, ecx
cmp dword [ebp + 8], ecx
jbe 0x68f029c9
mov dword [ebp - 4], 1
sub dword [ebp - 4], esi
mov dword [ebp - 8], 2
sub dword [ebp - 8], esi
push ebx
push edi
mov ebx, dword [eax]
lea edi, [ecx + esi]
movzx edx, byte [edi]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], dl
mov edx, dword [ebp - 4]
inc dword [eax]
add edx, edi
cmp edx, dword [ebp + 8]
je 0x68f0297a
mov dl, byte [edi]
movzx ebx, byte [ecx + esi + 1]
and dl, 3
shl dl, 4
shr ebx, 4
movzx edx, dl
or edx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [eax]
mov byte [edx], bl
mov ebx, dword [ebp - 8]
inc dword [eax]
mov edx, dword [eax]
add ebx, edi
cmp ebx, dword [ebp + 8]
je 0x68f029a3
mov bl, byte [ecx + esi + 1]
and bl, 0xf
shl bl, 2
movzx edi, bl
movzx ebx, byte [ecx + esi + 2]
shr ebx, 6
or edi, ebx
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], bl
inc dword [eax]
movzx edx, byte [ecx + esi + 2]
mov edi, dword [eax]
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], dl
inc dword [eax]
add ecx, 3
cmp ecx, dword [ebp + 8]
jb 0x68f028eb
jmp 0x68f029c7
mov cl, byte [ecx + esi]
and cl, 3
shl cl, 4
movzx ecx, cl
mov dl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [eax]
mov byte [ecx], dl
inc dword [eax]
cmp byte [ebp + 0xc], 0
mov ecx, dword [eax]
je 0x68f029c7
mov byte [ecx], 0x3d
inc dword [eax]
mov ecx, dword [eax]
jmp 0x68f029c2
mov cl, byte [ecx + esi + 1]
and cl, 0xf
shl cl, 2
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
inc dword [eax]
cmp byte [ebp + 0xc], 0
mov ecx, dword [eax]
je 0x68f029c7
mov byte [ecx], 0x3d
inc dword [eax]
pop edi
pop ebx
leave
ret 8