joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64aa60
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x7fdc64]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x64aa73
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x64aab4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x7fdd0c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x64aae6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x64aaea
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x64aadb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x64ab08
mov bl, byte [esp + ecx + 0x4c]
jmp 0x64ab0c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x64aafd
xor ecx, ecx
mov eax, 0x7fdc74
xor ebx, ebx
mov bl, byte [ecx + 0x7fdd1c]
cmp byte [esp + ebx + 0x14], 0
je 0x64ab37
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x7fdd34]
cmp byte [esp + ebx + 0x14], 0
je 0x64ab4e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x64ab1e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x64aaa7
lea edx, [esp + 0x84]
push edx
call fcn.0064ab90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x64f3f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x84e5cc]
xor edx, edx
cmp eax, edx
jne 0x64f416
xor eax, eax
mov byte [eax + 0x84e4cc], al
inc eax
cmp eax, 0x100
jl 0x64f3fe
mov dword [0x84e5cc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x84e4cc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x64f4a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x64f47a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x64f448
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x64f4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x64f503
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x64f4ea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a210e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.006567e0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x706d54
call fcn.006924aa
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x655f53
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006924aa
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x655f4c
push 0
mov ecx, eax
call fcn.0064d030
mov dword [esi + 0xc], eax
jmp 0x655f55
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x655f55
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x666680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x6667a1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x666785
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x6666d7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x6666b5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x6671e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x667240
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x667240
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x667240
xor eax, eax
inc eax
jmp 0x667242
xor eax, eax
leave
ret 0x10
Function at 0x66726b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x6672d9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x70abf4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6672d0
cmp dword [ebp - 0xc], 4
jne 0x6672d0
cmp dword [ebp - 0x10], edi
je 0x6672d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x806a58], edi
xor eax, eax
jmp 0x667318
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x806a58], edi
jge 0x667313
lea eax, [ebp - 0x34]
push eax
mov dword [0x806a58], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x667313
cmp word [ebp - 0x14], 5
jb 0x667313
call fcn.00667246
test eax, eax
je 0x667313
emms
mov dword [0x806a58], 1
mov eax, dword [0x806a58]
pop edi
leave
ret

Function at 0x694b37
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x694b6f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00692bc4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00692b9c
jmp 0x694b7b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x69622e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x696270
call fcn.0069be24
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x696270
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x696267
xor eax, eax
jmp 0x696278
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0069627e
pop edi
pop esi
pop ebx
ret 4

Function at 0x69c354
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x69c382
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x69c3a0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0069c2ba
jmp 0x69c3a0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x69c3a0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0069c2ba
test edi, edi
mov eax, edi
jne 0x69c38a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001b2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10005060
cmp edx, dword [eax]
je 0x10001b50
add eax, 8
inc ecx
cmp eax, 0x100050f0
jl 0x10001b41
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10005060]
jne 0x10001c7e
mov eax, dword [0x1000536c]
cmp eax, 1
je 0x10001c58
test eax, eax
jne 0x10001b81
cmp dword [0x10005370], 1
je 0x10001c58
cmp edx, 0xfc
je 0x10001c7e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001bb8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10001ef0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10001fe0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10001bfb
lea eax, [ebp - 0x1a4]
push eax
call fcn.10001fe0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10004384
push edi
call fcn.10003060
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10001ef0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10001f00
lea eax, [ebp - 0xa0]
push 0x10004364
push eax
call fcn.10001f00
push dword [esi + 0x10005064]
lea eax, [ebp - 0xa0]
push eax
call fcn.10001f00
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10002fce
add esp, 0x2c
pop edi
jmp 0x10001c7e
lea eax, [ebp + 8]
lea esi, [esi + 0x10005064]
push 0
push eax
push dword [esi]
call fcn.10001fe0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402029
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4060e0
cmp edx, dword [eax]
je 0x40204b
add eax, 8
inc ecx
cmp eax, 0x406170
jl 0x40203c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4060e0]
jne 0x402179
mov eax, dword [0x40648c]
cmp eax, 1
je 0x402153
test eax, eax
jne 0x40207c
cmp dword [0x406034], 1
je 0x402153
cmp edx, 0xfc
je 0x402179
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4020b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004026e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402850
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4020f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402850
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053a0
push edi
call fcn.00401160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004026e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004026f0
lea eax, [ebp - 0xa0]
push 0x405380
push eax
call fcn.004026f0
push dword [esi + 0x4060e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004026f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403b61
add esp, 0x2c
pop edi
jmp 0x402179
lea eax, [ebp + 8]
lea esi, [esi + 0x4060e4]
push 0
push eax
push dword [esi]
call fcn.00402850
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x408027
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x40803c
popal
leave
ret 0xc
Function at 0x550dfa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
wait
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.005500f8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.005500ad
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.005500e8
stosd dword es:[edi], eax
into
adc eax, 0x68b5ff93
stc
invalid

Function at 0x5544ee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x411580
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.006524bd
test eax, eax
je 0x554512
xor al, al
jmp 0x55455d
push edi
lea eax, [ebp - 8]
push eax
push edi
push 2
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x55450e
push ebx
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
call esi
push dword [ebp - 8]
call esi
cmp ebx, edi
pop esi
sete al
pop ebx
pop edi
leave
ret 0xc

Function at 0x555032
Capabilities:
Get common file path

Disassembly:
push 0x25c
mov eax, 0x6b03b8
call fcn.0066d8f7
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x55506a
lea eax, [ebp - 0x218]
push eax
call fcn.00554562
mov edi, eax
lea ecx, [ebp - 0x240]
call fcn.005761e7
and dword [ebp - 4], 0
lea eax, [ebp - 0x240]
push eax
push esi
call fcn.0055459b
lea ecx, [ebp - 0x240]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call fcn.00554562
mov esi, eax
shl edi, 0x10
push 0x411720
lea ecx, [ebp - 0x268]
add esi, edi
call fcn.0057706c
push esi
push eax
mov byte [ebp - 4], 1
call fcn.00554c9e
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call fcn.00576231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00576231
call fcn.0066d97a
ret 4
Function at 0x579b8b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
push edi
jne 0x579bd2
push 0x41d358
push 0x3a
lea eax, [ebp - 0x218]
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov ecx, dword [ebp + 8]
call fcn.00576060
cmp eax, 0x3fff
jbe 0x579bea
push 0x41d308
push 0x1d
jmp 0x579ba5
mov ecx, dword [ebp + 8]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [esi + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jle 0x579c14
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x579c53
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
push dword [ebp + 0xc]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41d2a8
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00520ba2
add esp, 0x1c
jmp 0x579bb4
pop edi
pop esi
leave
ret 8

Function at 0x579e18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
push edi
jne 0x579e60
push 0x41d530
lea eax, [ebp - 0x220]
push 0x3a
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x114]
lea edi, [ebp - 0x114]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov ecx, dword [ebp + 8]
push 4
pop edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [esi + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x579e96
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jge 0x579ed8
cmp ebx, 0x80070002
je 0x579ee1
cmp ebx, 0x800700ea
je 0x579ee1
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41d4f0
lea eax, [ebp - 0x220]
push ebx
push eax
call fcn.00520ba2
add esp, 0x14
jmp 0x579e42
cmp dword [ebp - 4], edi
jne 0x579ee1
mov al, 1
jmp 0x579ee3
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x57ad99
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x464
mov eax, 0x6b6543
call fcn.0066d88e
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x57ade5
push 0x41dc78
lea eax, [ebp - 0x364]
push 0x3a
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x258]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x258]
push eax
call fcn.0066dd58
call fcn.00579a4b
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
call fcn.005761e7
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00536636
cmp dword [ebp - 0x10], ebx
je 0x57ae5f
mov edi, 0x4000
dec dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], edi
call fcn.005765be
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [ebp - 0x10]
push dword [esi + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jle 0x57ae47
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x57ae73
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00524d25
cmp dword [ebp - 0x10], ebx
jne 0x57ae0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00576231
call fcn.0066d966
ret 4
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
lea eax, [ebp - 0x470]
push 0x41dc20
push dword [ebp - 0x14]
push eax
call fcn.00520ba2
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x14c]
jmp 0x57addf

Function at 0x57bef6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0xffffffff
push edi
jne 0x57bf3d
push 0x41e1a0
lea eax, [ebp - 0x21c]
push 0x15
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x110]
lea edi, [ebp - 0x110]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
call fcn.00576060
add eax, eax
push eax
push edi
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x57bf84
push 0x41e188
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.005287fb
jmp 0x57bf1c
pop edi
pop esi
leave
ret 4