joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007a1d4
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x100dda2e
call fcn.100ac440
sub esp, 0x24
mov eax, dword [0x10127ec4]
test eax, eax
push edi
mov edi, ecx
mov byte [ebp - 0xd], 0
je 0x1007a2e9
mov ecx, dword [eax]
push esi
push 0x400
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
je 0x1007a2e8
mov eax, 0x2ec
push eax
mov dword [esi + 0x10c], eax
lea eax, [esi + 0x110]
push eax
lea ecx, [ebp - 0x30]
mov dword [esi + 0x104], 0x6000
mov dword [esi + 0x108], 6
call fcn.1000749a
and dword [ebp - 4], 0
lea eax, [edi + 0x84]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1007982b
mov eax, dword [ebp - 0x2b]
sub eax, dword [ebp - 0x2f]
pop ecx
cmp eax, dword [esi + 0x10c]
pop ecx
jae 0x1007a264
mov dword [esi + 0x10c], eax
mov eax, dword [0x10127ec4]
mov ecx, dword [eax]
push esi
push str.vodnet
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x1007a2cc
cmp byte [edi + 0x144], al
je 0x1007a2c6
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [edi + 0xb4]
lea eax, [ebp - 0x14]
push dword [edi + 0x8c]
mov byte [ebp - 4], 1
push str.pps_test_vip_protect_verify_:__powerplayer_post_vodnet_active_usr_respond_uid__d__tokenlen__d_
push eax
call fcn.10001d75
mov esi, dword [ebp - 0x14]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esi - 0x10]
call fcn.10001199
mov byte [ebp - 0xd], 1
jmp 0x1007a2e0
cmp byte [edi + 0x144], 0
je 0x1007a2e0
push str.pps_test_vip_protect_verify_:__powerplayer_post_vodnet_active_usr_failure___
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x23]
call fcn.10059a78
pop esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x1007a8ea
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x100ddabc
call fcn.100ac440
sub esp, 0x50
mov eax, dword [0x1011c710]
push ebx
push esi
xor eax, ebp
mov ebx, ecx
xor esi, esi
cmp dword [ebx + 0x70], esi
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x35], 0
je 0x1007aa67
mov ecx, dword [ebx + 0x80]
cmp ecx, esi
je 0x1007aa67
call fcn.10055311
cmp eax, esi
je 0x1007aa67
cmp dword [0x10127ec4], esi
je 0x1007aa67
push edi
lea edi, [ebx + 0x74]
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
je 0x1007aa66
push edi
lea ecx, [ebp - 0x3c]
call fcn.1000174b
mov eax, dword [0x10127ec4]
mov ecx, dword [eax]
push 0x400
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
je 0x1007aa5b
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x104], 0x2143
mov dword [esi + 0x108], 6
mov dword [esi + 0x10c], 0x2ec
call fcn.10002e95
push dword [ebp - 0x3c]
xor eax, eax
inc eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
call fcn.10002026
mov eax, dword [ebp - 0x18]
add eax, 0xc
push eax
lea eax, [esi + 0x110]
push eax
lea ecx, [ebp - 0x5c]
call fcn.1000749a
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.10079733
mov eax, dword [ebp - 0x57]
sub eax, dword [ebp - 0x5b]
pop ecx
cmp eax, dword [esi + 0x10c]
pop ecx
jae 0x1007a9eb
mov dword [esi + 0x10c], eax
mov eax, dword [0x10127ec4]
mov ecx, dword [eax]
push esi
push str.ppslogin
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x1007aa47
cmp byte [ebx + 0x144], al
je 0x1007aa43
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x40], eax
push dword [edi]
lea eax, [ebp - 0x40]
push str.pps_test_vip_protect_verify_:__powerplayer_post_ppslogin_server_info__s_
push eax
mov byte [ebp - 4], 3
call fcn.10001d75
mov esi, dword [ebp - 0x40]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esi - 0x10]
call fcn.10001199
mov byte [ebp - 0x35], 1
lea ecx, [ebp - 0x4f]
call fcn.10059a78
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100017d0
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.10001199
pop edi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x35]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret
Function at 0x1007ac00
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x100ddaf3
call fcn.100ac440
sub esp, 0x4c
mov eax, dword [0x1011c710]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, ebp
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x70], edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x35], 0
je 0x1007ad53
mov ecx, dword [esi + 0x80]
cmp ecx, edi
je 0x1007ad53
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x1007ad53
call fcn.10055311
cmp eax, edi
je 0x1007ad53
cmp dword [0x10127ec4], edi
je 0x1007ad53
mov ecx, esi
call fcn.1007a8ea
push ebx
lea ecx, [ebp - 0x3c]
call fcn.1000174b
mov eax, dword [0x10127ec4]
mov ecx, dword [eax]
push 0x400
push eax
mov dword [ebp - 4], edi
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jne 0x1007ac94
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
jmp 0x1007ad4e
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x104], 0x1241
mov dword [esi + 0x108], 6
mov dword [esi + 0x10c], 0x2ec
call fcn.10002e95
mov edi, dword [ebp - 0x3c]
xor ebx, ebx
inc ebx
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call fcn.10002026
mov eax, dword [ebp - 0x18]
add eax, 0xc
push eax
lea eax, [esi + 0x110]
push eax
lea ecx, [ebp - 0x58]
call fcn.1000749a
mov eax, dword [ebp - 0x57]
mov dword [ebp - 0x53], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10079733
mov eax, dword [ebp - 0x53]
sub eax, dword [ebp - 0x57]
pop ecx
cmp eax, dword [esi + 0x10c]
pop ecx
jae 0x1007ad15
mov dword [esi + 0x10c], eax
mov eax, dword [0x10127ec4]
mov ecx, dword [eax]
push esi
push str.ppslogin
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x1007ad38
push str._Post_User_Login_Info_Success
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 0x35], bl
lea ecx, [ebp - 0x4b]
call fcn.10059a78
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100017d0
lea ecx, [edi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x35]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 4
Function at 0x1007bec9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x1011c710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
and word [ebp - 0x484], si
and word [ebp - 0x884], si
mov edx, 0xff
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x482]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp dword [ebp + 0xc], esi
mov ecx, edx
lea edi, [ebp - 0x882]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x1007bf25
push 0x100e96bc
push dword [ebp + 0xc]
call fcn.100acdfd
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x888]
push eax
call fcn.100ad218
lea eax, [ebp - 0x888]
push eax
call fcn.100afe43
test eax, eax
pop ecx
pop ecx
jne 0x1007bf57
push 0x100e3808
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1007bf71
push eax
push str._B__d__y__H:_M:_S
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100af24a
add esp, 0x10
test esi, esi
je 0x1007bf97
lea eax, [ebp - 0x84]
push eax
push 0x100f0db0
push esi
call fcn.100afde5
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push esi
call fcn.100afd88
add esp, 0x18
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x484]
push eax
call fcn.100ac587
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x884]
push 0x100f0da0
push eax
call fcn.100acf5b
add esp, 0x18
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
je 0x1007bff0
push 0x100eb370
push esi
call fcn.100afde5
push esi
call fcn.100acbf5
push esi
call fcn.100aca44
add esp, 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.100ac33f
leave
ret
Function at 0x1007cd65
Capabilities:
Parse credit card information

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x1011c710]
mov ecx, dword [ebp + 0x394]
xor eax, ebp
mov dword [ebp + 0x388], eax
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
test eax, eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], eax
je 0x1007ce77
push ebx
xor ebx, ebx
test eax, eax
push esi
lea esi, [ebp - 0x78]
jle 0x1007ce6c
push edi
mov edi, 0x100e6fe0
mov ecx, dword [ebp - 0x7c]
push ebx
call fcn.10020bb8
movsx edx, al
mov ecx, edx
and ecx, 0xff
cmp al, 0x27
jne 0x1007cdca
push 0x27
jmp 0x1007ce47
test cl, cl
js 0x1007ce4a
cmp al, 0x5c
je 0x1007ce4a
cmp al, 0x2f
je 0x1007ce4a
cmp al, 0x3a
je 0x1007ce4a
cmp al, 0x2a
je 0x1007ce4a
cmp al, 0x3f
je 0x1007ce4a
cmp al, 0x3c
je 0x1007ce4a
cmp al, 0x3e
je 0x1007ce4a
cmp al, 0x25
je 0x1007ce4a
cmp al, 0x26
je 0x1007ce4a
cmp al, 0x7c
je 0x1007ce4a
cmp al, 0x20
je 0x1007ce4a
cmp al, 0x2b
je 0x1007ce4a
cmp al, 0x3b
je 0x1007ce4a
cmp al, 0x3d
je 0x1007ce4a
cmp al, 0x5b
je 0x1007ce4a
cmp al, 0x5d
je 0x1007ce4a
cmp al, 0x7b
je 0x1007ce4a
cmp al, 0x7d
je 0x1007ce4a
cmp al, 0x5e
je 0x1007ce4a
cmp al, 0x7e
je 0x1007ce4a
cmp al, 0x60
je 0x1007ce4a
cmp al, 0x40
je 0x1007ce4a
cmp al, 0x21
je 0x1007ce4a
cmp al, 0x24
je 0x1007ce4a
cmp al, 0x22
je 0x1007ce4a
cmp al, 0x2c
je 0x1007ce4a
cmp al, 0x2d
je 0x1007ce4a
cmp al, 0x23
je 0x1007ce4a
cmp al, 0x29
je 0x1007ce4a
cmp al, 0x28
je 0x1007ce4a
push edx
push edi
jmp 0x1007ce50
push ecx
push str.___02X
push esi
call fcn.100acf5b
add esi, eax
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x80]
mov byte [esi], 0
jl 0x1007cdae
mov ecx, dword [ebp - 0x7c]
pop edi
lea eax, [ebp - 0x78]
push eax
call fcn.10001f92
pop esi
pop ebx
mov ecx, dword [ebp + 0x388]
xor ecx, ebp
call fcn.100ac33f
add ebp, 0x38c
leave
ret 4
Function at 0x10080200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3ac]
mov eax, dword [0x1011c710]
mov edx, dword [ebp + 0x3a4]
xor eax, ebp
push ebx
xor ebx, ebx
cmp edx, ebx
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp + 0x3b0]
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ebx
je 0x10080314
push esi
mov esi, dword [eax]
cmp dword [esi - 0xc], ebx
je 0x10080313
push edi
xor eax, eax
mov byte [ebp - 0x68], bl
mov ecx, 0xff
lea edi, [ebp - 0x67]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x6c]
push eax
xor edi, edi
inc edi
push edi
push ebx
push esi
push edx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10080312
cmp dword [ebp - 0x6c], ebx
je 0x10080309
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
je 0x100802ab
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push ebx
push eax
jmp 0x100802bd
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x100e2d52
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10080309
cmp dword [ebp - 0x70], 2
je 0x100802d5
cmp dword [ebp - 0x70], edi
jne 0x10080309
mov eax, dword [ebp - 0x74]
mov byte [ebp + eax - 0x68], bl
lea eax, [ebp - 0x68]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x10080309
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.100ad0b7
test eax, eax
pop ecx
pop ecx
jne 0x10080309
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x68]
push eax
call fcn.10001f92
mov dword [ebp - 0x78], edi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x398]
mov eax, dword [ebp - 0x78]
xor ecx, ebp
pop ebx
call fcn.100ac33f
add ebp, 0x39c
leave
ret 0x10
Function at 0x100825b3
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1011c710]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor eax, ebp
push edi
mov dword [ebp + 0x9c], eax
lea eax, [ebp - 0x78]
push eax
push 0x100e2a10
push 0x80000000
xor edi, edi
call esi
test eax, eax
jne 0x100826f0
push ebx
lea eax, [ebp - 0x74]
push eax
push str.C400B05B_CD0E_4ADF_9381_20A3C672B473
push dword [ebp - 0x78]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x100826ea
lea eax, [ebp - 0x6c]
push eax
push 0x100f13d4
push dword [ebp - 0x74]
call esi
test eax, eax
jne 0x100826e5
mov esi, str.PowerPlayer_of_ppStream
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 1
mov edi, 0x100e2d52
push edi
push dword [ebp - 0x6c]
call esi
lea eax, [ebp - 0x80]
push eax
push 0x100e6a80
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100826a9
lea eax, [ebp - 0x7c]
push eax
push str.win32
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100826a4
call fcn.100cd841
mov eax, dword [eax + 8]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x68]
push eax
call fcn.100ab7d0
pop ecx
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push edi
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
call ebx
push dword [ebp - 0x80]
call ebx
lea eax, [ebp - 0x70]
push eax
push str.FLAGS
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100826dd
push 0x100eb004
call fcn.100ab7d0
pop ecx
push eax
push 0x100eb004
push 1
push edi
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x70]
call ebx
push dword [ebp - 0x6c]
call ebx
xor edi, edi
inc edi
push dword [ebp - 0x74]
call ebx
push dword [ebp - 0x78]
call ebx
pop ebx
mov ecx, dword [ebp + 0x9c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100ac33f
add ebp, 0xa0
leave
ret
Function at 0x10082709
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push str.interface98CB8A58_AF21_45A2_9B41_6626C2F79665
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 0x100e2d52
jne 0x10082755
mov esi, str._DPowerPlayer
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.interface98CB8A58_AF21_45A2_9B41_6626C2F79665ProxyStubClsid
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, str.00020420_0000_0000_C000_000000000046
jne 0x1008278b
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.interface98CB8A58_AF21_45A2_9B41_6626C2F79665ProxyStubClsid32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100827bc
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.interface98CB8A58_AF21_45A2_9B41_6626C2F79665TypeLib
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10082813
mov esi, str.C400B05B_CD0E_4ADF_9381_20A3C672B473
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
mov esi, 0x100f13d4
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push 0
push 0x100f1400
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call ebx
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
pop ecx
ret
Function at 0x1008281c
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push str.Interface5D0CE636_38CD_4AE7_8BEF_D33CE4A01C83
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 0x100e2d52
jne 0x10082868
mov esi, str._DPowerPlayerEvents
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.Interface5D0CE636_38CD_4AE7_8BEF_D33CE4A01C83ProxyStubClsid
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, str.00020420_0000_0000_C000_000000000046
jne 0x1008289e
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.interface5D0CE636_38CD_4AE7_8BEF_D33CE4A01C83ProxyStubClsid32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100828cf
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.interface5D0CE636_38CD_4AE7_8BEF_D33CE4A01C83TypeLib
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10082926
mov esi, str.C400B05B_CD0E_4ADF_9381_20A3C672B473
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
mov esi, 0x100f13d4
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push 0
push 0x100f1400
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call ebx
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
pop ecx
ret
Function at 0x1008292f
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1011c710]
xor eax, esp
push ebx
push ebp
push edi
mov dword [esp + 0x114], eax
lea eax, [esp + 0xc]
push eax
push str.CLSID1AF34165_6CA9_4F08_BC21_49AEDC68D828
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 0x100e2d52
jne 0x1008298f
push esi
mov esi, str.PowerPlayer_Property_Page
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push ebp
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
pop esi
lea eax, [esp + 0xc]
push eax
push str.CLSID1AF34165_6CA9_4F08_BC21_49AEDC68D828InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100829e1
call fcn.100cd841
mov eax, dword [eax + 8]
push 0x104
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push eax
call fcn.100ab7d0
pop ecx
push eax
lea eax, [esp + 0x14]
push eax
push 1
push ebp
push dword [esp + 0x1c]
call edi
push dword [esp + 0xc]
call ebx
mov ecx, dword [esp + 0x114]
pop edi
pop ebp
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.100ac33f
add esp, 0x10c
ret

Function at 0x100829fc
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push str.POWERPLAYER.PowerPlayerCtrl.1
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x100e2d52
jne 0x10082a48
mov ebp, str.PowerPlayer_Control
push ebp
call fcn.100ab7d0
pop ecx
push eax
push ebp
push 1
push esi
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.POWERPLAYER.PowerPlayerCtrl.1CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10082a7e
mov ebp, str.5EC7C511_CD0F_42E6_830C_1BD9882F3458
push ebp
call fcn.100ab7d0
pop ecx
push eax
push ebp
push 1
push esi
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
lea eax, [esp + 0x10]
push eax
push str.POWERPLAYER.PowerPlayerCtrl.1Insertable
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10082aaf
push esi
call fcn.100ab7d0
pop ecx
push eax
push esi
push 1
push esi
push dword [esp + 0x20]
call edi
push dword [esp + 0x10]
call ebx
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
pop ecx
ret
Function at 0x100839f6
Capabilities:
Set registry value

Disassembly:
mov eax, 0x100de69a
call fcn.100ac440
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
xor edi, edi
cmp dword [ebx + 0x6c], esi
mov dword [ebp - 0x1c], ebx
jle 0x10083aed
push edi
lea ecx, [ebx + 0x64]
call fcn.1002cb80
push eax
lea ecx, [ebp - 0x18]
call fcn.1000174b
mov dword [ebp - 4], esi
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
lea eax, [ebp - 0x14]
push str.Search_d
push eax
mov byte [ebp - 4], 1
call fcn.10001d75
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20006
push esi
push str.SoftwarePPStream_recent_
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x10083ac9
push esi
lea ecx, [ebp - 0x18]
call fcn.1000192d
push 0x104
push eax
push 1
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.1000170f
cmp ebx, esi
jne 0x10083ab5
cmp dword [ebp - 0x10], esi
je 0x10083ac6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], esi
je 0x10083ac6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10001199
inc edi
cmp edi, dword [ebx + 0x6c]
jl 0x10083a18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10083afc
Capabilities:
Set registry value

Disassembly:
mov eax, 0x100de6ac
call fcn.100ac440
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push str.Search_d
push eax
call fcn.10001d75
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20006
push esi
push str.SoftwarePPStream_recent_
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [ebp - 0x18]
jne 0x10083b94
push esi
push esi
push 1
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10083b87
cmp dword [ebp - 0x10], esi
je 0x10083b94
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], esi
je 0x10083b94
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jl 0x10083b2f
push 0xffffffffffffffff
push esi
mov esi, dword [ebp - 0x1c]
lea ecx, [esi + 0x64]
call fcn.100c0b0a
mov ecx, esi
call fcn.10083788
lea ecx, [ebx - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret