joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3095924
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x3095937
mov esi, 1
mov edx, 0x309cf04
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x309cf2c
jl 0x3095974
mov eax, 1
mov byte [0x309ad04], 0x63
mov byte [0x309be67], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x309ad04], bl
mov byte [ebx + 0x309be04], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x30959b4
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x309ad04]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x309ae04], ecx
rol ecx, 8
mov dword [esi*4 + 0x309b204], ecx
rol ecx, 8
mov dword [esi*4 + 0x309b604], ecx
rol ecx, 8
mov dword [esi*4 + 0x309ba04], ecx
movzx ecx, byte [esi + 0x309be04]
test ecx, ecx
je 0x3095ae3
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x3095aec
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x309bf04], eax
rol eax, 8
mov dword [esi*4 + 0x309c304], eax
rol eax, 8
mov dword [esi*4 + 0x309c704], eax
rol eax, 8
mov dword [esi*4 + 0x309cb04], eax
inc esi
cmp esi, 0x100
jl 0x3095a29
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3095b44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x18
test al, 0xf
je 0x3095b5a
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x3095cae
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
jne 0x3095bf6
mov ebx, dword [ebp + 0x18]
lea edx, [ecx + 0xf]
dec eax
mov dword [ebp - 8], edx
mov edi, ecx
shr eax, 4
sub edi, esi
inc eax
mov dword [ebp + 0x10], eax
movups xmm0, xmmword [ebx]
push esi
push ebx
push dword [ebp + 8]
movups xmmword [ebp - 0x18], xmm0
call fcn.03096e74
add esp, 0xc
cmp esi, dword [ebp - 8]
ja 0x3095bc7
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0x14]
jb 0x3095bc7
mov ecx, esi
mov edx, 0x10
nop
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x3095bb4
mov eax, dword [ebp + 0x14]
jmp 0x3095bd7
mov eax, dword [ebp + 0x14]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x18]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 0x10], 1
movups xmmword [eax], xmm0
jne 0x3095b8a
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x18]
lea edx, [eax - 1]
mov ebx, ecx
shr edx, 4
sub ebx, edi
mov dword [ebp - 4], esi
inc edx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
nop dword [eax]
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x3095c22
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x3095c30
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x3095c61
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x3095c61
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 0x10]
sub ebx, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x3095c44
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
jmp 0x3095c6e
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp + 0xc], 1
push esi
push esi
push edx
jne 0x3095c7e
call fcn.03097404
jmp 0x3095c83
call fcn.03096e74
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x14]
sub ebx, 0x10
mov edx, dword [ebp + 8]
add esi, 0x10
add esp, 0xc
mov dword [ebp + 0x10], ebx
add edi, 0x10
mov dword [ebp - 4], esi
sub dword [ebp - 8], 1
movups xmmword [ecx], xmm0
jne 0x3095c14
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x3095cf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x118]
push dword [ebp + 0xc]
mov ecx, 0x46
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
lea esi, [edi + 8]
mov dword [edi + 4], esi
call fcn.03095ef4
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
jne 0x3095ee8
mov ecx, dword [ebp - 0x118]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [ebp - 0x114]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [esi + 0xc], eax
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x3095ecf
push ebx
nop dword [eax]
movzx eax, byte [ecx + 3]
dec edi
movzx edx, byte [eax + 0x309ad04]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x309cb04]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309c704]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309c304]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309bf04]
mov dword [esi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x309ad04]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x309c704]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309c304]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309cb04]
movzx eax, bl
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309bf04]
mov dword [esi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x309ad04]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x309c704]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309c304]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309cb04]
movzx eax, bl
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309bf04]
mov dword [esi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x309ad04]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x309c704]
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309c304]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309cb04]
movzx eax, bl
movzx eax, byte [eax + 0x309ad04]
xor edx, dword [eax*4 + 0x309bf04]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x3095d74
pop ebx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x3097d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], 0x1d1a
mov edx, 0x1d7e
mov word [ebp - 0x30], dx
mov eax, 0x1d78
mov word [ebp - 0x2e], ax
mov ecx, 0x1d76
mov eax, 0x1d7d
mov word [ebp - 0x2c], ax
mov eax, 0x1d72
mov word [ebp - 0x2a], ax
mov eax, 0x1d7f
mov word [ebp - 0x28], ax
mov eax, 0x1d6a
mov word [ebp - 0x26], cx
mov word [ebp - 0x24], ax
mov eax, 0x1d34
mov word [ebp - 0x22], ax
xor eax, eax
mov word [ebp - 0x20], dx
xor edx, edx
mov word [ebp - 0x1e], cx
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], ax
mov ax, word [ebp - 0x30]
nop dword [eax]
mov ax, word [ebp + edx*2 - 0x30]
movzx ecx, ax
movzx eax, word [ebp - 0x34]
xor ecx, eax
mov word [ebp + edx*2 - 0x30], cx
inc edx
cmp edx, 0xb
jb 0x3097d84
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [edi + 0x698]
call eax
mov esi, eax
test esi, esi
jne 0x3097dcb
call dword [0x30bbfb4]
pop edi
or eax, 0xe0ff0000
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x65
mov eax, dword [ebp - 0x18]
xor eax, 0x4d
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
inc al
xor eax, 0x69
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
add al, 2
xor eax, 0x6e
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
add al, 3
xor eax, 0x69
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
add al, 4
xor eax, 0x44
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x18]
add al, 5
xor eax, 0x75
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x18]
add al, 6
xor eax, 0x6d
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
add al, 7
xor eax, 0x70
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x18]
add al, 8
xor eax, 0x57
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x18]
add al, 9
xor eax, 0x72
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x18]
add al, 0xa
xor eax, 0x69
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x18]
add al, 0xb
xor eax, 0x74
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x18]
add al, 0xc
xor eax, 0x65
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x18]
add al, 0xd
xor eax, 0x44
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x18]
add al, 0xe
xor eax, 0x75
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x18]
add al, 0xf
xor eax, 0x6d
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x18]
add al, 0x10
mov byte [ebp - 3], 0
xor eax, 0x70
xor edx, edx
mov byte [ebp - 4], al
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x18]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x14], cl
inc edx
cmp edx, 0x11
jb 0x3097e94
lea eax, [ebp - 0x14]
mov byte [ebp - 3], 0
push eax
mov eax, dword [edi + 0x6a0]
push esi
call eax
mov ecx, eax
test ecx, ecx
je 0x3097dba
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
pop esi
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x3099804
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x780], 0xffffffff
je 0x3099900
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
mov eax, dword [esi + 0x6c0]
call eax
mov dword [ebp - 0x14], 0x56
xor edx, edx
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x26
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x3e
mov byte [ebp - 5], 0x25
mov byte [ebp - 4], 0x5b
mov byte [ebp - 3], 0x5c
mov al, byte [ebp - 0x10]
mov byte [ebp - 2], 0
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x10]
movsx ecx, byte [ebp - 0x14]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x10], al
inc edx
cmp edx, 0xe
jb 0x3099884
lea eax, [ebp - 0x414]
mov byte [ebp - 2], 0
push eax
mov eax, dword [esi + 0x740]
call eax
push eax
push dword [esi + 0x700]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [esi + 0x6c8]
call eax
add esp, 0x14
lea eax, [ebp - 0x214]
cmp byte [ebp - 0x214], 0
je 0x30998e0
inc eax
cmp byte [eax], 0
jne 0x30998da
push 0
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x214]
sub eax, ecx
push eax
mov eax, ecx
push eax
push dword [esi + 0x780]
mov eax, dword [esi + 0x6bc]
call eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x3099914
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x309cf64]
sub esp, 0x18
cmp eax, 0x1ff
jae 0x3099938
inc eax
mov dword [0x309cf64], eax
mov byte [eax + 0x309cf68], 0x11
mov eax, dword [0x309cf64]
cmp dword [0x309cf4c], 0
jne 0x30999f9
push 1
push 0x309cf44
call fcn.03098614
add esp, 8
test eax, eax
js 0x30999f4
cmp dword [0x309d6c4], 0xffffffff
je 0x30999f4
mov dword [ebp - 0x18], 5
xor edx, edx
mov byte [ebp - 0x14], 0x55
mov byte [ebp - 0x13], 0x57
mov byte [ebp - 0x12], 0x4a
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x40
mov byte [ebp - 0xf], 0x56
mov byte [ebp - 0xe], 0x56
mov byte [ebp - 0xd], 0x25
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xa], 0x48
mov byte [ebp - 9], 0x55
mov byte [ebp - 8], 0x49
mov byte [ebp - 7], 0x40
mov byte [ebp - 6], 0x51
mov byte [ebp - 5], 0x40
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x61
mov al, byte [ebp - 0x14]
mov byte [ebp - 1], 0
mov al, byte [ebp + edx - 0x14]
movsx ecx, byte [ebp - 0x18]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x14], al
inc edx
cmp edx, 0x13
jb 0x30999c5
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov byte [ebp - 1], 0
push eax
push 0x309cf44
call fcn.03099804
add esp, 0xc
mov eax, dword [0x309cf64]
mov ecx, dword [0x309d640]
test ecx, ecx
je 0x3099a1e
push ecx
call dword [0x309d5ec]
dec dword [0x309cf64]
mov dword [0x309d640], 0
mov esp, ebp
pop ebp
ret
dec eax
mov dword [0x309cf64], eax
mov esp, ebp
pop ebp
ret
Function at 0x309a094
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
mov word [edi], cx
test eax, eax
je 0x309a261
push ebx
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x309a260
nop dword [eax]
mov dword [ebp - 0x10], 0xabc9
mov eax, dword [ebp - 0x10]
xor eax, 0x25
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x10]
inc eax
xor eax, 0x30
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x10]
add eax, 2
xor eax, 0x32
mov word [ebp - 8], ax
mov eax, dword [ebp - 0x10]
add eax, 3
xor eax, 0x58
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
mov ax, word [ebp - 0xc]
xor eax, eax
mov cx, word [ebp + eax*2 - 0xc]
mov edx, dword [ebp - 0x10]
add edx, eax
movzx ecx, cx
xor edx, ecx
mov word [ebp + eax*2 - 0xc], dx
inc eax
cmp eax, 4
jb 0x309a106
xor eax, eax
mov word [ebp - 4], ax
movsx eax, byte [esi + ebx + 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [esi + 0x768]
call eax
add esp, 0xc
cmp word [edi], 0
jne 0x309a198
mov dword [ebp - 0x1c], 0xb277
mov eax, 0xb252
mov word [ebp - 0x18], ax
mov eax, 0xb21b
mov word [ebp - 0x16], ax
mov eax, 0xb204
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
xor edx, edx
mov ax, word [ebp - 0x18]
nop
mov ax, word [ebp + edx*2 - 0x18]
movzx ecx, ax
movzx eax, word [ebp - 0x1c]
xor ecx, eax
mov word [ebp + edx*2 - 0x18], cx
inc edx
cmp edx, 3
jb 0x309a174
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x18]
jmp 0x309a1e1
mov eax, 0x30
mov word [ebp - 0x26], ax
mov eax, 0x77
mov word [ebp - 0x24], ax
mov eax, 0x7e
mov word [ebp - 0x22], ax
mov eax, 0x38
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
xor ecx, ecx
mov ax, word [ebp - 0x26]
mov ax, word [ebp + ecx*2 - 0x26]
movzx eax, ax
add eax, 0xfffffff5
mov word [ebp + ecx*2 - 0x26], ax
inc ecx
cmp ecx, 4
jb 0x309a1c8
lea eax, [ebp - 0x26]
push edi
push eax
lea eax, [ebp - 0x448]
push eax
mov eax, dword [esi + 0x768]
call eax
mov eax, 0x26
mov ecx, 0x6d
mov word [ebp - 0x34], ax
mov edx, 0x74
mov word [ebp - 0x32], cx
add esp, 0xc
mov word [ebp - 0x30], dx
mov word [ebp - 0x2e], ax
xor eax, eax
mov word [ebp - 0x2c], cx
xor ecx, ecx
mov word [ebp - 0x2a], dx
mov word [ebp - 0x28], ax
mov ax, word [ebp - 0x34]
mov ax, word [ebp + ecx*2 - 0x34]
movzx eax, ax
dec eax
mov word [ebp + ecx*2 - 0x34], ax
inc ecx
cmp ecx, 6
jb 0x309a228
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 0x768]
push edi
call eax
add esp, 0x10
sub ebx, 1
jne 0x309a0c4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003cf5
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1019214]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x500
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
mov dword [0x1059ad8], eax
jne 0x1003dd2
push 0x128
mov esi, 0x1059ae0
push esi
push 0x502
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp word [0x1059ae0], 0
jne 0x1003d53
mov dword [0x1059ad8], 1
jmp 0x1003dd2
push 0
push 9
push 0x110a
push dword [0x1019080]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.01005586
push eax
call fcn.0100a8f2
test eax, eax
je 0x1003dc6
cmp dword [ebp + 0xc], 0
je 0x1003d91
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x204]
push eax
push 0x94
push edi
push dword [0x1019530]
call fcn.01009e27
xor eax, eax
add esp, 0x14
inc eax
jmp 0x1003dd4
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010167d4
leave
ret 8
Function at 0x100484d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x1019214]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x80c]
push eax
push 0x1001678
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
test eax, eax
jne 0x1004997
lea eax, [ebp - 0x84c]
push eax
push edi
mov dword [ebp - 0x84c], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [0x1019090]
push ebx
push ebx
mov dword [ebp - 0x820], eax
mov eax, dword [0x1019084]
mov edi, 0x101d
push edi
push eax
mov dword [ebp - 0x808], eax
call esi
push ebx
push 1
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x81c], eax
call esi
push ebx
push 2
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x818], eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x814], eax
xor eax, eax
cmp dword [0x10190a0], ebx
push 0x40
setne al
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x84c]
push eax
push 3
push ebx
push 0x1001778
push dword [ebp - 0x80c]
call edi
push 4
push 0x10190e0
push 4
push ebx
push 0x1001784
push dword [ebp - 0x80c]
call edi
mov eax, dword [0x1019080]
push 3
lea ecx, [ebp - 0x804]
push ecx
push ebx
push 9
push 0x110a
push eax
mov dword [ebp - 0x808], eax
call esi
push eax
push dword [ebp - 0x808]
call fcn.010080e7
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push ebx
push 0x1001798
push dword [ebp - 0x80c]
call edi
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 9
push 0x110b
push dword [0x1019080]
call esi
mov eax, dword [0x1019098]
cmp eax, ebx
je 0x10049b7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1019094]
cmp eax, ebx
je 0x10049c7
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010167d4
leave
ret 4
Function at 0x1004abb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.01016ac0
mov eax, dword [0x1019214]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1008]
push eax
push 0x10016f0
push 0x80000001
mov dword [ebp - 0x1010], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1004c33
push 3
lea eax, [ebp - 0x1004]
push eax
push 0
push 9
push 0x110a
push dword [0x1019080]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push dword [0x1019080]
call fcn.010080e7
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], eax
push 0x5c
push dword [ebp - 0x100c]
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x1004b4f
inc eax
inc eax
mov dword [ebp - 0x100c], eax
jne 0x1004b31
push ebx
push esi
push dword [ebp - 0x100c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x804]
push eax
call esi
lea eax, [ebp - 0x804]
push eax
mov ebx, 0x10049e2
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x1004be4
xor eax, eax
cmp word [ebp - 0x804], ax
je 0x1004bc7
push eax
push eax
lea ecx, [ebp - 0x1014]
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call fcn.0100a001
test eax, eax
jne 0x1004bf5
push 0x10
push 0xac
push 0xab
push dword [ebp - 0x1010]
push dword [0x1019530]
call fcn.01009e27
add esp, 0x14
push dword [ebp - 0x100c]
lea eax, [ebp - 0x804]
push eax
call esi
lea eax, [ebp - 0x804]
push eax
push ebx
push dword [ebp - 0x1010]
push 0x70
push dword [0x1019530]
call edi
cmp eax, 1
je 0x1004b7c
jmp 0x1004c25
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x1004]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010167d4
leave
ret 4

Function at 0x1004e5e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.01016ac0
mov eax, dword [0x1019214]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1008]
push eax
push 0x10016f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1004f08
mov eax, 0x400
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1010], eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffafe
push eax
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1004efc
cmp dword [ebp - 0x1014], 1
jne 0x1004efc
cmp dword [ebp - 0x100c], eax
jbe 0x1004efc
lea eax, [ebp - 0x804]
push eax
call fcn.01004527
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.010167d4
leave
ret 8