joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d040
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090388
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea eax, [ebp - 0x222]
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [ebp - 4], 0
push str.mbae_svc.dat
push 0x100e1fb0
push 0x10086350
lea eax, [ebp - 0x224]
push eax
call fcn.10004ed0
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1001d185
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001d11a
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebx + 0x1e]
jmp 0x1001d235
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1001d155
mov byte [esi + 0xffff], 0
push esi
push str.DeleteReportFile
push 1
mov edx, 0x48e
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1001d16d
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebx + 0x1e]
jmp 0x1001d235
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1001d235
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x1001fa10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
test edi, edi
je 0x1001faad
cmp dword [edi], 0x1234abcd
jne 0x1001faad
mov esi, dword [ebp + 0xc]
push ebx
mov esi, dword [esi]
cmp esi, dword [edi + 0x4264]
jge 0x1001fa93
imul ebx, esi, 0xa30
mov eax, dword [ebp + 8]
sub eax, 0
je 0x1001fa66
dec eax
je 0x1001fa5e
dec eax
jne 0x1001fa84
mov eax, dword [edi + 0x426c]
add eax, 0x208
jmp 0x1001fa71
mov eax, dword [edi + 0x426c]
jmp 0x1001fa71
mov eax, dword [edi + 0x426c]
add eax, 0x410
push edx
add eax, ebx
push eax
call fcn.100513c3
add esp, 8
test eax, eax
je 0x1001fa9f
mov edx, dword [ebp - 4]
inc esi
add ebx, 0xa30
cmp esi, dword [edi + 0x4264]
jl 0x1001fa43
pop ebx
pop edi
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x1000a
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001fae1
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
lea eax, [esi + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push 8
test eax, eax
jle 0x1001fb2f
push esi
push str.FindApplication
push 1
mov edx, 0x20a
mov byte [esi + 0xffff], 0
mov ecx, str...StandAloneSvcClientIPC.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024e94
Capabilities:
Delete file

Disassembly:
mov eax, dword [ebp - 0x684]
test eax, eax
je 0x10024eb1
push eax
call fcn.10052152
add esp, 4
mov dword [ebp - 0x684], 0
xor eax, eax
mov word [ebx + 0x64c6], ax
cmp word [ebp - 0x224], ax
je 0x10024ed6
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x688], eax
ret
Function at 0x10025310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090638
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x224]
push eax
lea edx, [ebp - 0x42c]
call fcn.100302f0
add esp, 4
mov edi, eax
test edi, edi
je 0x10025414
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x100253aa
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x10025499
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x100253e5
mov byte [esi + 0xffff], 0
push esi
push str.GetCacheFilesFromFF
push 1
mov edx, 0x2f7
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100253fd
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x10025499
push esi
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x42c]
call fcn.10025660
add esp, 4
mov edi, eax
test edi, edi
je 0x10025490
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
je 0x10025384
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x100253e5
mov byte [esi + 0xffff], 0
push esi
push str.GetCacheFilesFromFF
push 1
mov edx, 0x2fb
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100253fd
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x100254c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090658
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x224]
push eax
xor edx, edx
call fcn.100302f0
add esp, 4
mov edi, eax
test edi, edi
je 0x100255bd
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x10025556
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x10025637
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x10025591
mov byte [esi + 0xffff], 0
push esi
push str.GetCacheFilesFromChrome
push 1
mov edx, 0x30e
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100255a9
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x10025637
mov edx, esi
lea ecx, [ebp - 0x224]
call fcn.10026f80
mov edi, eax
test edi, edi
je 0x1002562e
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
je 0x10025530
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x10025591
mov byte [esi + 0xffff], 0
push esi
push str.GetCacheFilesFromChrome
push 1
mov edx, 0x312
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100255a9
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x1002eea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1009cbc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x210], eax
mov esi, ecx
mov dword [eax], 0
call fcn.10002c40
mov ecx, edi
call fcn.10002c40
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.1002f010
mov ebx, eax
test ebx, ebx
je 0x1002efb3
push 0x1000a
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x1002ef2a
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push ebx
test eax, eax
jle 0x1002ef7f
push esi
push str.ValidateKeyFromID
push 1
mov edx, 0xe5
mov byte [esi + 0xffff], 0
mov ecx, str...StandAloneSvcMisc.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
lea esp, [esp]
mov cx, word [edi]
cmp cx, word [eax]
jne 0x1002efe6
test cx, cx
je 0x1002efe2
mov cx, word [edi + 2]
cmp cx, word [eax + 2]
jne 0x1002efe6
add edi, 4
add eax, 4
test cx, cx
jne 0x1002efc0
xor eax, eax
jmp 0x1002efeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1002effb
mov eax, dword [ebp - 0x210]
mov dword [eax], 1
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x1002f840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090a78
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
push 1
push 0
push str.SOFTWAREMalwarebytes_Anti_Exploit
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002f8f4
test esi, esi
je 0x1002f911
mov dword [ebp - 0x30], 0x208
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x38]
push eax
push 0
push 0x1008d278
push dword [ebp - 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
je 0x1002f917
lea esi, [eax + 0x1e]
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, esi
jmp 0x1002fab3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test ebx, ebx
je 0x1002f93b
mov dword [ebp - 0x30], 0x208
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x38]
push eax
push 0
push 0x1008d280
push dword [ebp - 0x34]
call esi
test eax, eax
jne 0x1002f8f4
test edi, edi
jne 0x1002f959
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
xor eax, eax
jmp 0x1002fab3
mov dword [ebp - 0x30], 0x208
lea eax, [ebp - 0x30]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push 0
push str.UUID
push dword [ebp - 0x34]
call esi
test eax, eax
je 0x1002f9e8
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x1002f8f4
movzx eax, byte [ebp - 0x1d]
push eax
movzx eax, byte [ebp - 0x1e]
push eax
mov ecx, dword [ebp - 0x20]
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0x21]
push eax
movzx eax, byte [ebp - 0x22]
push eax
mov ecx, dword [ebp - 0x24]
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push edi
call fcn.10001ba0
push edi
mov edx, str.UUID
mov ecx, str.SOFTWAREMalwarebytes_Anti_Exploit
call fcn.10030060
add esp, 0x38
test eax, eax
jne 0x1002f8f4
mov dword [ebp - 4], 0
call fcn.1002fa02
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1002fab3
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x10030680
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090b18
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov bl, cl
mov dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x27c], eax
push 0x40
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
call fcn.100309b0
push str.mbae.exe
lea eax, [ebp - 0x224]
push 0x100e2400
test bl, bl
je 0x10030729
push str._s_s__open
jmp 0x1003072e
push 0x10086350
push eax
call fcn.10004ed0
add esp, 0x10
mov dword [ebp - 0x27c], 0x44
mov dword [ebp - 0x274], str.winsta0default
mov eax, 0xa
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x100307a6
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1003088a
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1003088a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x10030813
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1003086f
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1003084e
mov byte [esi + 0xffff], 0
push esi
push str.StartClientApplication
push 1
mov edx, 0x342
mov ecx, str...StandAloneSvcMisc.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10030866
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [ebx + 0x1e]
jmp 0x10030977
mov dword [ebp - 4], 0
call fcn.100308a4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10030977
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x10034520
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090cc8
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov dword [ebp - 0x680], ecx
mov ecx, 0x8b
lea esi, [ebp + 8]
lea edi, [ebp - 0x67c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x44c], 0
push 0x424
push 0
lea eax, [ebp - 0x448]
push eax
call fcn.10055aa0
add esp, 0xc
mov eax, dword [ebp - 0x680]
mov byte [eax], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
push dword [ebp - 0x674]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x684], esi
cmp esi, 0xffffffff
jne 0x100345e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [esi + 0x1e]
jmp 0x10034714
mov dword [ebp - 0x44c], 0x428
lea eax, [ebp - 0x44c]
push eax
push esi
mov edi, dword [sym.imp.KERNEL32.dll_Module32FirstW]
call edi
test eax, eax
jne 0x10034612
lea eax, [ebp - 0x44c]
push eax
push esi
call edi
test eax, eax
je 0x100345c3
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
push ebx
lea eax, [ebp - 0x42c]
push eax
call fcn.100513c3
add esp, 8
test eax, eax
je 0x1003463c
lea eax, [ebp - 0x44c]
push eax
push esi
call edi
test eax, eax
jne 0x10034618
jmp 0x10034645
mov eax, dword [ebp - 0x680]
mov byte [eax], 1
mov dword [ebp - 4], 0
call fcn.10034665
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10034714
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x10036a60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090e08
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
test edi, edi
je 0x10036b99
cmp dword [edi], 0x1234abcd
jne 0x10036b99
lea esi, [edx + 0x14]
push 0x5c
push esi
call fcn.1005276f
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10036acf
mov dword [ebp - 0x1c], esi
xor esi, esi
mov dword [ebp - 0x20], esi
cmp esi, dword [edi + 0x62b8]
jge 0x10036b72
imul ebx, esi, 0x1908
mov eax, dword [edi + 0x62c0]
add eax, 0x658
add eax, ebx
push 0x5c
push eax
call fcn.1005276f
add esp, 8
mov ecx, eax
test ecx, ecx
jne 0x10036b12
mov ecx, dword [edi + 0x62c0]
add ecx, 0x658
add ecx, ebx
mov eax, dword [edi + 0x62c0]
cmp dword [ebx + eax], 0
jne 0x10036b3d
push ecx
push dword [ebp - 0x1c]
call fcn.100513c3
add esp, 8
test eax, eax
jne 0x10036b3d
mov eax, dword [edi + 0x62c0]
mov ecx, dword [ebp + 8]
cmp dword [eax + ebx + 0x10], ecx
je 0x10036b40
inc esi
jmp 0x10036ad1
cmp esi, dword [edi + 0x62b8]
jge 0x10036b72
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call fcn.10036c4d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x10036bc6
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10036c23
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push 8
test eax, eax
jle 0x10036c02
mov byte [esi + 0xffff], 0
push esi
push str.IsReportDuplicatedInApplication
push 1
mov edx, 0x18f
mov ecx, str...StandAloneSvcServerIPC.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10036c1a
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, 8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036d10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x100e2810]
mov esi, edx
test edi, edi
je 0x10036db6
cmp dword [edi], 0x1234abcd
jne 0x10036db6
push 0x5c
push esi
call fcn.1005276f
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x10036d4a
mov ecx, esi
mov dword [ebp - 4], esi
jmp 0x10036d50
add ecx, 2
mov dword [ebp - 4], ecx
xor esi, esi
push ebx
cmp dword [edi + 0x4264], esi
jle 0x10036d8d
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [edi + 0x426c]
add eax, 0x208
add eax, ebx
push eax
push ecx
call fcn.100513c3
add esp, 8
test eax, eax
je 0x10036d96
mov ecx, dword [ebp - 4]
inc esi
add ebx, 0xa30
cmp esi, dword [edi + 0x4264]
jl 0x10036d60
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x426c]
xor eax, eax
imul ecx, esi, 0xa30
pop ebx
pop edi
pop esi
cmp dword [ecx + edx + 0x620], 2
sete al
mov esp, ebp
pop ebp
ret
push 0x1000a
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x10036dea
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
lea eax, [esi + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push 8
test eax, eax
jle 0x10036e38
push esi
push str.IsExcludedProcessFromUI
push 1
mov edx, 0x1b9
mov byte [esi + 0xffff], 0
mov ecx, str...StandAloneSvcServerIPC.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret