joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x254
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
mov dword [ebp - 0x21c], 6
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call ebx
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebx - 3]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4016dd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d9
test eax, eax
jne 0x401777
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4021e2
sub eax, 0x401780
mov dword [esp], 0x401780
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401777
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401446
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040164f
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ba00
mov dword [esp], 0x40300c
call fcn.00401ee5
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e85
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x1f
call ebx
add byte [esi + edi], 0xef
call ebx
xor byte [esi + edi], 0x85
call ebx
add byte [esi + edi], 0x35
call ebx
add byte [esi + edi], 0xf3
call ebx
add byte [esi + edi], 0xa4
call ebx
add byte [esi + edi], 0x74
call ebx
xor byte [esi + edi], 0x44
call ebx
add byte [esi + edi], 0xd6
call ebx
add byte [esi + edi], 0xc6
call ebx
xor byte [esi + edi], 0x98
call ebx
add byte [esi + edi], 0x2e
call ebx
add byte [esi + edi], 0x47
call ebx
add byte [esi + edi], 0x88
call ebx
add byte [esi + edi], 0xf3
call ebx
add byte [esi + edi], 0x8c
call ebx
xor byte [esi + edi], 0x4d
call ebx
add byte [esi + edi], 0xa5
call ebx
add byte [esi + edi], 0x64
call ebx
add byte [esi + edi], 0xb9
call ebx
add byte [esi + edi], 0x42
call ebx
add byte [esi + edi], 0x70
call ebx
add byte [esi + edi], 0x77
call ebx
add byte [esi + edi], 0x6a
call ebx
add byte [esi + edi], 0x65
call ebx
xor byte [esi + edi], 0xb4
call ebx
add byte [esi + edi], 0xca
call ebx
add byte [esi + edi], 0xf0
call ebx
add byte [esi + edi], 0xe1
call ebx
add byte [esi + edi], 0x3f
call ebx
add byte [esi + edi], 0x5d
call ebx
xor byte [esi + edi], 0x9d
call ebx
xor byte [esi + edi], 0x2e
call ebx
xor byte [esi + edi], 0xdb
call ebx
add byte [esi + edi], 0x3e
call ebx
add byte [esi + edi], 0x3c
call ebx
xor byte [esi + edi], 0x19
call ebx
add byte [esi + edi], 0x11
call ebx
add byte [esi + edi], 0xa5
call ebx
xor byte [esi + edi], 0xa4
call ebx
add byte [esi + edi], 0x32
call ebx
xor byte [esi + edi], 0x6b
call ebx
add byte [esi + edi], 0xd
call ebx
xor byte [esi + edi], 0x7f
call ebx
add byte [esi + edi], 0x2c
call ebx
xor byte [esi + edi], 5
call ebx
add byte [esi + edi], 0x6c
call ebx
add byte [esi + edi], 0x8a
call ebx
add byte [esi + edi], 0xe6
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4460ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f78
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e6
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f90
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f40
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4c
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f7a
Function at 0x10001ea0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20006
push 0
mov esi, ecx
mov dword [ebp - 8], 0
push esi
push 0x80000001
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001f0a
lea eax, ds:[ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001f2b
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002a802
mov esp, ebp
pop ebp
ret

Function at 0x10001f40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1006100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x118]
movss dword [ebp - 0x11c], xmm2
push eax
push 0x20006
push 0
push 0x10065490
push 0x80000001
mov esi, edx
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001fc8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x10065490
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
nop
test eax, eax
jne 0x10002048
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1002c2e0
movss xmm0, dword [ebp - 0x11c]
lea eax, [ebp - 0x110]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push 0x10050390
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013a0
lea ecx, [ebp - 0x110]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002012
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword ds:[ebp - 0x118]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002a802
mov esp, ebp
pop ebp
ret

Function at 0x10002060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1006100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
mov dword [ebp - 0x110], 1
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 2
push esi
push 0x10065490
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov esi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.100387e2
mov ecx, dword [ebp - 4]
add esp, 4
fstp dword [edi]
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.1002a802
mov esp, ebp
pop ebp
ret
Function at 0x10002c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
push 0
push dword [ebp + 0xc]
push 0
push 0
call fcn.10001240
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.10033453
mov edi, eax
add esp, 0x1c
or eax, 0xffffffff
mov ecx, 2
test edi, edi
cmovs edi, eax
xor ebx, ebx
add edi, 2
mov eax, edi
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1002ad6f
add esp, 4
mov dword [esp + 0xc], eax
push ebx
push 0
push eax
call fcn.1002c2e0
add esp, 0xc
lea eax, [ebp + 0x10]
mov edx, edi
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.100012a0
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002ccc
nop
test edi, edi
je 0x10002cc5
mov esi, dword [esp + 0xc]
cmp word [esi], 0
je 0x10002cbc
push 0
push 0
push 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 2
sub edi, 1
jne 0x10002ca8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call fcn.1002a815
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100078e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1006100c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100641c5], 1
push ebx
push esi
push edi
mov edi, ecx
jne 0x10007950
cmp dword [0x10070d00], 0
je 0x10007950
push dword [0x10065bbc]
call dword [0x10065bc0]
add esp, 4
cmp dword [0x10065bbc], 2
jne 0x10007929
mov dword [0x10065bbc], 3
cmp eax, 0x4d2
jne 0x10007938
cmp edx, 0x1100001
je 0x10007950
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10065ab4]
test ecx, ecx
jne 0x10007ac3
push ecx
push 0x80
push 3
push ecx
push 1
push 0x80000000
push 0x100647f0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100079c6
push str.ISteamUser::GetSteamID_____Reading_SteamID_from_ticket_file__r_n
call fcn.10002100
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x100079f3
push str.ISteamUser::GetSteamID_____Unable_to_get_ticket_size__r_n
call fcn.10002100
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0x4d2
mov ecx, dword [ebp - 4]
mov byte [ebp - 9], 1
xor ecx, ebp
mov eax, dword [ebp - 0xc]
and eax, 0xff100001
or eax, 0x100001
mov dword [edi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1002a802
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x10]
push esi
call fcn.1002ad6f
add esp, 4
mov dword [ebp - 0x18], eax
push esi
mov esi, eax
push 0
push esi
call fcn.1002c2e0
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10007a54
push str.ISteamUser::GetSteamID_____Unable_to_read_ticket_file__r_n
call fcn.10002100
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1002a815
add esp, 4
jmp 0x100079c6
cmp dword [ebp - 0x14], 0x30
jae 0x10007a62
push str.ISteamUser::GetSteamID_____Ticket_struct_is_too_big__r_n
nop
jmp 0x10007a31
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
jne 0x10007a8d
push str.ISteamUser::GetSteamID_____Ticket_length_is_0__r_n
call fcn.10002100
add esp, 4
push esi
call fcn.1002a815
add esp, 4
jmp 0x100079c6
mov eax, dword [esi + 8]
test eax, eax
jne 0x10007aaf
push str.ISteamUser::GetSteamID_____SteamID_is_0__r_n
call fcn.10002100
add esp, 4
push esi
call fcn.1002a815
add esp, 4
jmp 0x100079c6
push esi
mov dword [0x10065ab4], eax
call fcn.1002a815
mov ecx, dword [0x10065ab4]
add esp, 4
mov dword [edi], ecx
jmp 0x100079cc
Function at 0x10008200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1006100c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10061a68], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x1000824b
mov eax, dword [0x10061a60]
test eax, eax
je 0x1000824b
cmp eax, 0x3e7
je 0x1000823a
dec eax
mov dword [0x10061a60], eax
test ebx, ebx
jne 0x1000825f
push str.GetStat_int32_Failed_____pchName_is_nullptr__r_n
call fcn.10002100
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
nop
test edi, edi
jne 0x1000826b
push str.GetStat_int32_Failed_____pData_is_nullptr__r_n
jmp 0x10008243
cmp dword [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x10065490
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x10008321
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100082e8
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax + eax]
test esi, esi
je 0x1000836c
push dword [edi]
mov edx, ebx
mov ecx, 0x10065490
call fcn.10001ea0
add esp, 4
test eax, eax
je 0x10008372
push dword [edi]
push ebx
push str.GetStat_int32_Failed______s______d_r_n
call fcn.10002100
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008357
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000836c
push 0
mov edx, ebx
mov ecx, 0x10065490
call fcn.10001ea0
add esp, 4
test eax, eax
jne 0x100082fd
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
Function at 0x100084a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1006100c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10061a68], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x100084f1
cmp byte [ebp + 8], 0
jne 0x100084e0
mov eax, dword [0x10061a64]
test eax, eax
je 0x100084f1
cmp eax, 0x3e7
je 0x100084e0
dec eax
mov dword [0x10061a64], eax
test ebx, ebx
jne 0x10008509
push str.GetAchievement_Failed_____pchName_is_nullptr__r_n
call fcn.10002100
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x10008514
push str.GetAchievement_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x100084e9
cmp byte [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x100657a0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x100085cb
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000858e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10008619
movzx eax, byte [edi]
mov edx, ebx
push eax
mov ecx, 0x100657a0
call fcn.10001ea0
add esp, 4
test eax, eax
je 0x10008623
movzx eax, byte [edi]
push eax
push ebx
push str.GetAchievement_Failed______s______d_r_n
call fcn.10002100
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008604
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax]
test esi, esi
je 0x10008619
push 0
mov edx, ebx
mov ecx, 0x100657a0
call fcn.10001ea0
add esp, 4
test eax, eax
jne 0x100085a5
cmp dword [esp + 0x10], 0
setne al
mov byte [edi], al
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
Function at 0x10008860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x1006100c]
xor eax, esp
mov dword [esp + 0x120], eax
cmp dword [0x10061a68], 1
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
je 0x100088b4
mov eax, dword [0x10061a64]
test eax, eax
je 0x100088b4
cmp eax, 0x3e7
je 0x100088a3
dec eax
mov dword [0x10061a64], eax
test esi, esi
jne 0x100088cb
push str.GetAchievementAndUnlockTime_Failed_____pchName_is_nullptr__r_n
call fcn.10002100
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x100088d6
push str.GetAchievementAndUnlockTime_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x100088ac
test edi, edi
jne 0x100088e2
push str.GetAchievementAndUnlockTime_Failed_____prtTime_is_nullptr__r_n
nop
jmp 0x100088ac
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002100
push 0x104
lea eax, [esp + 0x2c]
mov byte [ebx], 0
push 0
push eax
mov dword [edi], 0
call fcn.1002c2e0
add esp, 0x14
lea eax, [esp + 0x20]
push esi
push str._s_Time
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013a0
add esp, 0x14
mov byte [esp + 0xf], 0
lea edx, [esp + 0xf]
mov ecx, esi
push 1
call fcn.100084a0
add esp, 4
cmp byte [esp + 0xf], 1
jne 0x100089d0
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002100
add esp, 8
mov byte [ebx], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 4
push eax
push 0x20019
push 0
push 0x100657a0
push 0x80000001
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100089d0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100089d0
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x12c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002a802
mov esp, ebp
pop ebp
ret
Function at 0x10023a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jne 0x10023bc7
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
push str.RtlImageNtHeader
push eax
mov dword [0x10065dd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.steamclient.dll
mov dword [0x100643d0], eax
call esi
mov esi, eax
test esi, esi
je 0x10023a98
push esi
call dword [0x100643d0]
push str.xxx____x____x____
push 0x1005a754
mov ecx, esi
mov edx, dword [eax + 0x50]
call fcn.10001d60
add esp, 8
mov dword [0x10070d10], eax
test eax, eax
je 0x10023a98
push ecx
lea edx, [ebp - 0xc]
mov word [ebp - 0xc], 0x18eb
call fcn.10001de0
add esp, 4
lea eax, [ebp - 8]
mov dword [0x100647e8], edi
push eax
push 0
push 2
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10023ad2
push 0x10
push str.GreenLuma_2023
push str.Unable_to_get_exe_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x100658a8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10023b06
push 0x10
push str.GreenLuma_2023
push str.Unable_to_get_exe_path___2_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x10023b2f
push 0x10
push str.GreenLuma_2023
push str.Unable_to_get_exe_path___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x10063fb8
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10023b66
push 0x10
push str.GreenLuma_2023
push str.Unable_to_get_dll_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call esi
cmp eax, 0x7a
jne 0x10023b8e
push 0x10
push str.GreenLuma_2023
push str.Unable_to_get_dll_path___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100658a8
push 0x104
push 0x10066450
call fcn.10034abd
push 0x10063fb8
push 0x104
push 0x10070af8
call fcn.10034abd
add esp, 0x18
xor ecx, ecx
call fcn.10021580
jmp 0x10023c2a
test eax, eax
jne 0x10023c2a
cmp byte [0x10063b95], al
jne 0x10023c2a
call fcn.10025690
cmp dword [0x1007113c], 0
nop
je 0x10023be9
xor ecx, ecx
call fcn.10025600
xor eax, eax
mov ecx, 0x10071138
xchg dword [ecx], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateUserProcess
push dword [0x10065dd8]
call esi
mov ecx, eax
call fcn.10025ae0
push str.NtResumeThread
push dword [0x10065dd8]
call esi
mov ecx, eax
call fcn.10025ae0
call fcn.100256e0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002a802
mov esp, ebp
pop ebp
ret 0xc