joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454593
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45458b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45446c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45446c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45447f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x454560
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x454552
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x45454b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4544d6
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x45451f
mov eax, 1
cmp eax, ecx
ja 0x45450d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.004649c0
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x454546
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x454512
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x4544db
call fcn.00464960
xor eax, eax
call fcn.00464950
call fcn.004649c0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x454586
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x454557
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x454484
call fcn.00464960
xor eax, eax
call fcn.00464950
nop
call fcn.004634e0
jmp fcn.00454410
Function at 0x45bb90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bc2f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00464b67
lea ecx, [0x45bc40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004633d0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004634e0
jmp fcn.0045bb90
Function at 0x4647b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xaa0160]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x462f8b
je 0x462fde
cmp ebx, 0x20
jbe 0x462fe4
cmp ebx, 0x40
jbe 0x46302a
jmp 0x4630cb
test ebx, ebx
je 0x462fd4
add eax, 0x10
test ax, 0xff0
je 0x462fc0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x8b01c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x8b02c0]
jmp 0x462fa8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462fa8
pxor xmm1, xmmword [0xaa0170]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xaa0170]
pxor xmm2, xmmword [0xaa0180]
pxor xmm3, xmmword [0xaa0190]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xaa0170]
pxor xmm2, xmmword [0xaa0180]
pxor xmm3, xmmword [0xaa0190]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46312a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa9fbfe], 0
je 0x4647ca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x462f50
jmp fcn.004095d0
Function at 0x6c6d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xc
mov dword [esp + 8], edx
mov edx, dword [eax + 0x14]
mov dword [esp], eax
test edx, edx
jle 0x6c6dc5
lea esi, [esi]
mov edi, ebp
xor edi, 1
cmp ebp, 2
cmovge edi, ebp
mov eax, edi
mov dword [esp + 4], edi
mov edi, dword [esp]
shl eax, 4
add eax, dword [edi + 0x10]
mov edi, eax
test ebx, ebx
je 0x6c6da2
mov esi, dword [eax]
xor eax, eax
jmp 0x6c6d92
movzx ecx, byte [ecx + 0xa40be0]
cmp byte [edx + 0xa40be0], cl
jne 0x6c6dd0
add eax, 1
movzx edx, byte [esi + eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x6c6d80
test edx, edx
jne 0x6c6d8f
mov eax, dword [edi + 0xc]
mov edx, dword [esp + 8]
xor ecx, ecx
add eax, 0x18
call fcn.006c0d10
mov eax, dword [eax + 8]
test eax, eax
jne 0x6c6dc7
mov eax, dword [esp]
add ebp, 1
cmp dword [eax + 0x14], ebp
jg 0x6c6d50
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x6c6dba
xor edx, edx
mov eax, 0x6d
jmp 0x6c6e01
movzx ecx, byte [ecx + 0xa40be0]
cmp byte [eax + 0xa40be0], cl
jne 0x6c6dba
movzx eax, byte [edx + 0xa3042a]
add edx, 1
movzx ecx, byte [ebx + edx]
cmp eax, ecx
jne 0x6c6de8
test eax, eax
jne 0x6c6df7
jmp 0x6c6da2
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0x7a8258
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a8262
pushal
call 0x7a8268
pop ebp
sub ebp, 0x10
sub ebp, 0x3a8258
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a828c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a8295
mov eax, 0x3a8258
add eax, ebp
add eax, 0x63
mov ecx, 0x5f8
mov edx, 0x8e6cf345
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a82ac
jmp 0x7a82bf
into
mov dh, cl
int3

Function at 0x1071c048
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1071c052
pushal
call 0x1071c058
pop ebp
sub ebp, 0x10
sub ebp, 0x71c048
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1071c07c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1071c085
mov eax, 0x71c048
add eax, ebp
add eax, 0x63
mov ecx, 0x600
mov edx, 0xd9c1d83a
xor byte [eax], dl
inc eax
dec ecx
jne 0x1071c09c
jmp 0x1071c0af
mov cl, 0xf7
mov cl, 0xb3
push es
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a3f], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
jmp [edx + 0x6a]
Function at 0xd280970
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov ebx, ecx
push 0x411
push ebx
call esi
push 0x40f
push ebx
mov dword [ebp - 0x670], eax
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov esi, eax
push 0x188
push esi
call edi
push 0
push 0
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x670]
push 0xb8
push eax
call edi
test eax, eax
je 0xd280a86
mov edx, dword [ebp - 0x670]
push 0x104
lea ecx, [ebp - 0x66c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x412
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x18f
push esi
call edi
mov ecx, dword [0xd2aacf4]
lea edx, [ebp - 0x66c]
push edx
mov ebx, eax
lea eax, [ebp - 0x20c]
push eax
push ecx
lea edx, [ebp - 0x464]
push 0x12c
push edx
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
push 0
push ebx
push 0x182
push esi
call edi
lea eax, [ebp - 0x464]
push eax
push 0
push 0x180
push esi
call edi
push 1
push eax
push 0x19a
push esi
call edi
mov ecx, dword [ebp - 0x674]
push 0
push ecx
push 0x186
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
Function at 0xd281a60
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x20c], 0
je 0xd281aab
test eax, eax
je 0xd281aab
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
Function at 0xd282590
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov edi, dword [ebp + 8]
push 0x88
push edi
mov dword [ebp - 0x624], eax
call esi
test eax, eax
je 0xd2827dd
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x429
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
push eax
call ebx
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0x43a
push edi
call esi
push eax
call ebx
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x43b
push edi
call esi
push eax
call ebx
cmp word [ebp - 0x20c], 0
je 0xd282648
cmp word [ebp - 0x414], 0
je 0xd282633
cmp word [ebp - 0x61c], 0
jne 0xd282648
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0x147
push 0x42a
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
push 0
push eax
push 0x150
push 0x42a
push edi
call esi
push eax
call ebx
mov dword [ebp - 0x620], eax
cmp eax, 0xffffffff
jne 0xd28268a
mov dword [ebp - 0x620], 0
mov cx, word [ebp - 0x20c]
test cx, cx
jne 0xd282795
push 0x420
push edi
call esi
mov esi, dword [ebp - 0x624]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x34], 0
jne 0xd282787
push 0
push 0
push 0xf0
push eax
call ebx
test eax, eax
je 0xd2826d9
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0xd28270e
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0xd2826f2
push ecx
push 0x104
lea eax, [ebp - 0x20c]
push eax
jmp 0xd282706
mov eax, dword [eax + 0x10]
test eax, eax
je 0xd28270e
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
cmp word [ebp - 0x20c], 0
je 0xd282787
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd282721
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
call dword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [esi + 4]
mov dword [ecx + 0x34], eax
mov edx, dword [esi + 4]
add esp, 4
cmp dword [edx + 0x34], 0
je 0xd282633
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd282760
sub eax, edx
mov edx, dword [esi + 4]
sar eax, 1
lea ecx, [ebp - 0x20c]
push ecx
inc eax
push eax
mov eax, dword [edx + 0x34]
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push esi
push edi
call fcn.0d282270
mov cx, word [ebp - 0x20c]
cmp dword [ebp - 0x620], 1
mov ax, word [ebp - 0x61c]
jl 0xd2827c5
test cx, cx
je 0xd282633
cmp word [ebp - 0x414], 0
je 0xd282633
test ax, ax
je 0xd282633
test cx, cx
jne 0xd2827d4
test ax, ax
je 0xd2827dd
jmp 0xd282633
test ax, ax
je 0xd282633
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 8
Function at 0xd282800
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0
call fcn.0d2763f0
mov esi, eax
test esi, esi
je 0xd2828d0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [ebp - 0x210]
test dword [esi + 8], 0x1000
je 0xd2828ba
cmp dword [esi + 4], 0x3ef
jne 0xd282865
mov ecx, dword [ebp - 0x214]
test byte [ecx + 0x16], 2
jne 0xd2828ba
cmp dword [esi + 0x14], 0x403
jne 0xd28288e
push 0x420
push edi
call ebx
test eax, eax
je 0xd28288e
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0xd2828ba
mov esi, dword [esi + 0x14]
test esi, esi
je 0xd2828ba
push esi
push edi
call ebx
test eax, eax
je 0xd2828ba
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x20c], 0
je 0xd2828ef
mov eax, dword [ebp - 0x210]
push eax
call fcn.0d2763f0
mov esi, eax
test esi, esi
jne 0xd282841
mov ecx, dword [ebp - 0x214]
push ecx
push edi
call fcn.0d282590
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
Function at 0xd284040
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x40f
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 8
mov edi, eax
push ebx
mov dword [ebp - 0x268], edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov dword [ebp - 0x260], esi
test esi, esi
jne 0xd284097
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x18b
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esi + 4]
push 0x12c
mov edi, eax
lea eax, [ebp - 0x25c]
push eax
push 0x3f1
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 8]
test eax, eax
je 0xd2840e3
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov dword [esi + 8], 0
lea eax, [ebp - 0x25c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd2840f0
sub eax, edx
mov edx, dword [esi + 0x7c]
lea ecx, [esi + 0x6c]
push ecx
sar eax, 1
push eax
lea ecx, [ebp - 0x25c]
push ecx
push edx
call fcn.0d29f000
push 0x12c
mov dword [esi + 8], eax
lea eax, [ebp - 0x25c]
push eax
push 0x3f2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0xc]
test eax, eax
je 0xd28414e
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov dword [esi + 0xc], 0
lea eax, [ebp - 0x25c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd284157
sub eax, edx
mov edx, dword [esi + 0x7c]
lea ecx, [esi + 0x6c]
push ecx
sar eax, 1
push eax
lea ecx, [ebp - 0x25c]
push ecx
push edx
call fcn.0d29f000
mov dword [esi + 0xc], eax
test edi, edi
je 0xd284263
mov esi, dword [ebp - 0x268]
push 0
dec edi
push edi
push 0x199
push esi
mov dword [ebp - 0x264], edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0xd28425b
push 0x12c
lea ecx, [ebp - 0x25c]
push ecx
push edi
xor eax, eax
push esi
mov word [ebp - 0x25c], ax
call fcn.0d283770
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
lea edx, [ebp - 0x25c]
push 9
push edx
call esi
mov edi, eax
lea eax, [edi + 2]
push 9
push eax
call esi
add esp, 0x10
lea edx, [ebp - 0x25c]
mov esi, eax
xor ecx, ecx
push edx
add esi, 2
mov word [edi], cx
call fcn.0d276e40
mov edi, eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd284201
sub eax, edx
sar eax, 1
push edi
push esi
mov ebx, eax
call dword [sym.imp.msvcrt.dll__wtol]
mov ecx, dword [edi + 0xc]
add esp, 4
push eax
push ebx
push esi
mov esi, dword [ebp - 0x260]
mov eax, dword [esi + 4]
push eax
call ecx
movzx eax, ax
test ax, ax
je 0xd28423d
cmp ax, 1
jne 0xd284265
push 0
call fcn.0d2763f0
mov ecx, edi
mov edi, dword [ebp - 0x264]
sub ecx, eax
sar ecx, 5
mov edx, 1
shl edx, cl
or dword [esi + 8], edx
test edi, edi
jne 0xd284186
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
Function at 0xd290ed0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x418], 0
call fcn.0d290c30
test ax, ax
je 0xd290f0e
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x110]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x41c]
push ecx
push 0
push 0xf003f
push 0
push 0xd27348c
push 0
push 0xd273468
push edx
call edi
test eax, eax
je 0xd290fa8
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xb3b0
call fcn.0d29fa20
push 0xd273468
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push 0x104
push edx
call sub.msvcrt.dll_swprintf_s
mov edx, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x6c]
push ecx
push edx
push 0x3f
call fcn.0d288e10
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0xf003f
push 0
push 0xd27348c
push 0
push 0xd2724fc
push edx
call edi
test eax, eax
je 0xd291048
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0xb3b0
call fcn.0d29fa20
push 0xd2724fc
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push 0x104
push eax
call sub.msvcrt.dll_swprintf_s
mov eax, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [esi + 0x6c]
push edx
push eax
push 0x3f
call fcn.0d288e10
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
mov edx, dword [0xd2af740]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd291053
push ebx
sub eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar eax, 1
lea ecx, [eax + eax]
push ecx
push edx
mov edx, dword [ebp - 0x420]
push 1
push 0
push 0xd2716a4
push edx
call edi
test eax, eax
je 0xd29108b
mov ebx, 0xd2716a4
jmp 0xd2910c5
mov edx, dword [0xd2af740]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd291096
sub eax, ebx
sar eax, 1
lea ecx, [eax + eax]
push ecx
push edx
mov edx, dword [ebp - 0x420]
push 1
push 0
push 0xd271530
push edx
call edi
test eax, eax
je 0xd2910d8
mov ebx, 0xd271530
mov edi, 1
call fcn.0d2905d0
movzx eax, ax
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x420]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [ebp - 0x41c]
push edx
call esi
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x418]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
Function at 0xd291110
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10c], 0
push edi
mov edi, dword [ebp + 0x10]
jne 0xd29114a
mov ecx, esi
call fcn.0d290c30
test ax, ax
jne 0xd2911e6
test edi, edi
je 0xd29116a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd291153
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov edx, edi
jmp 0xd291174
mov ecx, 2
mov edx, 0xd2717b0
cmp dword [ebp + 0x14], 0
je 0xd291182
mov eax, dword [esi + 0x110]
jmp 0xd291188
mov eax, dword [esi + 0x10c]
push ecx
push edx
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0xd2911fc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xb3b0
call fcn.0d29fa20
push ebx
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push 0x104
push edx
call sub.msvcrt.dll_swprintf_s
mov edx, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x6c]
push ecx
push edx
push 0x3f
call fcn.0d288e10
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 0x10

Function at 0xd291220
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10c], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0xd291252
mov ecx, esi
call fcn.0d290c30
test ax, ax
jne 0xd2912c8
cmp dword [ebp + 0x14], 0
je 0xd291260
mov eax, dword [esi + 0x110]
jmp 0xd291266
mov eax, dword [esi + 0x10c]
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0xd2912dd
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0xb3b0
call fcn.0d29fa20
push edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push 0x104
push ecx
call sub.msvcrt.dll_swprintf_s
mov ecx, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [esi + 0x6c]
push eax
push ecx
push 0x3f
call fcn.0d288e10
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 0x10