joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100090d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c17bc
call esi
mov byte [0x4c17bc], 0xe9
mov eax, 0x10008e90
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3e83f
mov dword [0x4c17bd], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c17bc
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c17c1
call esi
mov eax, 0x4c17c1
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c17c1
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c1811
call esi
mov byte [0x4c1811], 0xe9
mov eax, 0x10008f50
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3e7ea
mov dword [0x4c1812], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c1811
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c1816
call esi
mov eax, 0x4c1816
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c1816
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c1861
call esi
mov byte [0x4c1861], 0xe9
mov eax, 0x10009010
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3e79a
mov dword [0x4c1862], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c1861
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c1866
call esi
mov eax, 0x4c1866
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c1866
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4c1791
call esi
mov byte [0x4c1791], 0xe9
mov eax, 0x100085e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb3e86a
mov dword [0x4c1792], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4c1791
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 3
push 0x4c1796
call esi
mov eax, 0x4c1796
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 3
push 0x4c1796
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b0d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x56906d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x1000b010
sub eax, 0x569072
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x56906e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push 0x569072
call esi
mov eax, 0x569072
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 2
push 0x569072
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000bdb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x527c13
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x1000b320
sub eax, 0x527c18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x527c14
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51e605
call ebx
push eax
call edi
mov eax, 0x1000b730
sub eax, 0x51e60a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51e606
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x51e60a
call esi
mov eax, 0x51e60a
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x51e60a
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x603d4b
call ebx
push eax
call edi
mov eax, 0x1000b890
sub eax, 0x603d50
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x603d4c
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x450a4e
call esi
mov byte [0x450a4e], 0xe9
mov eax, 0x1000b300
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffbaf5ad
mov dword [0x450a4f], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x450a4e
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x527b3f
call ebx
push eax
call edi
mov eax, 0x1000b990
sub eax, 0x527b44
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x527b40
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x602dd0
call ebx
push eax
call edi
mov eax, 0x1000bd40
sub eax, 0x602dd5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x602dd1
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.1000c3c0
test al, al
je 0x1000d212
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe8
push eax
push 0x4bbedb
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x1000cbb0
sub eax, 0x4bbee0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4bbedc
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4bd935
call ebx
push eax
call edi
mov eax, 0x1000cca0
sub eax, 0x4bd93a
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4bd936
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4bcea5
call ebx
push eax
call edi
mov eax, 0x1000cf20
sub eax, 0x4bceaa
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4bcea6
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4bd38a
call ebx
push eax
call edi
mov eax, 0x1000cd40
sub eax, 0x4bd38f
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4bd38b
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4bd38f
call esi
mov eax, 0x4bd38f
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x4bd38f
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x523062
call ebx
push eax
call edi
mov eax, 0x1000cfc0
sub eax, 0x523067
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x523063
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x523067
call esi
mov eax, 0x523067
mov dword [eax], 0x90909090
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 4
push 0x523067
call esi
call fcn.1000a6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.Error_hotkeys_configurations
push str.Fail_to_load_Hotkey.xml__previous_implementation_will_load__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1000a300
mov esp, ebp
pop ebp
ret
Function at 0x1000d5f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x555593
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x1000d5d0
sub eax, 0x555598
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x555594
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x40b8ae
call ebx
push eax
call edi
mov eax, 0x1000d5b0
sub eax, 0x40b8b3
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x40b8af
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x40b8b3
call esi
mov eax, 0x40b8b3
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x40b8b3
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4cb02e
call ebx
push eax
call edi
mov eax, 0x1000d230
sub eax, 0x4cb033
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4cb02f
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4cb0ae
call ebx
push eax
call edi
mov eax, 0x1000d320
sub eax, 0x4cb0b3
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4cb0af
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5a06aa
call ebx
push eax
call edi
mov eax, 0x1000d440
sub eax, 0x5a06af
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5a06ab
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x5a06af
call esi
mov eax, 0x5a06af
mov byte [eax], 0x90
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x5a06af
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5ce960
call ebx
push eax
call edi
mov eax, 0x1000d410
sub eax, 0x5ce965
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5ce961
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x6013a1
call esi
mov byte [0x6013a1], 0xe9
mov eax, 0x1000ff90
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fec5a
mov dword [0x6013a2], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x6013a1
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x602d64
call esi
mov byte [0x602d64], 0xe9
mov eax, 0x10010150
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xff9fd297
mov dword [0x602d65], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x602d64
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001104e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.launchtosingle
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10011030
test dl, dl
je 0x1001102c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10011030
add eax, 2
add ecx, 2
test dl, dl
jne 0x10011010
xor eax, eax
jmp 0x10011035
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret

Function at 0x10011060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001112e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.Auto_Save
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10011110
test dl, dl
je 0x1001110c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10011110
add eax, 2
add ecx, 2
test dl, dl
jne 0x100110f0
xor eax, eax
jmp 0x10011115
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret
Function at 0x10011f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10011ffe
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.Select_All
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10011fe0
test dl, dl
je 0x10011fdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10011fe0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10011fc0
xor eax, eax
jmp 0x10011fe5
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret
Function at 0x10012c80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10011370
call fcn.10011db0
call fcn.10011f30
test al, al
je 0x10012d14
push esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51d1d7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x10012bf0
sub eax, 0x51d1dc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x51d1d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push 0x51d1dc
call esi
mov eax, 0x51d1dc
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 2
push 0x51d1dc
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100163ce
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.Advanced_Interface
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100163b0
test dl, dl
je 0x100163ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100163b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10016390
xor eax, eax
jmp 0x100163b5
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret

Function at 0x10016450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x52236e
call esi
mov eax, 0x52236e
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 7
push 0x52236e
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x52236e
call esi
mov byte [0x52236e], 0xe9
mov eax, 0x100163e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffaddc8d
mov dword [0x52236f], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x52236e
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100167f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xe9
push eax
push 0x5b7f1d
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, 0x100167b0
sub eax, 0x5b7f22
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x5b7f1e
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4fa866
call edi
push eax
call esi
mov eax, 0x100167d0
sub eax, 0x4fa86b
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4fa867
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5bc668
call edi
push eax
call esi
mov eax, 0x10016770
sub eax, 0x5bc66d
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5bc669
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4f6d58
call edi
push eax
call esi
mov eax, 0x10016790
sub eax, 0x4f6d5d
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4f6d59
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x51e975
call edi
push eax
call esi
mov eax, 0x10016730
sub eax, 0x51e97a
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x51e976
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x5b1418
call edi
push eax
call esi
mov eax, 0x10016750
sub eax, 0x5b141d
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x5b1419
call edi
push eax
call esi
push 0
push 0
push 0
push 0x10016510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100169c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10016a8e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.double_click_Selection
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10016a70
test dl, dl
je 0x10016a6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10016a70
add eax, 2
add ecx, 2
test dl, dl
jne 0x10016a50
xor eax, eax
jmp 0x10016a75
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret

Function at 0x10016aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10016b6e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.selection_box
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10016b50
test dl, dl
je 0x10016b4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10016b50
add eax, 2
add ecx, 2
test dl, dl
jne 0x10016b30
xor eax, eax
jmp 0x10016b55
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret