joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x23c]
test eax, eax
push edi
mov edi, dword [esp + 0x14]
je 0x482d9d
mov ecx, dword [esi + 0x238]
test ecx, ecx
je 0x482d9d
push edi
push eax
call ebx
test eax, eax
jne 0x482da3
mov eax, dword [esi]
push edi
push eax
call ebx
pop edi
pop esi
pop ebx
ret 8

Function at 0x4835b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
shr eax, 0x10
movzx ecx, al
push esi
push ecx
movzx edx, ah
mov eax, dword [esp + 0x218]
push edx
push eax
lea ecx, [esp + 0x14]
push str.SoftwareSony_Creative_Software_s_d._dLang
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea edx, [esp + 8]
push edx
push 0
push 0x20019
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x483640
mov ecx, dword [esp + 0x224]
mov edx, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x21c]
push edx
mov edx, dword [esp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x20c
ret 0x14

Function at 0x483660
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
shr eax, 0x10
movzx ecx, al
push esi
push ecx
movzx edx, ah
mov eax, dword [esp + 0x218]
push edx
push eax
lea ecx, [esp + 0x14]
push str.SoftwareSony_Creative_Software_s_d._dLang
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4836f0
mov ecx, dword [esp + 0x224]
mov edx, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x21c]
push edx
mov edx, dword [esp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x20c
ret 0x14
Function at 0x483bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0xc]
mov word [eax], 0
mov eax, dword [ebp + 0x23c]
test eax, eax
push esi
push edi
je 0x483c7c
mov ecx, dword [ebp + 0x238]
test ecx, ecx
je 0x483c7c
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov cx, word [ebp + 0x240]
shr edx, 4
inc edx
push ecx
movzx ecx, dx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x483c7c
mov edx, dword [ebp + 0x23c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x483c7c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x483c7c
mov eax, dword [esp + 0x18]
and eax, 0xf
jbe 0x483c52
dec eax
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x483c48
movzx eax, word [esi]
inc eax
cmp eax, ebx
jl 0x483c5c
mov eax, ebx
push eax
mov eax, dword [esp + 0x20]
lea edx, [esi + 2]
push edx
push eax
call fcn.004049b0
mov si, word [esi]
movzx edi, si
cmp edi, ebx
jl 0x483c77
mov edi, ebx
test si, si
jne 0x483c93
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ebp]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
test edi, edi
je 0x483cab
mov ecx, dword [esp + 0x1c]
push 3
push 0x5e7168
push ebx
push ecx
call fcn.00483950
sub edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x483f90
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x483fd3
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx + 0x240]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jg 0x483fcd
push 0x5d49c0
push esi
call dword [0x5d2614]
add esp, 8
xor eax, eax
pop esi
ret 0xc
mov eax, 1
pop esi
ret 0xc
Function at 0x4846c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x4846d3
mov esi, dword [0x621c7c]
test esi, esi
je 0x484742
push edi
mov edi, dword [esp + 0x54]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x484704
mov eax, dword [esi + 0x208]
jmp 0x48470a
mov eax, dword [esi + 0x414]
test eax, eax
je 0x484742
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x54]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
mov esi, 4
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x484742
cmp dword [esp + 0x4c], esi
je 0x48474b
xor eax, eax
pop esi
add esp, 0x44
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 0x44
ret 8

Function at 0x484760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x484773
mov esi, dword [0x621c7c]
test esi, esi
je 0x4847ae
push edi
mov edi, dword [esp + 0x54]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x4847a4
mov eax, dword [esi + 0x208]
jmp 0x4847aa
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x4847b9
mov eax, dword [esp + 0x5c]
pop esi
add esp, 0x44
ret 0x14
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x54]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
mov esi, 4
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4847ed
cmp dword [esp + 0x4c], esi
je 0x4847f3
mov eax, dword [esp + 0x5c]
jmp 0x4847f7
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
cmp ecx, edx
je 0x484816
cmp eax, ecx
jge 0x484810
mov eax, ecx
pop esi
add esp, 0x44
ret 0x14
cmp eax, edx
jle 0x484816
mov eax, edx
pop esi
add esp, 0x44
ret 0x14
Function at 0x484820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x484833
mov esi, dword [0x621c7c]
test esi, esi
je 0x48486e
push edi
mov edi, dword [esp + 0x54]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x484864
mov eax, dword [esi + 0x208]
jmp 0x48486a
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x484879
mov eax, dword [esp + 0x54]
pop esi
add esp, 0x44
ret 0xc
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x54]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
mov esi, 4
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4848ad
cmp dword [esp + 0x4c], esi
je 0x4848c1
mov eax, dword [esp + 0x54]
xor ecx, ecx
test eax, eax
setne cl
pop esi
mov eax, ecx
add esp, 0x44
ret 0xc
mov eax, dword [esp + 4]
xor ecx, ecx
test eax, eax
setne cl
pop esi
mov eax, ecx
add esp, 0x44
ret 0xc

Function at 0x4848e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4848f3
mov esi, dword [0x621c7c]
test esi, esi
je 0x48492e
push edi
mov edi, dword [esp + 0x50]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0xc]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x484924
mov eax, dword [esi + 0x208]
jmp 0x48492a
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x48493a
mov eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
push 4
lea ecx, [esp + 0x54]
push ecx
push 4
push 0
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
Function at 0x484970
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
push edi
jne 0x484984
mov esi, dword [0x621c7c]
test esi, esi
je 0x4849bd
mov edi, dword [esp + 0x50]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0xc]
push 0x5e7474
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jge 0x4849b3
mov eax, dword [esi + 0x208]
jmp 0x4849b9
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x4849df
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 0x10
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x4c]
push ecx
push edi
lea edx, [esp + 0x58]
push edx
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x484a17
cmp dword [esp + 0x50], 3
je 0x484a1f
xor edx, edx
mov dword [esp + 0x4c], edx
jmp 0x484a23
mov edx, dword [esp + 0x4c]
cmp edx, esi
jae 0x484a41
add edi, edx
mov ecx, esi
sub ecx, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x4c]
pop edi
mov eax, edx
pop esi
add esp, 0x40
ret 0x10

Function at 0x484a50
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x40
push ebp
xor ebp, ebp
test eax, eax
je 0x484b3e
push esi
mov esi, dword [esp + 0x4c]
cmp esi, 0xffffffff
jne 0x484a72
mov esi, dword [0x621c7c]
test esi, esi
push edi
je 0x484aac
mov edi, dword [esp + 0x54]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e7474
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jge 0x484aa2
mov eax, dword [esi + 0x208]
jmp 0x484aa8
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x484aba
pop edi
pop esi
mov eax, 0x8004e00a
pop ebp
add esp, 0x40
ret 0x14
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x50]
push ecx
push edi
lea edx, [esp + 0x5c]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x484b26
mov ebp, 0x8004e03c
mov edx, dword [esp + 0x50]
cmp edx, esi
jae 0x484b15
add edi, edx
mov ecx, esi
sub ecx, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x60]
pop edi
mov dword [eax], edx
pop esi
mov eax, ebp
pop ebp
add esp, 0x40
ret 0x14
test eax, eax
jne 0x484b31
cmp dword [esp + 0x54], 3
je 0x484af3
xor edx, edx
mov dword [esp + 0x50], edx
mov ebp, 1
jmp 0x484af7
mov eax, 0x80070057
pop ebp
add esp, 0x40
ret 0x14
Function at 0x484b50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
je 0x484b98
test esi, esi
je 0x484b98
push edi
mov edi, dword [esp + 0x50]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0xc]
push 0x5e7474
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x484b8e
mov eax, dword [esi + 0x208]
jmp 0x484b94
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x484ba4
mov eax, 0x80004005
pop esi
add esp, 0x40
ret 0x10
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push ecx
push edx
push 3
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
add esp, 0x40
ret 0x10

Function at 0x484bd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x54]
push esi
mov esi, dword [esp + 0x4c]
add ebx, ebx
cmp esi, 0xffffffff
je 0x484c1f
test esi, esi
je 0x484c1f
push edi
mov edi, dword [esp + 0x54]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e7484
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
pop edi
jge 0x484c15
mov eax, dword [esi + 0x208]
jmp 0x484c1b
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x484c2c
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x40
ret 0x10
mov ecx, dword [esp + 0x54]
push ebx
push ecx
push 7
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
pop esi
and eax, 0x80004005
pop ebx
add esp, 0x40
ret 0x10

Function at 0x484c60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x40
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call fcn.00484610
test eax, eax
je 0x484cbb
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x54]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x484cb5
cmp eax, 0xea
jne 0x484cbb
cmp esi, dword [esp + 0x4c]
je 0x484cc7
mov eax, 1
pop esi
add esp, 0x40
ret 0xc
xor eax, eax
pop esi
add esp, 0x40
ret 0xc

Function at 0x484cd0
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
sub esp, 0x40
lea eax, [esp]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
call fcn.00484610
test eax, eax
jne 0x484cfa
mov eax, 1
add esp, 0x40
ret 0xc
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb eax, eax
and eax, 0x80004005
add esp, 0x40
ret 0xc
Function at 0x484d20
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
sub esp, 0x40
lea eax, [esp]
push eax
push ecx
push 0
push edx
call fcn.00484610
test eax, eax
jne 0x484d47
mov eax, 1
add esp, 0x40
ret 0xc
mov ecx, dword [esp + 0x48]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb eax, eax
and eax, 0x80004005
add esp, 0x40
ret 0xc

Function at 0x485240
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x485253
mov esi, dword [0x621c7c]
test esi, esi
je 0x48527c
xor eax, eax
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 8]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 0x414]
add esp, 0xc
test eax, eax
jne 0x485288
mov eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
mov edx, dword [esp + 0x4c]
push 4
lea ecx, [esp + 0x54]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc

Function at 0x4852b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
cmp esi, 0xffffffff
jne 0x4852c3
mov esi, dword [0x621c7c]
test esi, esi
je 0x485320
xor eax, eax
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x5e747c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 0x414]
add esp, 0xc
test eax, eax
je 0x485320
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x58]
push ecx
push 0
push edx
mov esi, 4
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x68], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x485320
cmp dword [esp + 0x50], esi
je 0x48532b
mov eax, dword [esp + 0x58]
pop esi
add esp, 0x48
ret 0xc
mov eax, dword [esp + 8]
pop esi
add esp, 0x48
ret 0xc
Function at 0x485340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x50]
cmp esi, 0xffffffff
lea ebx, [ebp + ebp]
jne 0x48535d
mov esi, dword [0x621c7c]
test esi, esi
push edi
je 0x485397
mov edi, dword [esp + 0x58]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x14]
push 0x5e746c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jge 0x48538d
mov eax, dword [esi + 0x208]
jmp 0x485393
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x4853b7
mov esi, dword [esp + 0x5c]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor edx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x60], edx
jmp 0x4853f7
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x60]
push ecx
push esi
lea edx, [esp + 0x5c]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
mov edi, 1
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4853eb
cmp dword [esp + 0x54], edi
je 0x4853f3
xor edx, edx
mov dword [esp + 0x60], edx
jmp 0x4853f7
mov edx, dword [esp + 0x60]
cmp edx, ebx
jae 0x485416
mov ecx, ebx
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x60]
cmp edx, 2
pop edi
ja 0x485469
test edx, edx
jbe 0x485428
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x48544b
mov eax, dword [esp + 0x60]
test eax, eax
je 0x48544b
test ebp, ebp
jle 0x485447
push ebp
push eax
push esi
call dword [0x5d2618]
add esp, 0xc
mov word [ebx + esi - 2], 0
test esi, esi
jne 0x485456
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 0x18
push esi
call dword [0x5d2620]
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0x18
pop esi
mov eax, edx
shr eax, 1
pop ebp
dec eax
pop ebx
add esp, 0x40
ret 0x18

Function at 0x485480
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x485499
mov eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
test esi, esi
push edi
je 0x4854d3
mov edi, dword [esp + 0x50]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0xc]
push 0x5e746c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jge 0x4854c9
mov edi, dword [esi + 0x208]
jmp 0x4854cf
mov edi, dword [esi + 0x414]
test edi, edi
jne 0x4854e0
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
mov esi, dword [esp + 0x54]
test esi, esi
jne 0x4854ec
xor eax, eax
jmp 0x4854f6
push esi
call dword [0x5d2620]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
pop edi
and eax, 0x80004005
pop esi
add esp, 0x40
ret 0xc
Function at 0x485520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x50]
cmp esi, 0xffffffff
lea ebx, [ebp + ebp]
jne 0x48553d
mov esi, dword [0x621c7c]
test esi, esi
push edi
je 0x485577
mov edi, dword [esp + 0x58]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x14]
push 0x5e7484
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jge 0x48556d
mov eax, dword [esi + 0x208]
jmp 0x485573
mov eax, dword [esi + 0x414]
test eax, eax
jne 0x485597
mov esi, dword [esp + 0x5c]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor edx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x60], edx
jmp 0x4855d7
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x60]
push ecx
push esi
lea edx, [esp + 0x5c]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
mov edi, 7
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4855cb
cmp dword [esp + 0x54], edi
je 0x4855d3
xor edx, edx
mov dword [esp + 0x60], edx
jmp 0x4855d7
mov edx, dword [esp + 0x60]
cmp edx, ebx
jae 0x4855f6
mov ecx, ebx
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x60]
cmp edx, 2
pop edi
ja 0x485649
test edx, edx
jbe 0x485608
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x48562b
mov eax, dword [esp + 0x60]
test eax, eax
je 0x48562b
test ebp, ebp
jle 0x485627
push ebp
push eax
push esi
call dword [0x5d2618]
add esp, 0xc
mov word [ebx + esi - 2], 0
test esi, esi
jne 0x485636
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 0x18
push esi
call dword [0x5d2620]
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0x18
pop esi
mov eax, edx
shr eax, 1
pop ebp
dec eax
pop ebx
add esp, 0x40
ret 0x18
Function at 0x48ca50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebp
lea eax, [esp + 0xc]
push eax
push 2
push ecx
push edx
call sym.vidcap60.exe__SfLoadResourceCustom_16
mov ebp, eax
test ebp, ebp
jne 0x48ca71
pop ebp
ret 0x20
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x48ca86
pop esi
xor eax, eax
pop ebp
ret 0x20
cmp dword [esi], 0x28
jne 0x48ca7f
mov eax, dword [esp + 0x10]
push ebx
xor ebx, ebx
test eax, eax
push edi
je 0x48cac1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x48cac1
mov ecx, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
jne 0x48cad5
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x20
mov eax, dword [esp + 0x1c]
mov esi, dword [ebx]
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
mov eax, dword [esp + 0x20]
add esi, ebx
shl ecx, 8
or ecx, edx
mov dword [esi], ecx
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
mov eax, dword [esp + 0x24]
push 0
shl ecx, 8
or ecx, edx
mov dword [esi + 0x1c], ecx
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
mov eax, dword [esp + 0x2c]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x20], ecx
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
mov eax, dword [esp + 0x30]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x3c], ecx
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
mov eax, dword [esp + 0x34]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x2c], ecx
movzx ecx, ah
mov ch, al
shr eax, 0x10
movzx edx, al
shl ecx, 8
or ecx, edx
mov dword [esi + 0x28], ecx
call dword [sym.imp.USER32.dll_GetDC]
push 0
push ebx
add esi, 0x40
push esi
push 4
mov edi, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0x20