joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479052
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x90
mov eax, 0x4a0bb4
call fcn.00486fc7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x80], eax
call fcn.00403b1e
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0043f7f0
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.00403ecf
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x9c]
call fcn.0043fa10
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x4790ba
mov eax, dword [eax + 4]
jmp 0x4790bd
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.00403ecf
cmp ebx, 3
jne 0x4790e6
test dword [ebp + 0xc], 0x20000
jne 0x479134
cmp ebx, 2
jne 0x4790f4
test dword [ebp + 0xc], 0x10000
jne 0x479134
cmp ebx, 4
jne 0x479102
test dword [ebp + 0xc], 0x40000
jne 0x479134
cmp ebx, 5
jne 0x479110
test dword [ebp + 0xc], 0x80000
jne 0x479134
cmp ebx, 6
jne 0x47911e
test dword [ebp + 0xc], 0x100000
jne 0x479134
cmp ebx, 2
jne 0x4791e0
test dword [ebp + 0xc], 0x200000
je 0x4791e0
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x9c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.0043fa10
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x47915e
mov eax, dword [eax + 4]
jmp 0x479161
add eax, 4
push edi
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.00403ecf
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.00403b1e
mov byte [ebp - 4], 5
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x9c]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0046f861
mov byte [ebp - 4], 7
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.00403ecf
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x68]
push eax
call fcn.00479b18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x68]
push eax
call fcn.00473181
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c1a7
call fcn.0048704a
ret 0xc
Function at 0x47b096
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a6527
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4d7488]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, ecx
push str.AIEXTERNALUI
lea ecx, [esp + 0x30]
call fcn.00403b1e
xor ebx, ebx
mov dword [esp + 0x70], ebx
mov eax, dword [edi + 0xc0]
mov edx, dword [eax + 0x5c]
lea ecx, [esp + 0x48]
push ecx
call fcn.00436be0
pop ecx
mov byte [esp + 0x70], 1
mov ecx, dword [edi + 0xc4]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x30]
push eax
call dword [edx + 0xc]
mov byte [esp + 0x70], bl
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.00403ecf
or dword [esp + 0x70], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00403ecf
mov eax, dword [edi + 0xc0]
mov ecx, dword [eax + 0xa8]
add eax, 0x8c
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x1c]
mov ecx, dword [ecx]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x47b15d
cmp eax, dword [esp + 0x24]
je 0x47b162
call fcn.00482bb3
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x20], eax
je 0x47b19d
lea esi, [esp + 0x1c]
call fcn.00467168
mov dword [esp + 0x18], eax
call fcn.00467168
mov esi, dword [esp + 0x18]
mov ecx, dword [edi + 0xc4]
mov edx, dword [ecx]
add esi, 0x1c
push esi
push eax
call dword [edx + 0xc]
lea esi, [esp + 0x1c]
call fcn.0042344f
jmp 0x47b14f
mov esi, str.PRIMARYFOLDER
push esi
lea ecx, [esp + 0x30]
call fcn.00403b1e
mov dword [esp + 0x70], 2
mov ecx, dword [edi + 0xc4]
mov eax, dword [ecx]
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x4c]
push edx
call dword [eax]
mov byte [esp + 0x70], 3
cmp dword [eax + 0x14], ebx
sete byte [esp + 0x17]
mov byte [esp + 0x70], 2
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.00403ecf
or dword [esp + 0x70], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00403ecf
cmp byte [esp + 0x17], bl
je 0x47b25b
push str.APPDIR
lea ecx, [esp + 0x4c]
call fcn.00403b1e
mov dword [esp + 0x70], 4
push esi
lea ecx, [esp + 0x30]
call fcn.00403b1e
mov byte [esp + 0x70], 5
mov edi, dword [edi + 0xc4]
mov eax, dword [edi]
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov byte [esp + 0x70], 4
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00403ecf
or dword [esp + 0x70], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.00403ecf
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c452
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x48]
test al, al
jne 0x47c495
movzx eax, byte [esi + 4]
mov ecx, dword [esi]
neg eax
sbb eax, eax
and eax, 5
push eax
mov eax, dword [ecx]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 4], 0
je 0x47c495
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x84]
test al, al
je 0x47c495
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x80]
mov al, 1
ret

Function at 0x47c556
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4a350a
call fcn.00486fc7
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x270]
call fcn.00403b1e
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x270]
call fcn.0043f7f0
mov byte [ebp - 4], 2
push esi
push 1
lea ecx, [ebp - 0x270]
call fcn.00403ecf
push 0x4b8960
lea ecx, [ebp - 0x270]
call fcn.00403b1e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x270]
push eax
lea ebx, [ebp - 0x238]
call fcn.0040c427
mov byte [ebp - 4], 2
push esi
push 1
lea ecx, [ebp - 0x270]
call fcn.00403ecf
lea eax, [ebp - 0x254]
push eax
call fcn.004411c0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x248]
sar eax, 1
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x234]
jae 0x47c633
lea eax, [ebp - 0x234]
push esi
push esi
lea ecx, [ebp - 0x23c]
push ecx
push esi
push eax
call sub.msi.dll_MsiMessageBoxW
mov eax, dword [ebp - 0x23c]
inc eax
lea ecx, [ebp - 0x254]
call fcn.004407a0
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x248]
sar eax, 1
jne 0x47c66a
call fcn.00482bb3
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x47c67f
lea eax, [ebp - 0x234]
push esi
push esi
lea ecx, [ebp - 0x23c]
push ecx
push dword [ebp - 0x248]
push eax
call sub.msi.dll_MsiMessageBoxW
xor ebx, ebx
xor edi, edi
cmp edi, dword [ebp - 0x23c]
jae 0x47c6c6
lea esi, [ebp - 0x254]
call fcn.00440680
cmp word [eax], 0x2e
je 0x47c6c0
call fcn.00440680
imul ebx, ebx, 0xa
movzx eax, word [eax]
lea ebx, [ebx + eax - 0x30]
inc edi
cmp edi, 3
jb 0x47c698
imul ebx, ebx, 0xa
mov byte [ebp - 4], 2
lea eax, [ebp - 0x254]
push eax
call fcn.00440610
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x238]
push eax
call fcn.0040c1a7
mov eax, ebx
call fcn.0048704a
ret
Function at 0x47eeb8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0ab6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d7488]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0xec]
mov dword [esp + 0x1c], eax
inc dword [eax]
mov byte [esp + 0x20], 0
and dword [esp + 0x38], 0
lea edi, [ecx + 0xf0]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x24]
call fcn.0046752f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x24]
call fcn.0046752f
mov esi, dword [esp + 0x14]
test esi, esi
je 0x47ef39
cmp esi, dword [esp + 0x24]
je 0x47ef3e
call fcn.00482bb3
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esp + 0x28]
je 0x47ef89
test esi, esi
jne 0x47ef81
call fcn.00482bb3
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x47ef5d
call fcn.00482bb3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax]
test esi, esi
jne 0x47ef85
call fcn.00482bb3
cmp ebx, dword [esi + 0x10]
jb 0x47ef78
call fcn.00482bb3
add ebx, 0x4c
mov dword [esp + 0x18], ebx
jmp 0x47ef1f
mov eax, dword [esi]
jmp 0x47ef53
mov esi, dword [esi]
jmp 0x47ef6e
mov eax, edi
call fcn.0047f1ab
or dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x1c]
dec dword [eax]
mov byte [esp + 0x20], 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4812ab
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x4a4c67
call fcn.00486fc7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x60], esi
mov edi, edx
mov dword [ebp - 0x5c], ebx
call fcn.0040529d
push dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 4], ebx
push esi
inc ebx
push edi
mov dword [ebp - 0x5c], ebx
call fcn.0048106b
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x481306
mov eax, dword [esi + 4]
jmp 0x481309
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4813df
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.0043f7f0
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.00440500
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043f7f0
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 4
call fcn.00473181
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x48]
call fcn.004403c0
mov edi, eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.004403c0
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00405130
xor edi, edi
push edi
push ebx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 5
call fcn.00403ecf
push edi
push ebx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 4
call fcn.00403ecf
cmp byte [ebp - 0x49], 0
je 0x4813c6
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4813ad
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4813c6
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00403dd9
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.0040c1a7
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0
call fcn.0040c1a7
mov eax, esi
call fcn.0048704a
ret

Function at 0x481b0c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4d9698], 0
push esi
jne 0x481a7f
call fcn.004819a5
test eax, eax
je 0x481ac2
mov eax, dword [0x4d9698]
cmp eax, 1
jne 0x481aa0
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x481ac2
pop esi
ret
push eax
call dword [0x4d96a0]
test eax, eax
jne 0x481b0a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x481ac6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4d9698]
call dword [0x4d96a0]
mov edi, eax
test edi, edi
je 0x481aeb
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x481b07
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4d9698]
call dword [0x4d969c]
add edi, 0x10
cmp edi, esi
jb 0x481af3
mov eax, edi
pop edi
pop esi
ret
jmp 0x481a6c

Function at 0x48297b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d7488]
jne 0x482985
repz ret
jmp fcn.00489d9c
Function at 0x493deb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00485d3c
and dword [ebp - 4], 0
cmp dword [0x4da550], 0
mov ebx, eax
jne 0x493e9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x493f4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x493f4d
push eax
call fcn.00485cca
mov dword [esp], 0x4b0de8
push edi
mov dword [0x4da550], eax
call esi
push eax
call fcn.00485cca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4da554], eax
call esi
push eax
call fcn.00485cca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4da558], eax
call esi
push eax
call fcn.00485cca
pop ecx
mov dword [0x4da560], eax
test eax, eax
je 0x493e9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00485cca
pop ecx
mov dword [0x4da55c], eax
mov eax, dword [0x4da55c]
cmp eax, ebx
je 0x493ef4
cmp dword [0x4da560], ebx
je 0x493ef4
push eax
call fcn.00485d45
push dword [0x4da560]
mov esi, eax
call fcn.00485d45
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x493ef4
test edi, edi
je 0x493ef4
call esi
test eax, eax
je 0x493eeb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x493eeb
test byte [ebp - 0xc], 1
jne 0x493ef4
or dword [ebp + 0x10], 0x200000
jmp 0x493f2d
mov eax, dword [0x4da554]
cmp eax, ebx
je 0x493f2d
push eax
call fcn.00485d45
pop ecx
test eax, eax
je 0x493f2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x493f2d
mov eax, dword [0x4da558]
cmp eax, ebx
je 0x493f2d
push eax
call fcn.00485d45
pop ecx
test eax, eax
je 0x493f2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4da550]
call fcn.00485d45
pop ecx
test eax, eax
je 0x493f4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x493f4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100314c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x10031584
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100b8319
add esp, 4
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax + 1]
shl eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10031512
xor eax, eax
jmp 0x10031587
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
je 0x10031548
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov word [ecx + eax*2], 0x5c
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
jmp 0x1003155a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100b8319
add esp, 4
cmp dword [ebp - 4], eax
jae 0x10031584
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov cx, word [esi + ecx*2]
mov word [eax + edx*2], cx
jmp 0x10031551
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100352d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1010a944]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c88]
test byte [eax], 0x10
je 0x10035337
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.100a7070
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.100384e0
add esp, 0x1c
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x100f4038
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a647f
mov esp, ebp
pop ebp
ret
Function at 0x10051bb0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ce72e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
lea esi, [edi + 0xa4]
mov dword [edi + 0x64], 1
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], eax
mov dword [edi + 0x90], 0x3f800000
mov dword [edi + 0x94], 0x3f800000
mov dword [edi + 0x98], 0x3f800000
mov dword [edi + 0x9c], 0x3f800000
mov dword [edi + 0xa0], eax
push 0x2c
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.100a573e
add esp, 0x14
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x34], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x44], 0xffffffff
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0
call fcn.1008fef0
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov word [edi + 0x38], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0xa0], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10052860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x20
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], 7
push eax
push str.SteamGameId
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100528e4
cmp eax, 0x20
jae 0x100528e4
push 0xa
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.100b5342
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], edx
push 0x20
push eax
push str.SteamOverlayGameId
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100528d3
cmp eax, 0x20
jae 0x100528d3
push 0xa
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.100b5342
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [0x1011f99c]
lea edx, [ebp - 0x14]
push 0x14
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x10054260
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [esi - 2]
test edx, edx
je 0x100542fd
mov esi, dword [ebp + 0xc]
dec edx
mov eax, 0xaaaaaaab
add esi, 2
mul edx
mov edi, edx
shr edi, 1
inc edi
lea ebx, [edi + edi*2]
movzx eax, byte [esi - 2]
lea esi, [esi + 3]
shr eax, 2
movzx eax, byte [eax + 0x100d5e40]
mov byte [ecx], al
movsx edx, byte [esi - 5]
movzx eax, byte [esi - 4]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x100d5e40]
mov byte [ecx + 1], al
movsx eax, byte [esi - 4]
movzx edx, byte [esi - 3]
and eax, 0xf
shl eax, 2
shr edx, 6
or edx, eax
movzx eax, byte [edx + 0x100d5e40]
mov byte [ecx + 2], al
movsx eax, byte [esi - 3]
and eax, 0x3f
movzx eax, byte [eax + 0x100d5e40]
mov byte [ecx + 3], al
add ecx, 4
sub edi, 1
jne 0x10054291
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp ebx, esi
jae 0x10054360
mov edx, dword [ebp + 0xc]
movzx eax, byte [ebx + edx]
shr eax, 2
mov al, byte [eax + 0x100d5e40]
mov byte [ecx], al
lea eax, [esi - 1]
movsx edx, byte [ebx + edx]
and edx, 3
shl edx, 4
cmp ebx, eax
jne 0x10054331
mov al, byte [edx + 0x100d5e40]
mov dl, 0x3d
mov byte [ecx + 1], al
jmp 0x10054356
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebx + esi + 1]
shr eax, 4
or eax, edx
mov al, byte [eax + 0x100d5e40]
mov byte [ecx + 1], al
movsx eax, byte [ebx + esi + 1]
and eax, 0xf
mov dl, byte [eax*4 + 0x100d5e40]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
add ecx, 4
mov byte [ecx], 0
sub ecx, edi
pop edi
pop esi
pop ebx
lea eax, [ecx + 1]
pop ebp
ret
Function at 0x10054370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005439b
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
lea eax, [edi + edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push str.InstallPath
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100543ea
cmp esi, 0xea
je 0x100543ea
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea ecx, [edi + 2]
lea edx, [eax + eax]
shr eax, 1
cmp edx, ecx
jb 0x10054401
pop edi
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov eax, dword [ebp - 4]
pop edi
pop esi
shr eax, 1
pop ebx
mov esp, ebp
pop ebp
ret