joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101addd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1006ee8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101ae35
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1004d40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101ae28
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101ae37
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001063
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esp, dword [ebp + 0xc]
mov ebp, eax
pop dword fs:[0]
add esp, 4
pop ecx
test ecx, 0x80
je 0x1000108e
pop ebp
test ecx, 0x40
je 0x10001097
pop ebx
test ecx, 0x20
je 0x100010a0
pop edi
test ecx, 0x10
je 0x100010a9
pop esi
mov eax, edx
test ecx, 0x80000000
je 0x10001143
and ecx, 0xf
or ecx, ecx
jne 0x100010c4
ret
cmp ecx, 1
jne 0x100010d1
ret 4
cmp ecx, 2
jne 0x100010de
ret 8
cmp ecx, 3
jne 0x100010eb
ret 0xc
cmp ecx, 4
jne 0x100010f8
ret 0x10
cmp ecx, 5
jne 0x10001105
ret 0x14
cmp ecx, 6
jne 0x10001112
ret 0x18
cmp ecx, 7
jne 0x1000111f
ret 0x1c
cmp ecx, 8
jne 0x1000112c
ret 0x20
cmp ecx, 9
jne 0x10001139
ret 0x24
cmp ecx, 0xa
jne 0x100011ba
ret 0x28
and ecx, 0xf
or ecx, ecx
jne 0x1000114e
leave
ret
cmp ecx, 1
jne 0x10001159
leave
ret 4
cmp ecx, 2
jne 0x10001164
leave
ret 8
cmp ecx, 3
jne 0x1000116f
leave
ret 0xc
cmp ecx, 4
jne 0x1000117a
leave
ret 0x10
cmp ecx, 5
jne 0x10001185
leave
ret 0x14
cmp ecx, 6
jne 0x10001190
leave
ret 0x18
cmp ecx, 7
jne 0x1000119b
leave
ret 0x1c
cmp ecx, 8
jne 0x100011a6
leave
ret 0x20
cmp ecx, 9
jne 0x100011b1
leave
ret 0x24
cmp ecx, 0xa
jne 0x100011ba
leave
ret 0x28
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xb8]
jmp 0x100011d1
push eax
push 0x100011cb
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push dword [0x10058810]
call dword [sym.imp.user32.dll_MessageBoxA]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x100011ba
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esp, dword [ebp + 0xc]
mov ebp, eax
pop dword fs:[0]
add esp, 4
pop ecx
test ecx, 0x80
je 0x1000108e
pop ebp
test ecx, 0x40
je 0x10001097
pop ebx
test ecx, 0x20
je 0x100010a0
pop edi
test ecx, 0x10
je 0x100010a9
pop esi
mov eax, edx
test ecx, 0x80000000
je 0x10001143
and ecx, 0xf
or ecx, ecx
jne 0x100010c4
ret
cmp ecx, 1
jne 0x100010d1
ret 4
cmp ecx, 2
jne 0x100010de
ret 8
cmp ecx, 3
jne 0x100010eb
ret 0xc
cmp ecx, 4
jne 0x100010f8
ret 0x10
cmp ecx, 5
jne 0x10001105
ret 0x14
cmp ecx, 6
jne 0x10001112
ret 0x18
cmp ecx, 7
jne 0x1000111f
ret 0x1c
cmp ecx, 8
jne 0x1000112c
ret 0x20
cmp ecx, 9
jne 0x10001139
ret 0x24
cmp ecx, 0xa
jne 0x100011ba
ret 0x28
and ecx, 0xf
or ecx, ecx
jne 0x1000114e
leave
ret
cmp ecx, 1
jne 0x10001159
leave
ret 4
cmp ecx, 2
jne 0x10001164
leave
ret 8
cmp ecx, 3
jne 0x1000116f
leave
ret 0xc
cmp ecx, 4
jne 0x1000117a
leave
ret 0x10
cmp ecx, 5
jne 0x10001185
leave
ret 0x14
cmp ecx, 6
jne 0x10001190
leave
ret 0x18
cmp ecx, 7
jne 0x1000119b
leave
ret 0x1c
cmp ecx, 8
jne 0x100011a6
leave
ret 0x20
cmp ecx, 9
jne 0x100011b1
leave
ret 0x24
cmp ecx, 0xa
jne 0x100011ba
leave
ret 0x28
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xb8]
jmp 0x100011d1
push eax
push 0x100011cb
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push dword [0x10058810]
call dword [sym.imp.user32.dll_MessageBoxA]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1000159a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1000160d
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0
jle 0x10001604
mov dword [ebp - 0xc], eax
lea eax, [eax + 0xa]
push eax
push 8
call fcn.1000132a
or eax, eax
je 0x10001604
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x10002175
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov byte [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
leave
ret 0x14
Function at 0x100022ac
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push 0x11
push 2
push 2
call dword [sym.imp.ws2_32.dll_socket]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.10001000
mov word [ebp - 0x14], 2
push 0
call dword [sym.imp.ws2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0
call dword [sym.imp.ws2_32.dll_htonl]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.ws2_32.dll_bind]
or eax, eax
jne 0x1000236d
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebx]
call dword [sym.imp.ws2_32.dll_setsockopt]
push 0x21
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ws2_32.dll_WSAAsyncSelect]
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.10001000
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.ws2_32.dll_getsockname]
mov dword [ebp - 4], 0x2000
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push 0xffff
push dword [ebx]
call dword [sym.imp.ws2_32.dll_setsockopt]
jmp 0x1000237b
push dword [ebx]
call dword [sym.imp.ws2_32.dll_closesocket]
mov dword [ebx], 0
mov eax, dword [ebx]
pop ebx
leave
ret 0xc

Function at 0x1000249d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push 0x10
lea eax, [ebp - 0x184]
push eax
call fcn.10001000
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_lstrlen]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10002468
mov eax, dword [ebp - 0xc]
or eax, eax
jne 0x100024e8
mov eax, 0xd967
xchg al, ah
mov word [ebp - 0x182], ax
mov word [ebp - 0x184], 2
mov eax, dword [ebp - 8]
or eax, eax
je 0x10002555
cmp eax, 0xffffffff
je 0x10002555
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x174], 0x3e8
push dword [ebp + 0x10]
lea eax, [ebp - 0x170]
push eax
call fcn.1000103f
add eax, 4
mov dword [ebp - 4], eax
push 0x10
lea eax, [ebp - 0x184]
push eax
push 0
push dword [ebp - 4]
lea eax, [ebp - 0x174]
push eax
push dword [ebp + 8]
call dword [sym.imp.ws2_32.dll_sendto]
call dword [sym.imp.kernel32.dll_GetTickCount]
inc eax
mov dword [section..data], eax
leave
ret 0xc
Function at 0x10002a16
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaac
or dword [ebp - 4], 0xffffffff
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x3b0]
push eax
call fcn.100014eb
lea eax, [ebp - 0x3b0]
push eax
call fcn.1000220e
mov dword [ebp - 8], eax
push 0x168
push dword [ebp - 8]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyn]
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea eax, [ebp - 0x248]
push eax
call fcn.1000223c
lea edx, [ebp - 0x248]
cmp eax, edx
jbe 0x10002a78
mov byte [eax - 1], 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.100023b3
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_lstrcpy]
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_lstrcat]
jmp 0x10002abf
push 0x10002abb
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_lstrcat]
lea eax, [ebp - 0x552]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x10002b9c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
jmp 0x10002b42
test dword [ebp - 0x552], 0x10
jne 0x10002b32
cmp byte [ebp - 0x526], 0
je 0x10002b32
cmp dword [ebp - 0x532], 0x64
jbe 0x10002b32
lea eax, [ebp - 0x526]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000297a
inc dword [ebp - 0x18]
lea eax, [ebp - 0x552]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_FindNextFileA]
or eax, eax
jne 0x10002b01
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 0x18], 0
je 0x10002b93
cmp dword [ebp - 0x14], 0
je 0x10002b93
mov eax, dword [ebp - 0x14]
add eax, 4
push dword [ebp - 0x18]
push eax
call fcn.10002926
or eax, eax
je 0x10002b93
push eax
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.kernel32.dll_lstrcat]
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_lstrcpy]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.100012fb
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x100051b5
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.wininet.dll_HttpSendRequestA]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [ebp + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoA]
cmp eax, 1
jne 0x10005205
cmp dword [ebp - 4], 0xc8
jne 0x10005205
mov eax, dword [ebp - 4]
jmp 0x10005207
xor eax, eax
leave
ret 4
Function at 0x10007bce
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x10007bf7
push 0x10007bde
push 1
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
or eax, eax
je 0x10007d56
mov dword [ebp - 4], eax
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x10007d41
cmp eax, 5
je 0x10007d41
push 0x30
lea eax, [ebp - 0x34]
push eax
call fcn.10001000
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 0x2000
mov dword [ebp - 0x2c], 0x10007d5a
push dword [ebp + 8]
pop dword [ebp - 0x20]
jmp 0x10007c66
mov dword [ebp - 0xc], 0x10007c53
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
pop dword [ebp - 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.user32.dll_RegisterClassExA]
jmp 0x10007ca2
jmp 0x10007cac
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0x10007ca4
push 0x10007c8f
push 0x80
call dword [sym.imp.user32.dll_CreateWindowExA]
push dword [ebp + 0x14]
push dword [0x10058810]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x10058810]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
jne 0x10007d08
jmp 0x10007d1e
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x10007cf2
jmp 0x10007d33
push dword [ebp + 8]
push 0x10007d20
call dword [sym.imp.user32.dll_UnregisterClassA]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x48]
leave
ret 0x10
Function at 0x4016a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4016b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4016f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4016f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4016f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4016e0
cmp esi, eax
jb 0x4016fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402e20
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x80], 0
jne 0x402e6f
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x402b90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x80], eax
jne 0x402e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x402e71
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x403ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e967a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push 0x612c5c
lea edi, [esi + 0x50]
push edi
push eax
push ecx
mov ecx, esi
call fcn.00485370
mov dword [esp + 0x1c], 0
push edi
mov dword [esi], vtable.CMyAsyncReader.2.0
mov dword [esi + 0xc], vtable.CMyAsyncReader.1.0
mov dword [esi + 0x10], vtable.CMyAsyncReader.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x1c], 1
mov edx, dword [esp + 0x2c]
lea ebx, [esi + 0x68]
push edx
mov ecx, ebx
call fcn.004027d0
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x30]
push edi
push ebx
push esi
push eax
lea ecx, [esi + 0xf0]
call fcn.00403ae0
mov byte [esp + 0x1c], 3
lea ecx, [esi + 0x1a0]
call fcn.00486290
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x405bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e9c33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
push 0
call fcn.00485e00
mov dword [esp + 0x14], 0
mov dword [esi + 0x2c], vtable.IGraphEngine.0
push 0xa
lea ecx, [esi + 0x3c]
mov dword [esi], vtable.DSObjects::CBaseGraph.9.0
mov dword [esi + 0xc], vtable.DSObjects::CBaseGraph.8.0
mov dword [esi + 0x10], vtable.DSObjects::CBaseGraph.7.0
mov dword [esi + 0x14], vtable.DSObjects::CBaseGraph.6.0
mov dword [esi + 0x18], vtable.DSObjects::CBaseGraph.5.0
mov dword [esi + 0x1c], vtable.DSObjects::CBaseGraph.4.0
mov dword [esi + 0x20], vtable.DSObjects::CBaseGraph.3.0
mov dword [esi + 0x24], vtable.DSObjects::CBaseGraph.2.0
mov dword [esi + 0x28], vtable.DSObjects::CBaseGraph.1.0
mov dword [esi + 0x2c], vtable.DSObjects::CBaseGraph.0
mov dword [esi + 0x30], 0
call fcn.00405640
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x413770
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4137a1
mov eax, dword [esp + 0xc]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xd
ret 0xc

Function at 0x4137b0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413817
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x4137f3
cmp eax, 2
jne 0x413806
test esi, esi
mov eax, dword [esp + 0x14]
je 0x413813
test eax, eax
je 0x413810
cmp byte [eax + esi - 1], 0
je 0x413813
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x418290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5edde8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00417db0
mov byte [esp + 0x20], 1
mov byte [esp + 0x20], 0
mov ecx, esi
call fcn.004181e0
mov byte [esp + 0x14], 2
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.CGraphCustomFilter.0
mov ecx, dword [eax]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x24], edx
call fcn.004127a0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.004120a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
Function at 0x4183b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ede6b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00417db0
mov byte [esp + 0x20], 2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x28], 1
mov ecx, esi
call fcn.00418290
mov byte [esp + 0x14], 3
lea edx, [esp + 0x24]
push edx
lea ecx, [esi + 0x48]
mov dword [esi], vtable.CGraphFileFilter.0
call fcn.00404170
mov byte [esp + 0x14], 4
xor eax, eax
mov dword [esi + 0x4c], eax
mov byte [esp + 0x14], al
lea ecx, [esp + 0x24]
call fcn.00401aa0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.004120a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x4184f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5edee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00417db0
mov byte [esp + 0x24], 1
mov byte [esp + 0x24], 0
mov ecx, esi
call fcn.004181e0
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x20]
mov dword [esi], vtable.CGraphRendererFilter.0
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x24]
lea edi, [esi + 0x28]
push 0x6144d4
mov ecx, edi
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], eax
call fcn.00412230
push 0x67b350
mov ecx, edi
call fcn.00412230
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.004120a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14
Function at 0x420890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5ef1d6
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6f1550]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x6f1550]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov esi, ecx
mov ecx, dword [esp + 0x70]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.00420670
mov dword [esp + 0x64], 0
push 0xa
lea ecx, [esp + 0x20]
mov dword [esi], vtable.CGraphBuilderDVD.0
call fcn.00411980
mov byte [esp + 0x64], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jl 0x420911
movzx edx, ah
mov dh, al
cmp edx, 0x501
jb 0x420911
mov bl, 1
jmp 0x420913
xor bl, bl
call fcn.005a2d4d
test bl, bl
mov eax, dword [eax + 4]
jne 0x420928
cmp dword [eax + 0x1a8], 2
jne 0x420931
cmp dword [eax + 0x1a8], 1
jne 0x420994
push 0x60
call fcn.0059b02f
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x64], 2
test edi, edi
je 0x420985
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
add eax, 0xffffffff
adc ecx, 0xffffffff
push ecx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Overlay_Mixer
call fcn.00412bf0
mov byte [esp + 0x70], 3
mov edx, dword [esi + 8]
push edx
push 0x6148e4
mov byte [esp + 0x78], 2
mov ecx, edi
call fcn.004184f0
jmp 0x420987
xor eax, eax
mov byte [esp + 0x64], 1
push eax
mov ecx, esi
call fcn.00418ba0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.F50B3F13_19C4_11CF_AA9A_02608C9BABA2
call fcn.00401f00
mov byte [esp + 0x68], 4
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x6c], 1
call fcn.00487ce0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x50], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0xc]
push 0x50
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edx
call fcn.0059b02f
add esp, 0xc
mov dword [esp + 0x10], eax
mov byte [esp + 0x64], 5
test eax, eax
je 0x4209fd
push 0x20
push 0
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.0041a270
jmp 0x4209ff
xor eax, eax
mov byte [esp + 0x64], 1
push eax
mov ecx, esi
call fcn.00418ba0
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x1c]
call fcn.004119b0
mov dword [esp + 0x64], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005bf6a4
add esp, 0x58
ret 8