joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10099bcf
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x28], ebx
jne 0x10099bf4
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [esi + 0x28], eax
test eax, eax
je 0x10099d4e
movsd xmm0, qword [0x10667340]
ucomisd xmm0, qword [0x10334f00]
lahf
test ah, 0x44
jp 0x10099c25
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.100ae067
fstp qword [0x10667340]
mov eax, dword [ebp + 8]
movsd xmm1, qword [0x1033c2f0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10335e70]
lea eax, [ebp - 0x10]
push eax
divsd xmm1, xmm0
movsd qword [ebp - 8], xmm1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.100ae067
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
subsd xmm0, qword [0x10667340]
push ecx
push ecx
divsd xmm0, qword [ebp - 8]
movsd qword [ebp - 0x28], xmm0
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.1029ac48
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
mulsd xmm0, qword [ebp - 8]
pop ecx
pop ecx
push dword [esi + 0x9c]
addsd xmm0, qword [0x10667340]
push dword [esi + 0x98]
movsd qword [ebp - 0x30], xmm0
call fcn.100ae067
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
divsd xmm0, qword [ebp - 8]
push ecx
push ecx
movsd qword [ebp - 0x28], xmm0
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.1029ad63
movsd xmm2, qword [ebp - 8]
movsd xmm1, qword [ebp - 0x30]
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
mulsd xmm0, xmm2
pop ecx
pop ecx
addsd xmm0, qword [0x10667348]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x10099d03
addsd xmm1, xmm2
movsd qword [0x10667348], xmm1
subsd xmm1, qword [ebp - 0x18]
mulsd xmm1, qword [0x1035b850]
movaps xmm0, xmm1
call fcn.102793f6
mov dword [ebp - 0x20], eax
or eax, edx
mov dword [ebp - 0x1c], edx
je 0x10099d46
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1060a5ac
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], ebx
push eax
mov dword [ebp - 0x30], str.bad_allocation
mov dword [ebp - 0x34], vtable.std::bad_alloc.0
call fcn.1027a8f4
int3

Function at 0x100a2b1b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100a2b72
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
add eax, esi
mov dword [ebp + 0xc], edx
push edi
mov edi, eax
xor ecx, ecx
sub edi, esi
mov ebx, 0x15bd
cmp esi, eax
cmova edi, ecx
test edi, edi
je 0x100a2b6d
mov eax, ebx
shr eax, 8
xor al, byte [esi]
movzx ecx, al
add edx, ecx
lea eax, [ecx + ebx]
imul ebx, eax, 0xce6d
mov eax, dword [ebp + 0xc]
add ebx, 0x58bf
inc esi
inc eax
mov dword [ebp + 0xc], eax
cmp eax, edi
jb 0x100a2b46
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret 8
Function at 0x100c392a
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0xd
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
cmp eax, 2
je 0x100c3985
cmp eax, 3
jne 0x100c3999
push 0x30
push 0x10364830
push str.The_filename_or_path_does_not_exist.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret

Function at 0x100c39a7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0xd
push dword [ecx + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea eax, [ebp - 0x20c]
mov edi, 0x10666f58
push eax
mov ecx, edi
call fcn.1007ab01
test al, al
jne 0x100c3a02
push 0x30
push 0x10364830
push str.The_Animation_Library_file_failed_to_load._n_n_Warning_message_
jmp 0x100c3a19
mov ecx, edi
call fcn.10078b3f
test al, al
je 0x100c3a21
push 0x30
push 0x10364830
push str.A_new_class_has_been_added_to_the_Animation_Library._New_classes_cannot_be_loaded_at_runtime._n_nTo_preview_this_change_pin_the_XML_file_and_restart_the_application
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.102790a9
mov esp, ebp
pop ebp
ret

Function at 0x100c3a30
Capabilities:
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0xd
push dword [ecx + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push dword [0x10642768]
push dword [0x10642764]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x100c3a9e
push 0x30
push 0x10364830
push str.The_Animation_Library_file_failed_to_be_pinned.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret

Function at 0x100c3aac
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push str.http:__office_15_teams_OSS_uex_AnimationUsage_default.aspxTypeFormNameScenariosDSPathHome.NavigationSubform
push str.open
push dword [ecx]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x100c3b30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, ecx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0xd
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
test eax, eax
jle 0x100c3b7c
push 1
push dword [edi + 0xc]
call esi
push 1
jmp 0x100c3b85
push 0
push dword [edi + 0xc]
call esi
push 0
push dword [edi + 0x10]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x100c5169
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [esi]
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
call fcn.103048f5
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
push edi
push ebx
push edi
push edi
push 0xa5
push 0xdc
add eax, 0x14
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
push 0x80000
push str.Find_Layer
push str.AirSpyFindWindow
push 0x10000
call fcn.10055444
mov dword [esi + 4], eax
test eax, eax
jne 0x100c51de
xor al, al
jmp 0x100c534e
push edi
push dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x30
push eax
call edi
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
xor ecx, ecx
sub eax, dword [ebp - 0x14]
push ecx
push ebx
push ecx
push dword [esi + 4]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push ecx
push ecx
push 0x50000001
push str.Drag_the_Cross_icon_below_onto_the_layer_to_be_found
push str.Static
push ecx
call fcn.10055444
test eax, eax
je 0x100c51d7
push 0
push dword [esi + 0x10]
push 0x30
push eax
call edi
xor eax, eax
push eax
push ebx
push 0x66
push dword [esi + 4]
push eax
push eax
push 0x32
push 0x55
push 0x50800903
push eax
push str.Static
push eax
call fcn.10055444
mov dword [ebp - 0x28], eax
test eax, eax
je 0x100c51d7
push 0x7f03
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
push 2
push 0x172
push dword [ebp - 0x28]
mov dword [esi + 8], eax
call edi
xor eax, eax
push eax
push ebx
push eax
push dword [esi + 4]
push 0x19
push 0x3c
push 0x5f
push 0xa
push 0x50000000
push str.handle:
push str.Static
push eax
call fcn.10055444
test eax, eax
je 0x100c51d7
push 0
push dword [esi + 0x10]
push 0x30
push eax
call edi
xor eax, eax
push eax
push ebx
push 0x64
push dword [esi + 4]
push 0x19
push 0x50
push 0x5f
push 0x46
push 0x50802000
push eax
push str.Edit
push eax
call fcn.10055444
test eax, eax
je 0x100c51d7
push 0
push dword [esi + 0x10]
push 0x30
push eax
call edi
push 0
push ebx
push 0x65
push dword [esi + 4]
push 0x19
push 0x28
push 0x5f
push 0x9e
push 0x50000001
push str.Find
push 0x103647b0
push 0
call fcn.10055444
test eax, eax
je 0x100c51d7
push 0
push dword [esi + 0x10]
push 0x30
push eax
call edi
push esi
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x64
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x100c8293
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
and dword [edi + 0x1c], 0
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x100c82c0
push ebx
mov ebx, dword [esi]
test ebx, ebx
je 0x100c82b7
mov ecx, ebx
call fcn.100c7bcb
push ebx
call fcn.102a9552
pop ecx
add esi, 4
cmp esi, dword [edi + 4]
jne 0x100c82a3
pop ebx
mov eax, dword [edi]
push 0
mov dword [edi + 4], eax
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [edi + 0x20], 0
mov ecx, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.100c958d
pop edi
pop esi
ret
Function at 0x100e0fe8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c0
mov eax, 0x1031ceb2
call fcn.1027911b
mov edi, ecx
cmp dword [edi + 0x20], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c8], eax
jne 0x100e102e
push 0x10368f20
push 0x3a
lea ecx, [ebp - 0x3b0]
call fcn.100e066f
push 0x1060513c
lea eax, [ebp - 0x3b0]
push eax
call fcn.1027a8f4
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x3b8], 7
mov dword [ebp - 0x3b4], 1
jb 0x100e104c
mov eax, dword [esi]
jmp 0x100e104e
mov eax, esi
lea ecx, [ebp - 0x3b4]
xor ebx, ebx
push ecx
push ebx
lea ecx, [ebp - 0x3b8]
push ecx
push ebx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x100e118a
cmp dword [ebp - 0x3b8], 7
jne 0x100e118a
test ecx, ecx
je 0x100e10a3
push esi
lea eax, [edi + 8]
push eax
push str.ORegistryKey.GetValue_failure:_Cannot_get_registry__s_value__s
push ecx
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.100088e9
jmp 0x100e101d
mov eax, dword [ebp - 0x3b4]
add eax, 2
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3bc], ebx
push eax
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 4], ebx
call fcn.100e1904
mov ebx, dword [ebp - 0x3c0]
sub ebx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c4]
push 0
pop eax
cmove ecx, eax
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x100e10fc
mov eax, dword [esi]
jmp 0x100e10fe
mov eax, esi
lea edx, [ebp - 0x3b4]
push edx
push ecx
lea ecx, [ebp - 0x3b8]
push ecx
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x100e1086
mov edi, dword [ebp - 0x3c8]
xor esi, esi
mov eax, dword [ebp - 0x3c4]
xor ecx, ecx
test ebx, ebx
cmove eax, ecx
lea ecx, [ebp - 0x28]
lea eax, [eax + esi*2]
push eax
call fcn.10006939
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.1000f54f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 0
inc eax
mov byte [ebp - 4], 1
push 1
add esi, eax
call fcn.10007cb3
mov ecx, dword [ebp - 0x3c4]
xor edx, edx
test ebx, ebx
cmove ecx, edx
cmp byte [ecx + esi*2], dl
jne 0x100e112b
lea ecx, [ebp - 0x3c4]
call fcn.100d58ce
mov al, 1
jmp 0x100e118c
xor al, al
call fcn.102790cd
ret 8
Function at 0x100fabe8
Capabilities:
Get user security identifier

Disassembly:
push 0x3d0
mov eax, 0x10320367
call fcn.1027911b
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 8
mov dword [ebp - 0x3d8], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3c4], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], ecx
jb 0x100fac3f
mov eax, dword [edi]
jmp 0x100fac41
mov eax, edi
cmp dword [esi + 0x14], ecx
jb 0x100fac4a
mov ecx, dword [esi]
jmp 0x100fac4c
mov ecx, esi
lea edx, [ebp - 0x3c4]
push edx
lea edx, [ebp - 0x3b4]
push edx
push ebx
lea edx, [ebp - 0x3b8]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100faca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100faca0
push edi
push esi
push str.::LookupAccountNameW_failed_to_retrieve_size_of_account_security_identifier__systemname_s__accountname_s_.
push eax
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.100f9738
push 0x1060513c
lea eax, [ebp - 0x3b0]
push eax
call fcn.1027a8f4
mov eax, dword [ebp - 0x3b4]
lea ecx, [ebp - 0x28]
dec eax
push ebx
push eax
call fcn.1000f5d8
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c8], ebx
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 1
call fcn.100e1904
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x3cc]
cmovae edx, dword [ebp - 0x28]
sub eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3d0]
push 0
pop ecx
cmove eax, ecx
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3d4], eax
jb 0x100fad15
mov ecx, dword [edi]
jmp 0x100fad17
mov ecx, edi
cmp dword [esi + 0x14], 8
jb 0x100fad21
mov eax, dword [esi]
jmp 0x100fad23
mov eax, esi
lea ebx, [ebp - 0x3c4]
push ebx
lea ebx, [ebp - 0x3b4]
push ebx
push edx
lea edx, [ebp - 0x3b8]
push edx
push dword [ebp - 0x3d4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, dword [ebp - 0x3d0]
test eax, eax
jne 0x100fad71
push edi
push esi
push str.::LookupAccountNameW_failed_to_retrieve_account_security_identifier__systemname_s__accountname_s_.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.100f9502
jmp 0x100fac8f
xor eax, eax
lea ecx, [ebp - 0x3bc]
cmp dword [ebp - 0x3c0], eax
cmove ebx, eax
lea eax, [ebp - 0x3c0]
push eax
mov dword [ebp - 0x3c0], ebx
call fcn.100fa999
mov esi, dword [ebp - 0x3d8]
lea ecx, [ebp - 0x3bc]
push esi
mov byte [ebp - 4], 3
call fcn.100fdfff
cmp dword [ebp - 0x3bc], 0
je 0x100fadbe
push dword [ebp - 0x3bc]
call fcn.1015b074
lea ecx, [ebp - 0x3d0]
call fcn.100d58ce
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10007cb3
mov eax, esi
call fcn.102790cd
ret 0xc
Function at 0x100fb15e
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.1000f5d8
cmp dword [esi + 0x14], 8
jb 0x100fb194
mov eax, dword [esi]
jmp 0x100fb196
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x100fb1c9
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.1000f5d8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_get_current_username.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.100084eb
push 0x1060513c
lea eax, [ebp - 0x38c]
push eax
call fcn.1027a8f4
int3

Function at 0x100fe0ed
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x100fe0fe
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x100fe137
mov ecx, dword [ebp - 8]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x1e
shr eax, 0x1e
push eax
push ecx
call fcn.100fe070
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x100fe139
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100ff2ad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push dword [0x10642874]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.10114b4e
test eax, eax
je 0x100ff2d2
xor al, al
jmp 0x100ff32d
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x100ff2dd
mov eax, dword [eax]
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push 2
push esi
push esi
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100ff2ce
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x100ff301
mov eax, dword [eax]
push edi
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
call esi
push dword [ebp - 8]
call esi
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10109134
Capabilities:
Get number of processors

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esi + 0x24c]
call fcn.10007cb3
lea ecx, [esi + 0x238]
call fcn.1000f4f3
push ebx
push edi
lea ecx, [esi + 0x21c]
call fcn.10007cb3
push ebx
push edi
lea ecx, [esi + 0x204]
call fcn.10007cb3
push ebx
push edi
lea ecx, [esi + 0x1ec]
call fcn.10007cb3
push ebx
push edi
lea ecx, [esi + 0x1d4]
call fcn.10007cb3
lea ecx, [esi + 0x1c8]
call fcn.10021c7f
push ebx
push edi
lea ecx, [esi + 0x1b0]
call fcn.10007cb3
push ebx
push edi
lea ecx, [esi + 0x198]
call fcn.10007cb3
push ebx
push edi
lea ecx, [esi + 0x134]
call fcn.10007cb3
lea ecx, [esi + 0x114]
call fcn.10017fa1
lea ecx, [esi + 0xf4]
call fcn.10017fa1
lea ecx, [esi + 0xe8]
call fcn.1012a49c
lea ecx, [esi + 0xdc]
call fcn.100f886d
lea ecx, [esi + 0xd0]
call fcn.10021c2f
lea ecx, [esi + 0x7c]
call fcn.100e0c4a
lea ecx, [esi + 0x70]
call fcn.100e8006
lea ecx, [esi + 0x64]
call fcn.1010a612
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.10100128

Function at 0x1010bcab
Capabilities:
Get number of processors

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x7c]
call fcn.10017fa1
push 0
push 1
lea ecx, [esi + 0x64]
call fcn.10007cb3
mov ecx, esi
pop esi
jmp fcn.10100128
Function at 0x10110862
Capabilities:
Set registry value

Disassembly:
push 0x3e8
mov eax, 0x103236e2
call fcn.1027911b
mov dword [ebp - 0x3ec], ecx
and dword [ebp - 0x3e8], 0
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x3f0], eax
push esi
je 0x101108a5
lea eax, [ebp - 0x58]
push eax
call fcn.1001a661
and dword [ebp - 4], 0
xor edi, edi
inc edi
mov ebx, edi
jmp 0x101108b6
lea ecx, [ebp - 0x40]
call fcn.100068e6
xor edi, edi
inc edi
push 2
mov dword [ebp - 4], edi
pop ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x3e8], ebx
call fcn.100068e6
mov dword [ebp - 4], 2
test bl, 2
je 0x101108df
push 0
push edi
lea ecx, [ebp - 0x40]
and ebx, 0xfffffffd
call fcn.10007cb3
mov byte [ebp - 4], 4
test bl, 1
je 0x101108f3
push 0
push edi
lea ecx, [ebp - 0x58]
call fcn.10007cb3
push esi
lea ecx, [ebp - 0x28]
call fcn.10013982
mov edx, dword [ebp - 0x3ec]
test eax, eax
setne cl
mov byte [ebp - 0x3e1], cl
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x3f4], eax
test eax, eax
jne 0x10110959
test cl, cl
mov edx, 0x10376c14
mov eax, str.EXPAND_SZ
lea ecx, [ebp - 0x3e0]
cmove eax, edx
mov dword [ebp - 0x3ec], eax
lea eax, [ebp - 0x3ec]
push eax
push str.ORegistryKey.SetValue_failure:_Cannot_set___s__string._The_registry_key_is_closed_or_not_set
push 0x3a
call fcn.1010d4ed
push 0x1060513c
lea eax, [ebp - 0x3e0]
push eax
call fcn.1027a8f4
mov ebx, dword [ebp - 0x3f0]
cmp dword [ebx + 0x10], 0x3fff
jbe 0x1011099c
test cl, cl
mov eax, str.EXPAND_SZ
mov esi, 0x10376c14
lea ecx, [ebp - 0x3e0]
cmove eax, esi
mov dword [ebp - 0x3f0], eax
lea eax, [edx + 8]
push eax
lea eax, [ebp - 0x3f0]
push eax
push str.ORegistryKey.SetValue_failure:_Cannot_set___s__string_into_registry_key__s._The_value_name_is_too_long
push 0x1d
call fcn.1010d72f
jmp 0x10110948
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x101109aa
mov edx, 0x10376db0
jmp 0x101109b6
cmp dword [esi + 0x14], 8
jb 0x101109b4
mov edx, dword [esi]
jmp 0x101109b6
mov edx, esi
cmp dword [ebx + 0x14], 8
jb 0x101109c9
mov eax, dword [ebx]
mov dword [ebp - 0x3e8], eax
mov eax, dword [esi + 0x10]
jmp 0x101109cf
mov dword [ebp - 0x3e8], ebx
lea eax, [eax*2 + 2]
push eax
xor eax, eax
test cl, cl
push edx
setne al
inc eax
push eax
push 0
push dword [ebp - 0x3e8]
push dword [ebp - 0x3f4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10110a3e
cmp byte [ebp - 0x3e1], 0
mov edx, 0x10376c14
mov ecx, str.EXPAND_SZ
cmove ecx, edx
mov dword [ebp - 0x3f4], ecx
mov ecx, dword [ebp - 0x3ec]
add ecx, 8
push ecx
push esi
push ebx
lea ecx, [ebp - 0x3f4]
push ecx
push str.ORegistryKey.SetValue_failure:_Cannot_set___s__string_name___s__value___s__into_registry_key__s.
push eax
push 0xf
lea ecx, [ebp - 0x3e0]
call fcn.1010d60b
jmp 0x10110948
push 0
push edi
lea ecx, [ebp - 0x28]
call fcn.10007cb3
call fcn.102790cd
ret 0xc
Function at 0x10110a51
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x10110ae2
cmp dword [esi + 0x10], 0x3fff
jbe 0x10110a8e
push str.ORegistryKey.SetValue_failure:_Cannot_set_DWORD_value._value_name_is_too_long
push 0x1d
lea ecx, [ebp - 0x38c]
call fcn.100145cd
jmp 0x10110af4
cmp dword [esi + 0x14], 8
jb 0x10110a98
mov eax, dword [esi]
jmp 0x10110a9a
mov eax, esi
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10110ad0
lea ecx, [edi + 8]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
push str.ORegistryKey.SetValue_failure:_Cannot_set_DWORD_name___s__value___i__in_registry_key__s
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.1010d449
jmp 0x10110af4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.SetValue_failure:_Cannot_set_DWORD_value._The_registry_key_is_closed_or_not_set
push 0x3a
lea ecx, [ebp - 0x38c]
call fcn.10014732
push 0x1060513c
lea eax, [ebp - 0x38c]
push eax
call fcn.1027a8f4
int3