joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a20
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x10001a5e
push dword [ebp - 8]
call fcn.10014d28
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x10001ae8
mov edx, esi
test esi, esi
je 0x10001a7f
nop dword [eax]
cmp dword [edx + 0x1a0], 6
je 0x10001ab2
mov edx, dword [edx]
test edx, edx
jne 0x10001a70
mov eax, dword [0x1003af00]
xor ecx, ecx
mov dword [eax], ecx
mov eax, dword [0x1003af00]
mov word [eax + 4], cx
test esi, esi
je 0x10001a9e
push esi
call fcn.10013e71
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1003af00]
mov eax, dword [edx + 0x194]
push esi
mov dword [ecx], eax
mov ax, word [edx + 0x198]
mov word [ecx + 4], ax
call fcn.10013e71
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10001af5
push esi
call fcn.10013e71
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000d579
mov esp, ebp
pop ebp
ret

Function at 0x10001b10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b9ed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
mov esi, dword [0x1003af08]
mov edx, 2
push eax
mov ecx, 0x10039b68
call fcn.10007d20
add esp, 4
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
neg esi
cmp ecx, 0xf
jbe 0x10001bbf
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001bb5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001bdb
push ecx
push edx
call fcn.1000d587
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
call fcn.100140c1
int3
Function at 0x10002210
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x120], edx
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x11c], eax
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
push dword [ebp + 0xc]
mov ecx, dword [0x1003aefc]
sub eax, edi
push eax
mov eax, dword [ebp - 0x120]
add eax, edi
push eax
push ebx
call ecx
cmp eax, 0xffffffff
jne 0x100022d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100022b1
nop dword [eax + eax]
inc esi
cmp esi, 5
jg 0x100022b1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0
lea eax, [ebp - 0x118]
mov dword [ebp - 8], 0
push eax
push 0
push 1
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x100022d2
je 0x10002270
push dword [ebp - 0x11c]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
add edi, eax
mov eax, dword [ebp + 8]
cmp edi, eax
jne 0x10002241
push dword [ebp - 0x11c]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d579
mov esp, ebp
pop ebp
ret

Function at 0x10002300
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10034d58
push 2
mov edi, ecx
call fcn.100153d9
add esp, 8
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000236b
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], edi
je 0x10002386
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x10002355
push 0
call fcn.1000d6c8
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d579
mov esp, ebp
pop ebp
ret
Function at 0x10003150
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.1000e610
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x100031af
call fcn.10001910
push str.Error_EP
push 0
push eax
call fcn.10008120
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x100c]
xor bl, bl
shr edi, 2
xor esi, esi
test edi, edi
je 0x1000321b
mov eax, dword [0x1003aed8]
lea edx, [esi + 1]
nop dword [eax + eax]
mov ecx, dword [ebp + esi*4 - 0x1008]
test ecx, ecx
je 0x10003216
test eax, eax
jne 0x1000320e
call fcn.100023b0
test eax, eax
je 0x10003202
cmp eax, 1
jne 0x10003202
mov bl, al
mov edx, 1
mov eax, dword [ebp + esi*4 - 0x1008]
mov dword [0x1003aed8], eax
jmp 0x10003216
mov eax, dword [0x1003aed8]
mov edx, 1
jmp 0x10003216
cmp ecx, eax
movzx ebx, bl
cmove ebx, edx
inc esi
cmp esi, edi
jb 0x100031d0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d579
mov esp, ebp
pop ebp
ret
Function at 0x100047a0
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [0x10039080]
xor eax, esp
mov dword [esp + 0xa8], eax
sub dword [ebp + 0xc], 1
push esi
jne 0x10004914
push 0
lea eax, [esp + 0x24]
push eax
push str.rgc.auth
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000492e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x1000492e
cmp eax, 0x1000
jne 0x1000492e
push eax
call fcn.1000d6c8
add esp, 4
mov dword [0x1003aee8], eax
lea ecx, [esp + 4]
push 0
push ecx
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000492e
cmp dword [esp + 4], 0x1000
jne 0x1000492e
lea eax, [esp + 8]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1000492e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100038c0
test al, al
je 0x10004935
push 0x10034ee8
push str.set_to_dev
call fcn.10014bbc
add esp, 8
test eax, eax
je 0x10004892
push eax
call fcn.10014cf8
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1003aeec], eax
call fcn.1000b570
call fcn.1000a770
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1000ac40
push sym.pn.dll_void___stdcall_sub_0A93FFA_struct__SYSTEMTIME__
push 0x1003aef8
call fcn.10009ff0
mov esi, eax
call fcn.1000a7d0
test esi, esi
jne 0x10004914
push 0x6c
call fcn.1000d5b8
add esp, 4
mov dword [esp + 4], eax
mov ecx, eax
mov dword [0x1003aee4], eax
mov byte [eax + 0x10], 0
push 2
push 0x1003aeec
mov dword [eax + 0x54], esi
mov dword [eax + 0x58], esi
mov dword [eax + 0x5c], 0x67452301
mov dword [eax + 0x60], 0xefcdab89
mov dword [eax + 0x64], 0x98badcfe
mov dword [eax + 0x68], 0x10325476
call fcn.10008970
mov ecx, dword [esp + 0xac]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1000d579
mov esp, ebp
pop ebp
ret 0xc
push 0xfffffffffffffff5
call fcn.10015741
push 0xfffffffffffffff4
call fcn.10015741
int3
Function at 0x10004f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10004f52
jl 0x10004f45
test ecx, ecx
jne 0x10004f52
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10005012
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10006aa0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10004fbe
jg 0x10004f7d
test esi, esi
je 0x10004fbe
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10004f95
mov eax, dword [esp + 0x10]
jl 0x10004f8f
cmp eax, esi
jae 0x10004f95
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1000ecb0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10004fdf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10004ffb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10004f64
jl 0x10004ffb
test ecx, ecx
jne 0x10004f64
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10005050
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10005050
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.1000ecb0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100050b9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10005076
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x100050a4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100162c5
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100050b9
cmp edi, eax
ja 0x10005082
test edi, edi
je 0x100050b9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100162c5
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002bd5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10039080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.100020c0
push 8
call fcn.1000d5b8
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.1000caf9
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.10006c30
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + 0xb], al
test ecx, ecx
je 0x10006a4a
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10006a4a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x10006a66
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.100020c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10006b50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002bd80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10039080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1000d5b8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1000caf9
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10006af0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, esi
mov edx, 8
mul edx
push edi
mov edi, dword [ebp + 8]
seto cl
mov dword [ebp - 8], edi
neg ecx
or ecx, eax
push ecx
call fcn.1000d6c8
shl esi, 3
add esp, 4
mov ebx, eax
xor edx, edx
mov dword [ebp - 0xc], ebx
test esi, esi
je 0x10007d74
mov edi, dword [ebp - 4]
sub edi, ebx
lea ecx, [edx + ebx]
mov al, byte [edi + ecx]
xor al, dl
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x10007d62
mov edi, dword [ebp - 8]
mov ecx, ebx
mov esi, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007d80
sub ecx, edx
sar ecx, 1
lea eax, [ebx + ecx*2]
mov dword [ebp - 8], eax
cmp ebx, eax
je 0x10007de4
mov ebx, eax
nop dword [eax + eax]
mov al, byte [esi]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
mov byte [ebp - 4], al
cmp ecx, edx
jae 0x10007dcb
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x10007dbe
mov eax, dword [edi]
mov dl, byte [ebp - 4]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x10007dda
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 0xc]
push 1
call fcn.10007200
add esi, 2
cmp esi, ebx
jne 0x10007da0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.1000d6d1
add esp, 4
cmp dword [edi + 0x14], 0xf
jbe 0x10007dfc
mov eax, dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002bf6b
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x10039080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 1
push eax
mov edx, 9
mov dword [ebp - 0x148], 0
mov ecx, 0x10039b98
call fcn.10007d20
add esp, 4
lea ecx, [ebp - 0x148]
cmp dword [ebp - 0x130], 0xf
lea eax, [ebp - 0x144]
cmova eax, dword [ebp - 0x144]
push ecx
push 0x20119
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi], eax
test eax, eax
je 0x10007fb0
or esi, 0xffffffff
jmp 0x10008067
push 0xff
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000f230
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x114], 0xff
push eax
mov edx, 4
mov ecx, 0x10039b78
call fcn.10007d20
add esp, 0x10
lea ecx, [ebp - 0x114]
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
cmova eax, dword [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0xffff
push eax
push 0x10034d58
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [esi], eax
push dword [ebp - 0x148]
test eax, eax
je 0x1000803a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffe
jmp 0x10008067
cmp dword [ebp - 0x114], 0x25
jae 0x10008050
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffd
jmp 0x10008067
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call fcn.10007e10
mov esi, 1
mov ecx, dword [ebp - 0x118]
cmp ecx, 0xf
jbe 0x1000809d
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10008093
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000810c
push ecx
push edx
call fcn.1000d587
add esp, 8
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp ecx, 0xf
jbe 0x100080ee
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100080e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000810c
push ecx
push edx
call fcn.1000d587
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d579
mov esp, ebp
pop ebp
ret 4
call fcn.100140c1
int3
Function at 0x10008cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10008e90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10008d9d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10008d0a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10039004]
ja 0x10008d0a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10008cda
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1000f230
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10008d2f
jmp 0x10008d9d
cmp dword [ebp - 0x14], 0x10000
jne 0x10008d83
cmp dword [ebp - 0x18], 0x10000
jb 0x10008d83
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008d66
mov eax, dword [ebp - 8]
jmp 0x10008d9f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10008d76
xor eax, eax
jmp 0x10008d9f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10008d98
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10008e90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10008cda
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10008db0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10008ec0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10008e85
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10008df5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10039004]
ja 0x10008df5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10008dc5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1000f230
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10008e1a
jmp 0x10008e85
cmp dword [ebp - 0x14], 0x10000
jne 0x10008e6e
cmp dword [ebp - 0x18], 0x10000
jb 0x10008e6e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008e51
mov eax, dword [ebp - 8]
jmp 0x10008e87
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10008e61
xor eax, eax
jmp 0x10008e87
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10008e80
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10008ec0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10008dc5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10008ef0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100092e0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1003a17c], 0
jne 0x10008f2d
cmp dword [0x1003a178], 0
je 0x10008f2d
mov eax, dword [0x1003a178]
mov dword [0x1003a17c], eax
cmp dword [0x1003a17c], 0
je 0x10008faa
mov ecx, dword [0x1003a17c]
cmp dword [ecx + 8], 0
je 0x10008faa
mov edx, dword [0x1003a17c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10008faa
mov ecx, dword [0x1003a17c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10008faa
mov eax, dword [0x1003a17c]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10008f79
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10008f80
xor eax, eax
jmp 0x100090c9
mov ecx, dword [0x1003a17c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1000f230
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100090c9
mov edx, dword [0x1003a178]
mov dword [0x1003a17c], edx
jmp 0x10008fc6
mov eax, dword [0x1003a17c]
mov ecx, dword [eax + 4]
mov dword [0x1003a17c], ecx
cmp dword [0x1003a17c], 0
je 0x10009006
cmp dword [0x1003a17c], 0
je 0x10009004
mov edx, dword [0x1003a17c]
cmp dword [edx + 8], 0
je 0x10009004
mov eax, dword [0x1003a17c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10009004
mov edx, dword [0x1003a17c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10009004
jmp 0x10008f5e
jmp 0x10008fb8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100090d0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100090c7
mov eax, dword [ebp - 0x18]
mov dword [0x1003a17c], eax
mov ecx, dword [0x1003a17c]
mov dword [ecx], 0x52727464
mov edx, dword [0x1003a17c]
mov dword [edx + 8], 0
mov eax, dword [0x1003a17c]
mov ecx, dword [0x1003a178]
mov dword [eax + 4], ecx
mov edx, dword [0x1003a17c]
mov dword [0x1003a178], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1003a17c]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10009097
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x100090b7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1000908e
mov eax, dword [0x1003a17c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10008f5e
xor eax, eax
mov esp, ebp
pop ebp
ret