joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040e6
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, dword [esp + 0x1c]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x40410b
mov esi, dword [esi]
mov dword [esp + 0x18], esi
push esi
shr edi, 2
push edi
push str._x_and__p
call fcn.004043ba
add esp, 0xc
test edi, edi
je 0x404166
mov ebp, esi
mov esi, edi
push 4
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00406ab0
imul ecx, dword [esp + 0x28], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x1c], eax
sub esi, 1
jne 0x404125
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x40418f
sub eax, 1
je 0x404185
sub eax, 1
jne 0x40419d
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ecx
ret

Function at 0x4041c3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipCursor]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x45eca0], eax
pop edi
pop esi
ret

Function at 0x4066de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40671d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40671d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40671d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40671d
cmp dword [ecx + 0x74], 0xe
jbe 0x40671d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d09a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bd28
push 0x41bd20
push str.FlsAlloc
push 0x1e
call fcn.0040cf5b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d0ce
push dword [ebp + 8]
mov ecx, esi
call dword [0x419184]
call esi
jmp 0x40d0d4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d118
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bd38
push 0x41bd30
push str.FlsGetValue
push 0x20
call fcn.0040cf5b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d14f
push dword [ebp + 8]
mov ecx, esi
call dword [0x419184]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
sub byte [esi + 0x4228d0], 0x43
call edi
add byte [esi + 0x4228d0], 0x5a
call edi
xor byte [esi + 0x4228d0], 0xee
call edi
add byte [esi + 0x4228d0], 0x33
call edi
add byte [esi + 0x4228d0], 0x18
call edi
add byte [esi + 0x4228d0], 0xca
call edi
add byte [esi + 0x4228d0], 0xc4
call edi
xor byte [esi + 0x4228d0], 0x18
call edi
add byte [esi + 0x4228d0], 0x58
call edi
add byte [esi + 0x4228d0], 0x18
call edi
xor byte [esi + 0x4228d0], 0xb3
call edi
add byte [esi + 0x4228d0], 0x50
call edi
add byte [esi + 0x4228d0], 0xcc
call edi
add byte [esi + 0x4228d0], 0xf0
call edi
add byte [esi + 0x4228d0], 0xf1
call edi
add byte [esi + 0x4228d0], 0x6a
call edi
xor byte [esi + 0x4228d0], 0xfb
call edi
add byte [esi + 0x4228d0], 0xcb
call edi
add byte [esi + 0x4228d0], 0x24
call edi
add byte [esi + 0x4228d0], 0xb6
call edi
add byte [esi + 0x4228d0], 0x68
call edi
add byte [esi + 0x4228d0], 0xb8
call edi
add byte [esi + 0x4228d0], 0xf0
call edi
add byte [esi + 0x4228d0], 0xb3
call edi
add byte [esi + 0x4228d0], 0xe5
call edi
xor byte [esi + 0x4228d0], 0xe7
call edi
add byte [esi + 0x4228d0], 0x5a
call edi
add byte [esi + 0x4228d0], 2
call edi
add byte [esi + 0x4228d0], 0x60
call edi
add byte [esi + 0x4228d0], 0xab
call edi
add byte [esi + 0x4228d0], 0x8a
call edi
xor byte [esi + 0x4228d0], 8
call edi
xor byte [esi + 0x4228d0], 0x5a
call edi
xor byte [esi + 0x4228d0], 0xfc
call edi
add byte [esi + 0x4228d0], 0x7e
call edi
add byte [esi + 0x4228d0], 8
call edi
xor byte [esi + 0x4228d0], 0x9f
call edi
add byte [esi + 0x4228d0], 0xea
call edi
add byte [esi + 0x4228d0], 0x37
call edi
xor byte [esi + 0x4228d0], 0xb2
call edi
add byte [esi + 0x4228d0], 9
call edi
xor byte [esi + 0x4228d0], 0x3e
call edi
add byte [esi + 0x4228d0], 0xe5
call edi
xor byte [esi + 0x4228d0], 0x18
call edi
add byte [esi + 0x4228d0], 0x9b
call edi
xor byte [esi + 0x4228d0], 0xa0
call edi
add byte [esi + 0x4228d0], 0x2e
call edi
add byte [esi + 0x4228d0], 0x9d
call edi
add byte [esi + 0x4228d0], 0x9c
inc esi
cmp esi, 0x2b800
jb 0x40115e
pop edi
pop esi
ret
Function at 0x418a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x69760252
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6450606d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0x40345a
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404680
push 0x403e24
push eax
mov eax, dword [0x405424]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x405420]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.00401970
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x40541c]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d8
push 0x4040d4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4034f5
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4034ed
cmp al, 0x22
jne 0x4034e2
cmp byte [esi], 0x22
jne 0x4034ff
inc esi
jmp 0x4034ff
cmp al, 0x20
jbe 0x4034ff
inc esi
cmp byte [esi], 0x20
ja 0x4034f9
cmp byte [esi], 0
je 0x40350f
cmp byte [esi], 0x20
ja 0x40350f
inc esi
cmp byte [esi], 0
jne 0x403504
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x40352f
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x40356b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401100
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push eax
push dword [esp + 4]
call fcn.004014c0
add esp, 8
test eax, eax
jne 0x4012be
mov eax, dword [0x408470]
test eax, eax
jne 0x401145
mov ecx, dword [0x4084dc]
mov edx, 0x405aa0
call fcn.004029e0
mov dword [0x408470], eax
push ebx
push esi
push edi
push 0x405444
call eax
mov esi, eax
add esp, 4
test esi, esi
je 0x401210
mov eax, dword [0x408494]
test eax, eax
jne 0x40117a
mov ecx, dword [0x4084dc]
mov edx, 0x405c18
call fcn.004029e0
mov dword [0x408494], eax
push 0
push 0
push 0x408018
call eax
mov ebx, dword [str._MessageBox]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x4011ae
mov ecx, dword [0x4084dc]
mov edx, 0x405c00
call fcn.004029e0
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
mov eax, dword [0x408494]
add esp, 0xc
test eax, eax
jne 0x4011d4
mov ecx, dword [0x4084dc]
mov edx, 0x405c18
call fcn.004029e0
mov dword [0x408494], eax
push 0
push 0
push 0x408028
call eax
mov ebx, dword [str._SHGetSpecialFolderPath]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x401208
mov ecx, dword [0x4084dc]
mov edx, 0x405c00
call fcn.004029e0
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
add esp, 0xc
call fcn.00401310
push str.PYTHONINSPECT
mov edi, eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x401299
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 0
call esi
mov ebx, eax
add esp, 4
mov eax, dword [0x4084b4]
test eax, eax
jne 0x401256
mov ecx, dword [0x4084dc]
mov edx, 0x4057a0
call fcn.004029e0
mov dword [0x4084b4], eax
push str._stdin_
push ebx
call eax
add esp, 8
test eax, eax
je 0x401299
push 0
call esi
mov esi, eax
add esp, 4
mov eax, dword [0x408550]
test eax, eax
jne 0x40128c
mov ecx, dword [0x4084dc]
mov edx, 0x4057b4
call fcn.004029e0
mov dword [0x408550], eax
push 0
push str._stdin_
push esi
call eax
add esp, 0xc
mov eax, dword [0x408454]
test eax, eax
jne 0x4012b7
mov ecx, dword [0x4084dc]
mov edx, 0x405828
call fcn.004029e0
mov dword [0x408454], eax
call eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0x10
Function at 0x70b3cc50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push edi
xor edi, edi
test eax, eax
je 0x70b3cc95
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x70b3cc95
push esi
push ebx
mov esi, dword [ecx]
mov ecx, dword [ecx + 8]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
mov ebx, eax
mov eax, esi
sub ebx, edx
neg ebx
cdq
sbb ebx, ebx
and edx, 7
add eax, edx
sar eax, 3
neg ebx
add eax, edi
test ecx, ecx
lea edi, [eax + ebx]
jne 0x70b3cc64
pop ebx
pop esi
mov eax, edi
pop edi
ret
Function at 0x70b6aed0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [0x70bcd578], eax
mov ecx, 9
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
add edx, eax
add eax, eax
nop
nop
rdtsc
sub eax, dword [ebp - 8]
sbb edx, dword [ebp - 4]
dec ecx
jg 0x70b6aee8
sub eax, 2
add dword [0x70bcd578], eax
cmp ecx, 0xffffffe1
jne 0x70b6aee8
mov eax, dword [0x70bcd578]
shr eax, 5
mov dword [0x70bcd578], eax
mov esp, ebp
pop ebp
ret
Function at 0x70b73fd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push esi
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.70b661b0
add esp, 8
cmp eax, 1
jne 0x70b74102
mov ecx, dword [str.Application_User_Data]
lea edx, [esp + 0x30]
lea eax, [esp + 8]
push edx
mov edx, dword [str._p_p]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0xf003f
push 0
push ecx
push 0
push edx
push 0x80000001
call esi
test eax, eax
jne 0x70b740e6
mov edx, dword [str.Decoder]
lea eax, [esp + 0x30]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call esi
test eax, eax
jne 0x70b740e6
mov edx, dword [str.Scalability_Levels]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x20]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
mov edx, dword [str.Delta_frames_on_off]
mov eax, dword [esp + 4]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push edx
push eax
call esi
mov edx, dword [str.Transparency]
mov eax, dword [esp + 4]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push 0
push edx
push eax
call esi
mov edx, dword [str.Tile_Width]
mov eax, dword [esp + 4]
lea ecx, [esp + 0x24]
push 4
push ecx
push 4
push 0
push edx
push eax
call esi
mov edx, dword [0x70bcd748]
mov eax, dword [esp + 4]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
push edx
push eax
call esi
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x70b740f7
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x70b74102
push eax
call esi
pop esi
add esp, 0x28
ret
Function at 0x70b74110
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov ecx, dword [str._p_p]
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x1c]
push edi
push eax
push 0xf003f
push 0
mov edi, 4
push ecx
push 0x80000001
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], edi
call esi
mov ebp, dword [esp + 0x28]
test eax, eax
jne 0x70b74265
mov eax, dword [str.Decoder]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 1
push 0
push eax
push ecx
call esi
test eax, eax
jne 0x70b74265
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
mov edx, dword [str.Scalability_Levels]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x70b741ad
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x14], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [str.Delta_frames_on_off]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x70b741db
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 8], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [str.Transparency]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x70b74209
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x10], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
mov edx, dword [str.Tile_Width]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x70b74237
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x18], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
mov edx, dword [0x70bcd748]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x70b74265
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x1c], ecx
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x70b74276
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x70b74281
push eax
call esi
pop edi
mov dword [ebp], 0
mov dword [ebp + 0xc], 0
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x70b74d20
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov edx, dword [str.Application_User_Data]
push ebp
push esi
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x10]
xor ebp, ebp
push eax
mov eax, dword [str._p_p]
push ecx
push ebp
push 0xf003f
push ebp
push edx
push ebp
push eax
push 0x80000001
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x70b74e9a
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov ecx, dword [edi + 0x14]
push edx
push 4
push eax
mov eax, dword [str.EnabledAccessKey]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
call esi
test eax, eax
jne 0x70b74e9a
mov eax, dword [edi + 0x14]
test eax, eax
je 0x70b74da2
mov edx, dword [edi + 4]
mov dword [esp + 0xc], edx
jmp 0x70b74daa
mov dword [esp + 0xc], 0
mov ecx, dword [str.AccessKey]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x70b74e9a
mov ecx, dword [str.MinViewportWidth]
mov edx, dword [esp + 0x10]
lea eax, [edi + 8]
push 4
push eax
push 4
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x70b74e9a
mov ecx, dword [str.MinViewportHeight]
mov edx, dword [esp + 0x10]
lea eax, [edi + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x70b74e9a
mov eax, dword [edi + 0x10]
sub eax, 4
je 0x70b74e2a
dec eax
je 0x70b74e20
mov dword [esp + 0xc], 1
jmp 0x70b74e32
mov dword [esp + 0xc], 5
jmp 0x70b74e32
mov dword [esp + 0xc], 4
mov ecx, dword [str.Transparency]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x70b74e9a
mov eax, dword [edi + 0x1c]
mov edx, dword [str.QuickCompress]
lea ecx, [esp + 0xc]
push 4
push ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push 4
push 0
push edx
push eax
call esi
test eax, eax
jne 0x70b74e9a
mov ecx, dword [edi + 0x18]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push eax
mov eax, dword [str.Scalability]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
call esi
test eax, eax
jne 0x70b74e9a
mov ebp, 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x70b74ea9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0xc
ret