joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4874f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x4fc040]
xor eax, esp
mov dword [esp + 0x54], eax
lea eax, [ecx - 0x310]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push esi
mov esi, edx
movaps xmmword [esp + 0x2c], xmm0
cdq
and edx, 0xf
movaps xmmword [esp + 0x3c], xmm0
add eax, edx
sar eax, 4
mov dword [esp + 0x18], eax
push edi
test eax, eax
je 0x4876c7
nop dword [eax + eax]
mov edi, 2
cmp eax, edi
cmovb edi, eax
mov eax, edi
mov dword [esp + 0x28], edi
shl eax, 4
push eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00497c70
add esp, 0xc
lea edx, [esp + 0x30]
mov ecx, edx
push dword [esp + 0x10]
call fcn.00486930
add esp, 4
test edi, edi
je 0x4876af
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x3a]
mov eax, dword [esp + 0x14]
mov edx, esi
sub eax, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], eax
lea eax, [ecx + 0x2e0]
mov dword [esp + 0x20], eax
lea ecx, [esi - 0xa]
call fcn.00482580
mov ecx, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 8], edx
lea ecx, [ecx + 0x2d8]
call fcn.00482580
xor edi, eax
mov dword [esp + 0xc], edi
mov edi, dword [esp + 8]
xor edi, edx
mov edx, dword [esp + 0xc]
mov ecx, edx
mov byte [esi - 0xa], dl
mov eax, edi
mov dword [esp + 8], edi
shrd ecx, eax, 8
mov eax, edi
mov byte [esi - 9], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov byte [esi - 8], cl
mov ecx, edi
mov eax, ecx
mov byte [esi - 6], cl
shrd edx, eax, 0x18
mov eax, ecx
shr eax, 8
mov byte [esi - 5], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [esi - 3], cl
mov ecx, dword [esp + 0x20]
mov byte [esi - 7], dl
mov byte [esi - 4], al
call fcn.00482580
mov dword [esp + 0xc], eax
lea ecx, [esi - 2]
mov eax, edx
mov dword [esp + 8], eax
call fcn.00482580
xor dword [esp + 0xc], eax
lea esi, [esi + 0x10]
mov eax, dword [esp + 8]
xor eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 8], eax
mov ecx, edx
shrd ecx, eax, 8
mov eax, dword [esp + 8]
mov byte [esi - 0x11], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov byte [esi - 0x12], dl
mov byte [esi - 0x10], cl
mov ecx, dword [esp + 8]
mov eax, ecx
shrd edx, eax, 0x18
mov eax, ecx
mov byte [esi - 0xe], cl
shr eax, 8
mov byte [esi - 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 0xc], al
mov eax, dword [esp + 0x24]
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [esi - 0xb], cl
movups xmm0, xmmword [eax + esi - 0x10]
mov ecx, dword [esp + 0x10]
mov byte [esi - 0xf], dl
movups xmmword [ecx + 0x2d8], xmm0
movups xmm0, xmmword [esi - 0x1a]
movups xmmword [eax + esi - 0x10], xmm0
jne 0x4875a2
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
add esi, dword [esp + 0x2c]
sub eax, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jne 0x487540
mov edx, 0x20
lea ecx, [esp + 0x30]
call fcn.00492670
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
xor ecx, esp
call fcn.00495b16
mov esp, ebp
pop ebp
ret
Function at 0x487e70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4fc040]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, edx
mov dword [esp + 4], 0
push esi
mov dword [esp + 4], eax
mov edx, ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
lea eax, [eax*4 + 0x1c]
mov dword [esp + 0x18], ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x18], edi
test eax, eax
je 0x487fd2
mov edi, dword [esp + 8]
lea ecx, [esp + 0x20]
lea eax, [edi*4]
sub ecx, eax
add edx, 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
cmp esi, edi
jae 0x487f02
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 2]
shl eax, 8
or eax, ecx
mov ecx, dword [esp + 0x10]
jmp 0x487fac
mov edi, dword [esp + esi*4 + 0x1c]
xor edx, edx
mov eax, esi
div dword [esp + 8]
cmp dword [esp + 8], 8
jne 0x487f21
mov eax, esi
and al, 7
cmp al, 4
jne 0x487f21
mov al, 1
jmp 0x487f23
xor al, al
test edx, edx
jne 0x487f7d
mov edx, dword [esp + 0xc]
xor eax, eax
movd xmm1, edi
xorps xmm2, xmm2
movd xmm0, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm1
aeskeygenassist xmm0, xmm2, 0
pextrd edi, xmm0, 1
cmp edx, 0xa
jb 0x487f6d
push 0x52
push str.C:Usersomahr_source_reposputty_caccodecrypto_aes_ni.c
push str.rconpos___lenof_aes_key_setup_round_constants_
call fcn.004a3dca
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [esp + 0xc]
movzx eax, byte [edx + 0x4d2fac]
xor edi, eax
inc edx
mov dword [esp + 0xc], edx
jmp 0x487fa0
test al, al
je 0x487fa0
xor eax, eax
movd xmm1, edi
xorps xmm2, xmm2
movd xmm0, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm1
aeskeygenassist xmm0, xmm2, 0
movd edi, xmm0
mov eax, dword [ecx]
mov edx, dword [esp + 0x14]
xor eax, edi
mov edi, dword [esp + 8]
mov dword [esp + esi*4 + 0x20], eax
add edx, 4
inc esi
mov dword [esp + 0x14], edx
add ecx, 4
lea eax, [edi*4 + 0x1c]
mov dword [esp + 0x10], ecx
cmp esi, eax
jb 0x487ed7
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 8]
lea eax, [esp + 0x24]
mov edx, eax
mov ecx, edi
sub ecx, edx
add esi, 6
lea edx, [esi + 1]
nop word [eax + eax]
movd xmm1, dword [eax + 8]
lea eax, [eax + 0x10]
movd xmm3, dword [eax - 0xc]
movd xmm0, dword [eax - 0x10]
movd xmm2, dword [eax - 0x14]
punpckldq xmm3, xmm1
punpckldq xmm2, xmm0
punpcklqdq xmm2, xmm3
movups xmmword [ecx + eax - 0x10], xmm2
sub edx, 1
jne 0x487ff0
mov edx, 0xf0
lea ecx, [esp + 0x20]
call fcn.00492670
mov edx, esi
xor ecx, ecx
shl edx, 4
add edx, dword [esp + 0x1c]
movups xmm0, xmmword [edi]
test ecx, ecx
je 0x488048
mov eax, esi
sub eax, ecx
je 0x488048
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
inc ecx
add edi, 0x10
sub edx, 0x10
cmp ecx, esi
jbe 0x488036
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.00495b16
mov esp, ebp
pop ebp
ret
Function at 0x488d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x4fc040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0xa4], edx
lea edx, [ebp - 0x8c]
push dword [ebp + 0xc]
mov dword [ebp - 0x94], ecx
mov ecx, 0x4d264c
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x98], eax
call fcn.00473560
mov eax, dword [ebp + 8]
xor edi, edi
add eax, 0x1f
mov dword [ebp - 0x90], edi
cdq
add esp, 8
and edx, 0x1f
lea ebx, [edx + eax]
sar ebx, 5
mov dword [ebp - 0xa0], ebx
test ebx, ebx
jle 0x488eb9
mov edx, dword [ebp - 0x98]
mov ecx, esi
xorps xmm0, xmm0
xor esi, esi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
cmp dword [ebp - 0x94], esi
jle 0x488e7b
mov ebx, dword [ebp - 0x94]
lea eax, [edi + 1]
mov dword [ebp - 0x9c], eax
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push edx
xor eax, eax
lea edx, [ebp - 0x8c]
push ecx
test esi, esi
mov ecx, edi
cmovne ecx, eax
call fcn.00488cd0
add esp, 0xc
lea ecx, [ebp - 0x48]
mov edx, 0x20
xor eax, eax
nop dword [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x28]
movups xmm1, xmmword [ebp + eax - 0x48]
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x28], xmm1
add eax, 0x10
cmp eax, 0x20
jl 0x488e50
inc esi
cmp esi, ebx
jl 0x488e21
mov edi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0xa0]
mov esi, dword [ebp + 8]
mov ecx, edi
cmp edi, esi
jge 0x488ea4
mov edi, dword [ebp - 0xa4]
lea edx, [ebp - 0x28]
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edi + ecx], al
add ecx, ebx
cmp ecx, esi
jl 0x488e90
mov edi, dword [ebp - 0x90]
mov esi, dword [ebp - 0xa8]
inc edi
mov dword [ebp - 0x90], edi
cmp edi, ebx
jl 0x488df3
mov edx, 0x40
lea ecx, [ebp - 0x8c]
call fcn.00492670
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b16
mov esp, ebp
pop ebp
ret
Function at 0x48a2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov esi, edx
mov edi, ecx
mov ecx, esi
call fcn.00473640
mov ecx, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
lea ecx, [esi + 8]
mov dword [esp + 0x34], edx
call fcn.00473640
mov ecx, eax
mov dword [esp + 0x28], 0x80
mov eax, edx
mov dword [esp + 8], ecx
lea edx, [edi + 0x850]
mov dword [esp + 0x20], eax
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], edx
nop
movups xmm0, xmmword [esp + 0x30]
and ecx, 1
xor esi, esi
mov dword [esp + 0x2c], ecx
mov ecx, eax
movups xmmword [edx], xmm0
mov edx, dword [esp + 0x20]
xor eax, eax
shrd dword [esp + 8], edx, 1
xor eax, dword [esp + 8]
shl ecx, 0x1f
shr edx, 1
xor ecx, edx
mov dword [esp + 8], eax
mov edx, dword [esp + 0x2c]
neg edx
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x24]
mov eax, ecx
mov ecx, dword [esp + 0x10]
adc esi, esi
shrd ecx, edi, 1
neg esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], eax
and esi, 0xe1000000
xor eax, eax
shr edi, 1
xor eax, ecx
xor edi, esi
mov ecx, dword [esp + 8]
sub edx, 0x10
sub dword [esp + 0x28], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], edx
jne 0x48a300
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48a390
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov ecx, edi
call fcn.00473640
xor dword [ebx + 0x40], eax
lea ecx, [edi + 8]
xor dword [ebx + 0x44], edx
lea esi, [ebx + 0x60]
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
call fcn.00473640
mov ecx, dword [ebp - 0x24]
xor eax, dword [ebx + 0x48]
xor edx, dword [ebx + 0x4c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 4], ecx
mov edi, eax
and eax, 1
shrd edi, edx, 1
shr edx, 1
mov dword [ebx + 0x4c], edx
mov dword [ebp - 0x1c], edx
xor edx, edx
neg eax
mov dword [ebx + 0x48], edi
mov dword [ebp - 0x18], eax
mov ecx, eax
adc edx, edx
and ecx, dword [esi]
xor dword [ebp - 4], ecx
neg edx
mov ecx, dword [ebp - 0x18]
mov eax, edx
and eax, dword [esi + 4]
xor dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
and ecx, dword [esi + 8]
and eax, edx
xor dword [ebp - 0x10], eax
add esi, 0x10
xor dword [ebp - 0xc], ecx
mov eax, edi
sub dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x1c]
jne 0x48a3e7
mov dword [ebp - 0x14], 0x40
nop dword [eax + eax]
mov edi, dword [ebx + 0x40]
lea esi, [esi + 0x10]
mov ecx, dword [ebx + 0x44]
mov eax, edi
shrd eax, ecx, 1
and edi, 1
xor edx, edx
shr ecx, 1
neg edi
mov dword [ebx + 0x40], eax
mov eax, edi
adc edx, edx
mov dword [ebx + 0x44], ecx
and eax, dword [esi - 0x10]
neg edx
xor dword [ebp - 4], eax
mov ecx, edx
and ecx, dword [esi - 0xc]
mov eax, dword [ebp - 4]
and edi, dword [esi - 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [esi - 4]
mov dword [ebp - 0xc], ecx
and eax, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, eax
sub dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], ecx
jne 0x48a440
movups xmm0, xmmword [ebp - 0x30]
pop edi
pop esi
movups xmmword [ebx + 0x40], xmm0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48b6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [0x5002e0]
test ecx, ecx
jne 0x48b6d7
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0x48b6a0
lea edx, [ebp - 4]
call fcn.0048ecb0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x48d8a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 0
je 0x48d8cd
push 0x10e
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_NONE
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 1
je 0x48d8ee
push 0x10f
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_BOOL
call fcn.004a3dca
add esp, 0xc
mov ecx, dword [edi]
lea edx, [ebp - 8]
push 0
mov dword [ebp - 8], esi
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48d91d
push 0x112
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov al, byte [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48d930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 0
je 0x48d95d
push 0x11b
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_NONE
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 2
je 0x48d97e
push 0x11c
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_INT
call fcn.004a3dca
add esp, 0xc
mov ecx, dword [edi]
lea edx, [ebp - 8]
push 0
mov dword [ebp - 8], esi
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48d9ad
push 0x11f
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov eax, dword [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48d9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 2
je 0x48d9ed
push 0x128
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_INT
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 2
je 0x48da0e
push 0x129
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_INT
call fcn.004a3dca
add esp, 0xc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov ecx, dword [edi]
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48da43
push 0x12d
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov eax, dword [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48da50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 0
je 0x48da7d
push 0x136
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_NONE
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 3
je 0x48da9e
push 0x137
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_STR
call fcn.004a3dca
add esp, 0xc
mov ecx, dword [edi]
lea edx, [ebp - 8]
push 0
mov dword [ebp - 8], esi
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48dacd
push 0x13a
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov eax, dword [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48dae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 3
je 0x48db0d
push 0x143
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_STR
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 3
je 0x48db2e
push 0x144
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_STR
call fcn.004a3dca
add esp, 0xc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov ecx, dword [edi]
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
call fcn.0048ecb0
add esp, 4
test eax, eax
je 0x48db53
mov eax, dword [eax + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48dd00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 0
je 0x48dd2d
push 0x181
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_NONE
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 4
je 0x48dd4e
push 0x182
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_FILENAME
call fcn.004a3dca
add esp, 0xc
mov ecx, dword [edi]
lea edx, [ebp - 8]
push 0
mov dword [ebp - 8], esi
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48dd7d
push 0x185
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov eax, dword [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48dd90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 0
je 0x48ddbd
push 0x18e
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_NONE
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 5
je 0x48ddde
push 0x18f
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_FONT
call fcn.004a3dca
add esp, 0xc
mov ecx, dword [edi]
lea edx, [ebp - 8]
push 0
mov dword [ebp - 8], esi
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48de0d
push 0x192
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.entry
call fcn.004a3dca
add esp, 0xc
mov eax, dword [esi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e0b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi*4 + 0x4d4dd0], 3
je 0x48e0dd
push 0x1d6
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.subkeytypes_primary___TYPE_STR
call fcn.004a3dca
add esp, 0xc
cmp dword [esi*4 + 0x4d5120], 3
je 0x48e0fe
push 0x1d7
push str.C:Usersomahr_source_reposputty_caccodeutilsconf.c
push str.valuetypes_primary___TYPE_STR
call fcn.004a3dca
add esp, 0xc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov ecx, dword [edi]
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
je 0x48e12c
mov ecx, dword [edi]
mov edx, esi
call fcn.0048f390
mov ecx, esi
call fcn.0048d6f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48faf0
Capabilities:
Terminate process

Disassembly:
push esi
mov edx, 2
mov esi, ecx
call fcn.0048d930
mov ecx, esi
cmp eax, 5
jne 0x48fb0d
lea edx, [eax + 0x3c]
pop esi
jmp fcn.0048da50
xor edx, edx
pop esi
jmp fcn.0048da50
Function at 0x48fb60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.004bd1b0
mov eax, dword [0x4fc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x500320]
mov dword [ebp - 0x1000c], ecx
push esi
test eax, eax
jne 0x48fb96
mov ecx, 0x48fb50
call fcn.0048e470
mov dword [0x500320], eax
push 0x48b680
lea edx, [ebp - 0x1000c]
mov ecx, eax
call fcn.0048ecb0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48fc3d
push eax
lea edx, [eax + 8]
lea ecx, [eax + 1]
call fcn.0048ffe0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1000c]
push 0
push 0xffff
mov dword [esi], eax
lea eax, [ebp - 0x10008]
push eax
push 0x400
push dword [ebp - 0x1000c]
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x48fc4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10008]
push str._unable_to_format:_FormatMessage_returned__u_
push eax
call fcn.00401050
add esp, 0xc
lea eax, [ebp - 0x10008]
push eax
push dword [ebp - 0x1000c]
push str.Error__d:__s
call fcn.00490340
mov ecx, dword [0x500320]
add esp, 0xc
mov edx, esi
mov dword [esi + 4], eax
call fcn.0048ead0
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 4]
xor ecx, ebp
pop esi
call fcn.00495b16
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10008]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48fc58
sub ecx, edx
test ecx, ecx
jle 0x48fc13
cmp byte [ebp + ecx - 0x10009], 0xa
jne 0x48fc13
dec ecx
cmp ecx, 0x10000
jae 0x48fc81
mov byte [ebp + ecx - 0x10008], al
jmp 0x48fc13
call fcn.00495c46
int3
Function at 0x490fe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, 0x105
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], edi
push 0
mov edx, 1
mov ecx, edi
call fcn.0048ffe0
add esp, 4
mov esi, eax
push edi
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x491050
nop dword [eax]
mov ecx, esi
cmp eax, 0xea
jne 0x491059
push 0
push 1
push edi
push 1
lea edx, [ebp - 4]
call fcn.00490080
mov edi, dword [ebp - 4]
add esp, 0x10
mov esi, eax
push edi
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x491020
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00490070
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4910d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, ecx
mov ebx, edx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49116c
cmp dword [ebp - 8], 1
jne 0x49116c
push esi
push edi
mov edi, dword [ebp - 4]
lea edx, [eax + 1]
inc edi
push eax
mov ecx, edi
call fcn.0048ffe0
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49115c
cmp dword [ebp - 8], 1
jne 0x49115c
mov eax, dword [ebp - 4]
cmp eax, edi
jb 0x49114f
push 0x6c
push str.C:Usersomahr_source_reposputty_caccodewindowsutils_registry.c
push str.size___allocsize
call fcn.004a3dca
mov eax, dword [ebp - 4]
add esp, 0xc
mov byte [esi + eax], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00490070
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4911c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push esi
push edi
push eax
push 0
lea eax, [ebp - 4]
mov edi, edx
push eax
push 0
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49124d
cmp dword [ebp - 4], 7
jne 0x49124d
call fcn.0048fec0
mov edx, dword [ebp - 8]
mov esi, eax
mov ecx, esi
lea edx, [edx + 2]
call fcn.0048fd30
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 4]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x491246
cmp dword [ebp - 4], 7
jne 0x491246
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.0048fd70
xor dl, dl
mov ecx, esi
call fcn.0048fdd0
test al, al
jne 0x491226
lea ecx, [esi + 0xc]
xor dl, dl
call fcn.0048f460
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0048fee0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret