joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10033871
lfence
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10033860
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10045f60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push esi
push edi
test ebx, ebx
je 0x10045fc5
mov ecx, SysReAllocString
mov eax, ebx
cmp word [eax], 0
je 0x10045fa6
add eax, 2
sub ecx, 1
jne 0x10045f98
mov eax, SysReAllocString
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
xor esi, esi
and edi, eax
test ecx, ecx
mov eax, 0x80070057
cmovne eax, esi
jne 0x10045fcc
jmp 0x10045fca
mov eax, 0x80070057
xor edi, edi
test eax, eax
js 0x1004608e
push 0x27
lea eax, [ebp - 0x54]
push eax
push edx
call dword [sym.imp.OLE32.dll_StringFromGUID2]
mov esi, eax
test esi, esi
js 0x10046070
push 0
lea eax, [ebp - 0x5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x1024388c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0x10046020
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10046070
push 0
lea eax, [ebp - 0x58]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0x10046052
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10046070
lea eax, [edi*2 + 2]
push eax
push ebx
push 1
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x1004607e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x1004608c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret
Function at 0x10046190
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
je 0x10046282
cmp dword [edi + 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x21c], xmm0
je 0x1004621f
xor esi, esi
cmp dword [edi + 0x38], esi
jbe 0x1004621f
nop word [eax + eax]
mov eax, dword [edi + 0x34]
push dword [eax + esi*4]
lea eax, [ebp - 0x20c]
push dword [0x1024388c]
push str._s_s
push 0x104
push eax
call fcn.10046100
add esp, 0x14
test eax, eax
js 0x10046212
push 0
push 0x200
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
inc esi
cmp esi, dword [edi + 0x38]
jb 0x100461d0
movups xmm0, xmmword [ebp - 0x21c]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10056a60
mov esi, eax
test esi, esi
js 0x10046270
cmp dword [edi + 0x1c], 0
je 0x1004624f
sub esp, 0x10
lfence
movups xmm0, xmmword [ebp - 0x21c]
mov eax, esp
movups xmmword [eax], xmm0
call sub.MFPlat.DLL_MFTUnregister
mov edi, dword [edi + 0x40]
test edi, edi
je 0x10046270
mov ecx, edi
call dword [0x101f433c]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.101658c8
mov esp, ebp
pop ebp
ret
Function at 0x10046bd0
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1024e8fc], 0
push esi
push edi
je 0x10046d0d
xor esi, esi
mov dword [ebp - 0x214], esi
cmp dword [0x1024e900], esi
jbe 0x10046d0d
xor edi, edi
mov dword [ebp - 0x218], edi
add edi, dword [0x1024e8fc]
mov eax, dword [edi + 4]
test eax, eax
je 0x10046ceb
cmp dword [edi + 0x34], 0
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x230], xmm0
je 0x10046ca6
xor esi, esi
cmp dword [edi + 0x38], esi
jbe 0x10046ca0
nop dword [eax]
mov eax, dword [edi + 0x34]
mov eax, dword [eax + esi*4]
push eax
push dword [0x1024388c]
lea eax, [ebp - 0x210]
push str._s_s
push 0x104
push eax
call fcn.10046100
add esp, 0x14
test eax, eax
js 0x10046c93
push 0
push 0x200
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
inc esi
cmp esi, dword [edi + 0x38]
jb 0x10046c50
movaps xmm0, xmmword [ebp - 0x230]
mov esi, dword [ebp - 0x214]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10056a60
test eax, eax
js 0x10046ceb
cmp dword [edi + 0x1c], 0
je 0x10046cd4
sub esp, 0x10
mov eax, esp
lfence
movaps xmm0, xmmword [ebp - 0x230]
movups xmmword [eax], xmm0
call sub.MFPlat.DLL_MFTUnregister
mov esi, dword [edi + 0x40]
test esi, esi
je 0x10046ce5
mov ecx, esi
call dword [0x101f433c]
call esi
mov esi, dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
inc esi
add edi, 0x44
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], edi
cmp esi, dword [0x1024e900]
jb 0x10046c21
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.101658c8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10046f20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push eax
push 0
push 0
mov dword [esi], 0
mov dword [edi], 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x10047075
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10047075
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0
push eax
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0
push eax
push 0
push 0
push 4
push 6
push dword [esi]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x10047019
mov dword [ebp - 8], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push str.S_1_5_19
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x24], 0x1f0001
mov dword [ebp - 0x20], 1
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x10047019
push dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x10047019
push eax
push dword [ebp - 0x28]
push eax
push eax
push 4
push 6
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1004704b
push 0
push 0
push str.WARNING:_dwRes_is_unsuccessfull
push 0
push str.mfx_mft_unk
push str.MyNamedMutex::MyNamedMutex
push esi
push 0x8b
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024ecd8
push 0x102433b8
call fcn.10027570
add esp, 0x2c
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x10047059
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10047067
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10047075
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.101658c8
mov esp, ebp
pop ebp
ret 8

Function at 0x100470f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0
push dword [ebp + 0x10]
mov dword [esi], 0
push dword [ebp + 0xc]
mov dword [edi], 0x80004005
push 0
push 0
call fcn.1018b609
add esp, 0x18
mov dword [esi], eax
test eax, eax
mov eax, esi
je 0x1004712a
mov dword [edi], 0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10047130
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xc]
sub eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
sbb eax, dword [esi + 4]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100492f0
mov ecx, dword [ebp - 0xc]
add esp, 8
sub ecx, dword [esi + 8]
mov edx, dword [ebp - 8]
sbb edx, dword [esi + 0xc]
mov edi, dword [ebp - 0x44]
sub edi, dword [esi + 0x10]
mov ebx, dword [ebp - 0x40]
sbb ebx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], edx
test eax, eax
je 0x100471a3
mov ecx, dword [ebp - 0x3c]
add dword [eax], ecx
mov ecx, dword [ebp - 0x38]
adc dword [eax + 4], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100471af
add dword [eax], ecx
adc dword [eax + 4], edx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x100471bb
add dword [eax], edi
adc dword [eax + 4], ebx
cmp dword [esi + 0x18], 0
je 0x1004725a
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x30]
push eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
add edi, dword [ebp - 0x34]
mov ecx, edi
adc ebx, dword [ebp - 8]
mov edx, ebx
call fcn.10165f00
divsd xmm0, qword [0x1020f740]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mulsd xmm0, qword [0x102111c8]
movsd qword [ebp - 0xc], xmm0
call fcn.10165f00
mov edx, dword [0x1024eca4]
mov ecx, dword [0x1024eca0]
movsd qword [ebp - 0x44], xmm0
call fcn.10165f00
movsd xmm2, qword [ebp - 0x44]
divsd xmm2, xmm0
mov eax, dword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0xc]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x1020b5f0]
mov eax, dword [esi + 0x18]
mulsd xmm2, xmm1
divsd xmm0, xmm2
movsd qword [eax], xmm0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret
Function at 0x10048e70
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
mov esi, dword [ebp + 8]
push eax
push 2
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10048ef6
cmp eax, 2
je 0x10048ee1
push esi
push 0x10211038
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_delete_reg_value
push 0
push 0x606
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f038
push 0x102433b8
call fcn.10027570
add esp, 0x2c
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10048f74
cmp edi, 2
jne 0x10048f28
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str.__S_S
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_delete_reg_value
push 0
push 0x613
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f0c8
push 0x102433b8
call fcn.10027570
add esp, 0x30
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret

Function at 0x10049290
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x40]
movaps xmmword [ebp - 0x40], xmm0
push eax
movaps xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10049490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 1
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1004952d
cmp eax, 2
je 0x100495c1
push esi
push 0x10211038
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_get_reg_dword
push 0
push 0x676
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f398
push 0x102433b8
call fcn.10027570
add esp, 0x2c
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10049585
cmp eax, 2
je 0x100495c1
push edi
push esi
push str.__S_S
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_get_reg_dword
push 0
push 0x67f
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f428
jmp 0x100495b4
cmp dword [ebp - 8], 4
je 0x100495d7
push edi
push esi
push str._S_S
push str.RegValue_has_invalid_type:
push 0
push str.mfx_mft_unk
push str.mf_get_reg_dword
push 0
push 0x687
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f4b8
push 0x102433b8
call fcn.10027570
add esp, 0x30
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
push dword [ebx]
push edi
push esi
push str._S_S___u
push str.RegValue_was_read:
push 0
push str.mfx_mft_unk
push str.mf_get_reg_dword
push 0
push 0x68a
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f548
push 0x102433b8
call fcn.10027570
mov ecx, dword [ebp - 4]
add esp, 0x34
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret
Function at 0x10049630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
add eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100496d1
cmp eax, 2
je 0x10049768
push esi
push 0x10211038
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_get_reg_string
push 0
push 0x64c
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f158
push 0x102433b8
call fcn.10027570
add esp, 0x2c
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10049725
cmp ebx, 2
je 0x10049768
push edi
push esi
push str.__S_S
push str.failed_on
push 0
push str.mfx_mft_unk
push str.mf_get_reg_string
push 0
push 0x656
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f1e8
jmp 0x1004975b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x1004977e
cmp eax, 2
je 0x1004977e
push edi
push esi
push str._S_S
push str.RegValue_has_invalid_type:
push 0
push str.mfx_mft_unk
push str.mf_get_reg_string
push 0
push 0x65e
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f278
push 0x102433b8
call fcn.10027570
add esp, 0x30
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14]
push edi
push esi
push str._S_S___S
push str.RegValue_was_read:
push 0
push str.mfx_mft_unk
push str.mf_get_reg_string
push 0
push 0x661
push str.D:qbworkspace26444_source_sourcesmdp_msdk_mfts_samples_sample_pluginsmfoundationmf_utils_srcmf_utils.cpp
push 0x1024f308
push 0x102433b8
call fcn.10027570
mov ecx, dword [ebp - 4]
add esp, 0x34
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret
Function at 0x1004c8a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d9220
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebx + 0x18]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], edi
mov ecx, dword [eax + edi*8]
cmp esi, ecx
je 0x1004c98d
mov esi, dword [eax + edi*8 + 4]
mov esi, dword [esi]
cmp esi, ecx
je 0x1004c98d
mov esi, dword [esi + 4]
mov eax, dword [edx]
cmp eax, dword [esi + 8]
jne 0x1004c930
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.1004d290
push 0x24
push edi
call fcn.101654b3
mov eax, dword [ebp - 0x1c]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1004c9ba
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [eax + ecx*8]
lea ecx, [eax + ecx*8]
cmp edx, dword [ebx + 4]
jne 0x1004c9d9
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax + ecx*8 + 4], edi
jmp 0x1004c9ff
cmp edx, esi
jne 0x1004c9e1
mov dword [ecx], edi
jmp 0x1004c9ff
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1004c9ff
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1004d880
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x1004c96f
Function at 0x1004ca50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d9250
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebx + 0x18]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], edi
mov ecx, dword [eax + edi*8]
cmp esi, ecx
je 0x1004cb3d
mov esi, dword [eax + edi*8 + 4]
mov esi, dword [esi]
cmp esi, ecx
je 0x1004cb3d
mov esi, dword [esi + 4]
mov eax, dword [edx]
cmp eax, dword [esi + 8]
jne 0x1004cae0
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.1004d290
push 0x24
push edi
call fcn.101654b3
mov eax, dword [ebp - 0x1c]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1004cb6a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [eax + ecx*8]
lea ecx, [eax + ecx*8]
cmp edx, dword [ebx + 4]
jne 0x1004cb89
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax + ecx*8 + 4], edi
jmp 0x1004cbaf
cmp edx, esi
jne 0x1004cb91
mov dword [ecx], edi
jmp 0x1004cbaf
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1004cbaf
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1004d880
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x1004cb1f