joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005aa20
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x38]
cmp edi, dword [esi + 0x3c]
jge 0x1005abb3
mov dword [ebp - 0xc], 4
push ebx
mov edi, edi
lea eax, [edi + 1]
mov dword [esi + 0x38], eax
mov eax, dword [esi]
cmp dword [eax + edi*4], 0xffffffff
je 0x1005aaaa
lea ebx, [esi + 0x10]
test edi, edi
js 0x1005aa5c
mov dword [ebp - 4], ebx
cmp edi, dword [ebx]
jl 0x1005aa81
push str.bitNum___0__bitNum___this__Size__
push 0x14a
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1_bitstring.h
mov dword [ebp - 4], ebx
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x1005aa81
int3
cmp dword [ebx + 4], 1
jne 0x1005aa8c
add ebx, 8
jmp 0x1005aa8f
mov ebx, dword [ebx + 0xc]
mov eax, edi
mov ecx, edi
and ecx, 0x1f
sar eax, 5
mov edx, 1
shl edx, cl
test dword [ebx + eax*4], edx
je 0x1005aaba
mov ecx, dword [ebp - 4]
jmp 0x1005aaad
lea ecx, [esi + 0x10]
mov edi, dword [esi + 0x38]
cmp edi, dword [esi + 0x3c]
jl 0x1005aa40
jmp 0x1005ab9e
mov ebx, dword [ebp - 4]
test edi, edi
js 0x1005aac5
cmp edi, dword [ebx]
jl 0x1005aae1
push str.bitNum___0__bitNum___this__Size__
push 0x154
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1_bitstring.h
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x1005aae1
int3
cmp dword [ebx + 4], 1
jne 0x1005aaec
add ebx, 8
jmp 0x1005aaef
mov ebx, dword [ebx + 0xc]
mov eax, edi
mov ecx, edi
sar eax, 5
and ecx, 0x1f
lea edx, [ebx + eax*4]
mov eax, dword [edx]
bts eax, ecx
mov dword [edx], eax
mov eax, dword [esi]
mov ebx, dword [eax + edi*4]
lea eax, [eax + edi*4]
mov dword [ebp - 4], eax
cmp ebx, 0xffffffff
je 0x1005ab82
mov edx, dword [esi + 0x20]
lea eax, [ebx + ebx*2]
shl eax, 2
add edx, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [edx]
shr ecx, 0x10
xor ecx, dword [edx]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esi + 0xc]
dec eax
and ecx, eax
lea eax, [edx + 8]
mov dword [ebp - 8], ecx
cmp ecx, edi
je 0x1005ab78
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x10]
mov dword [ecx + edx + 8], eax
mov eax, dword [esi]
mov edx, dword [ebp - 8]
mov dword [eax + edx*4], ebx
mov eax, dword [ebp - 4]
jmp 0x1005ab7b
mov dword [ebp - 4], eax
mov ebx, dword [eax]
cmp ebx, 0xffffffff
jne 0x1005ab13
mov edi, dword [esi + 0x38]
cmp edi, dword [esi + 0x3c]
jge 0x1005ab9b
sub dword [ebp - 0xc], 1
jns 0x1005aa40
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
dec eax
push 0
mov dword [esi + 0x40], eax
call fcn.10087450
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005bcb0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 0x34]
jae 0x1005bd9f
mov eax, dword [esi + 0x20]
lea ebx, [edi + edi*2]
cmp dword [eax + ebx*4 + 8], 0xffffffff
jl 0x1005bd9f
call fcn.1005aa20
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax + ebx*4]
shr ecx, 0x10
xor ecx, dword [eax + ebx*4]
mov ebx, dword [esi + 0xc]
imul ecx, ecx, 0x85ebca6b
dec ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, ebx
and eax, ecx
mov dword [ebp - 8], ecx
push eax
mov ecx, esi
call fcn.1005bdd0
test al, al
jne 0x1005bdbb
sar ebx, 1
cmp ebx, dword [esi + 0x40]
jl 0x1005bd93
mov edi, ebx
and edi, dword [ebp - 8]
cmp edi, dword [esi + 0x38]
jl 0x1005bd93
test edi, edi
js 0x1005bd39
cmp edi, dword [esi + 0x10]
jl 0x1005bd55
push str.bitNum___0__bitNum___this__Size__
push 0x14a
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1_bitstring.h
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x1005bd55
int3
cmp dword [esi + 0x14], 1
lea eax, [esi + 0x18]
je 0x1005bd61
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
mov ecx, edi
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov eax, edi
mov ecx, dword [ebp - 4]
sar eax, 5
test dword [ecx + eax*4], edx
jne 0x1005bd93
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.1005bdd0
test al, al
jne 0x1005bdbb
sar ebx, 1
cmp ebx, dword [esi + 0x40]
jge 0x1005bd26
push str.CUtlHashMap::RemoveAt___couldnt_find_bucket_for_item
push 0x380
jmp 0x1005bda9
push str.CUtlHashMap::RemoveAt___Invalid_index
push 0x363
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1utlhashmap.h
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x1005bdbb
int3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005cc20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov dword [esi], vtable.CClientSecureDesktop.0
test eax, eax
je 0x1005cc4e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov edi, dword [esi + 8]
test edi, edi
je 0x1005cc6e
mov ecx, edi
call fcn.10050d10
push 0x18
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 8], 0
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1005cc9b
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
jne 0x1005cc94
mov ecx, edi
call fcn.10060540
push 0x120
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 0xc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005ccb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi], vtable.CClientSecureDesktop.0
test eax, eax
je 0x1005ccdd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x1005ccfe
mov ecx, edi
call fcn.10050d10
push 0x18
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 8], 0
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1005cd2b
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
jne 0x1005cd24
mov ecx, edi
call fcn.10060540
push 0x120
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 0xc], 0
test byte [ebp + 8], 1
pop edi
je 0x1005cd3d
push 0x10
push esi
call fcn.100c15fb
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x1005d098
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov edi, dword [esi + 8]
test edi, edi
je 0x1005d0b8
mov ecx, edi
call fcn.10050d10
push 0x18
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 8], 0
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1005d0e5
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
jne 0x1005d0de
mov ecx, edi
call fcn.10060540
push 0x120
push edi
call fcn.100c15fb
add esp, 8
mov dword [esi + 0xc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005f300
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005f3ef
cmp dword [ecx + 0x10c], 0
je 0x1005f3ef
cmp byte [esi], 0x2e
lea eax, [ebp - 0x100]
jne 0x1005f368
push edi
mov edi, esi
mov edx, 0x100
mov ecx, eax
sub edi, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x1005f359
mov al, byte [edi + ecx]
test al, al
je 0x1005f359
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1005f340
test edx, edx
lea eax, [ecx - 1]
pop edi
cmovne eax, ecx
inc esi
mov byte [eax], 0
jmp 0x1005f37c
push esi
push 0x1024f6c4
push 0x100
push eax
call fcn.1005fb70
add esp, 0x10
push esi
push str._sType
lea eax, [ebp - 0x200]
push 0x100
push eax
call fcn.1005fb70
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [ebp - 0x100]
add esp, 0x10
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x200]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x100]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPropertySystemPropertyHandlers_s
lea eax, [ebp - 0x400]
push 0x200
push eax
call fcn.1005fb70
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1005f400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1005f468
cmp dword [ecx + 0x10c], 0
je 0x1005f468
mov ecx, esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f420
sub ecx, edx
lea edi, [esi - 4]
push 4
add edi, ecx
push str..lnk
push edi
call fcn.100bb950
add esp, 0xc
test eax, eax
je 0x1005f456
push 4
push str..url
push edi
call fcn.100bb950
add esp, 0xc
test eax, eax
jne 0x1005f468
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
pop edi
setne al
pop esi
pop ebp
ret 4
pop edi
xor al, al
pop esi
pop ebp
ret 4
Function at 0x1005f500
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [0x10317168]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1005f5f9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDisableReflectionKey]
test eax, eax
jne 0x1005f5f9
mov edi, dword [ebp + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1005f552
sub edi, ecx
jne 0x1005f56e
push dword [0x10317164]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1005f5a6
lea edi, [edi*2 + 2]
mov eax, edi
call fcn.100c19f0
mov esi, esp
push 0
push edi
push esi
push dword [ebp + 8]
call fcn.100bf010
add esp, 0x10
push edi
push esi
push 1
push 0
push dword [0x10317164]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1005f5f9
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf023f
push 0
push dword [0x10317168]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005f5ec
push dword [0x10317164]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call esi
mov al, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10060e70
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10250110
push 1
push 0
push 0x10250100
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10060ef2
cmp dword [ebp - 4], 0
mov esi, dword [ebp - 8]
push edi
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
je 0x10060ecd
push str.m_pObj__NULL
push 0xc0
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1_smartptr.h
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x10060ecd
int3
lea eax, [ebp - 4]
push eax
push esi
call edi
pop edi
test eax, eax
js 0x10060ef2
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x10060ef2
cmp dword [esi], 0
setne bl
jmp 0x10060ef4
xor bl, bl
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10060f08
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10060f1c
mov dword [ebp - 8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10061f10
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.100c15d0
xor al, al
mov ecx, 0x1024cb86
push ebx
xor ebx, ebx
mov byte [ebp - 1], al
mov byte [ebp - 2], al
mov eax, dword [ebp + 8]
test eax, eax
push esi
cmovne ecx, eax
mov dword [ebp - 0x18], ebx
cmp byte [ebp + 0xc], bl
mov eax, 0xf013f
mov dword [ebp - 0x1c], ecx
mov ecx, 0x20119
cmovne ecx, eax
xor esi, esi
push edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ecx
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push dword [esi + 0x10250858]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10062102
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x122c]
mov dword [ebp - 0xc], 0x1000
push eax
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100620f9
lea esp, [esp]
cmp dword [ebp - 0x10], 1
jne 0x10062019
test ebx, ebx
jne 0x10062005
push 4
push ebx
push ebx
push dword [ebp - 0x1c]
mov byte [ebp - 2], 1
call fcn.100bf010
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.100c192b
push 0
mov ebx, eax
push esi
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
call fcn.100bf010
add esp, 0x24
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.100d2f0a
add esp, 8
test eax, eax
je 0x10062064
xor eax, eax
mov dword [ebp - 0x14], 0x104
mov word [ebp - 0x122c], ax
inc edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1000
push eax
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10061fc0
jmp 0x100620f6
mov al, byte [ebp + 0x10]
xor esi, esi
lea esp, [esp]
test al, al
je 0x10062078
test esi, esi
je 0x100620c8
mov ebx, dword [esi*4 + 0x10317214]
lea eax, [ebp - 0x122c]
push 4
push 0
push 0
push eax
call fcn.100bee50
mov edi, eax
push edi
call fcn.100c192b
push 0
push edi
mov edi, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x122c]
push edi
push eax
call fcn.100bee50
push ebx
push edi
call fcn.100ba090
add esp, 0x2c
test eax, eax
jne 0x100620d0
push edi
call fcn.100c1934
mov al, byte [ebp + 0x10]
add esp, 4
inc esi
cmp esi, 0xf
jb 0x10062070
jmp 0x100620f3
cmp byte [ebp + 0xc], 0
mov byte [ebp - 1], 1
je 0x100620ea
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
call fcn.100c1934
add esp, 4
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x24]
add esi, 4
mov dword [ebp - 8], esi
cmp esi, 8
jb 0x10061f55
cmp byte [ebp - 2], 0
je 0x10062123
push ebx
call fcn.100c1934
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10062900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 0
push dword [ebp + 0xc]
mov byte [ebp - 0x10], 0
mov byte [ebp - 1], 0xf
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test esi, esi
jg 0x1006294f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.string_expansion_failed__1__res__d_GLE__d
push 0xecb
push str.C:_buildworker_steam_rel_client_win32_build_srccommonwindowshelper.cpp
call fcn.100ada00
add esp, 0x14
test al, al
jne 0x10062a3e
int3
mov al, byte [ebp - 1]
push edi
mov edi, 0xf
test al, al
jns 0x10062961
mov ecx, dword [ebp - 0xc]
jmp 0x10062968
movzx eax, al
mov ecx, edi
sub ecx, eax
push esi
push 1
push ecx
lea ecx, [ebp - 0x10]
call fcn.1004bdd0
mov al, byte [ebp - 1]
mov esi, edi
test al, al
cmovs esi, dword [ebp - 8]
jns 0x100629ba
test al, 0x40
je 0x100629a4
push str._m_data.HasError__
push 0x39d
push str.C:_buildworker_steam_rel_client_win32_build_srcpublic_tier1utlstring.h
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x100629a1
int3
mov al, byte [ebp - 1]
test al, al
jns 0x100629ba
test al, 0x40
jne 0x100629b6
test al, al
jns 0x100629ba
cmp dword [ebp - 8], 0
jne 0x100629ba
xor ecx, ecx
jmp 0x100629c3
test al, al
lea ecx, [ebp - 0x10]
cmovs ecx, dword [ebp - 0x10]
push esi
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test esi, esi
jle 0x100629ee
cmp byte [ebp - 1], 0
cmovl edi, dword [ebp - 8]
cmp esi, edi
ja 0x100629ee
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.10077680
jmp 0x10062a3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.string_expansion_failed__2__res__d_GLE__d
push 0xed7
push str.C:_buildworker_steam_rel_client_win32_build_srccommonwindowshelper.cpp
call fcn.100ada00
add esp, 0x14
test al, al
jne 0x10062a12
int3
mov al, byte [ebp - 1]
test al, al
jns 0x10062a32
test al, 0x40
jne 0x10062a3d
test al, al
jns 0x10062a32
call fcn.100ad570
push 0
push dword [ebp - 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0xf
pop edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
call fcn.10076e50
cmp byte [ebp - 1], 0
jge 0x10062a61
call fcn.100ad570
push 0
push dword [ebp - 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10062e30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10062d60
add esp, 0xc
test al, al
je 0x10062e92
mov eax, dword [ebp - 4]
mov ecx, 0x1024cb86
test eax, eax
cmovne ecx, eax
lea eax, [ebp - 0x44]
push ecx
push 0x40
push eax
push 0
push str.DriverVer
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10062e92
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10062e8e
lea eax, [ebp - 0x44]
push eax
call fcn.10077780
mov bl, 1
jmp 0x10062e94
xor bl, bl
call fcn.100ad570
push 0
push dword [ebp - 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10063140
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push str._s.cat
push eax
call fcn.10076ec0
push str.windir
mov dword [ebp - 8], 0
call fcn.100d7a5c
push eax
lea eax, [ebp - 8]
push str._sINF
push eax
call fcn.10076ec0
mov eax, dword [ebp - 8]
mov esi, 0x1024cb86
test eax, eax
mov ecx, esi
cmovne ecx, eax
add esp, 0x18
mov eax, esp
push ecx
lea ecx, [ebp - 0x4a8]
mov dword [eax], str.oem.inf
call fcn.100852c0
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 4], 0
call fcn.10085680
test al, al
je 0x10063257
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ebx, [ebx]
lea ecx, [ebp - 0x4a8]
call fcn.10085ba0
mov ecx, dword [ebp - 8]
mov edx, esi
test ecx, ecx
push eax
cmovne edx, ecx
lea eax, [ebp - 4]
push edx
push 0x1024f6dc
push eax
call fcn.10076ec0
mov eax, dword [ebp - 4]
add esp, 0x10
test eax, eax
mov ecx, esi
cmovne ecx, eax
lea eax, [ebp - 0x8c]
push ecx
push 0x80
push eax
push 0
push str.CatalogFile
push str.Version
call edi
test eax, eax
je 0x10063244
mov eax, dword [ebp - 0xc]
mov ecx, esi
test eax, eax
push SysReAllocString
cmovne ecx, eax
lea eax, [ebp - 0x8c]
push eax
push ecx
call fcn.100bb950
add esp, 0xc
test eax, eax
je 0x100632a0
lea ecx, [ebp - 0x4a8]
call fcn.10085680
test al, al
jne 0x100631d0
xor bl, bl
call fcn.100ad570
push 0
push dword [ebp - 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x4a8]
call fcn.10085450
call fcn.100ad570
push 0
push dword [ebp - 8]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
call fcn.100ad570
push 0
push dword [ebp - 0xc]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100632b5
mov eax, dword [ebp - 4]
test eax, eax
cmovne esi, eax
push esi
call fcn.10077780
mov bl, 1
jmp 0x10063259
Function at 0x10063510
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0
push 2
mov byte [ebx], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10063539
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10063599
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x120], edi
je 0x10063585
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10063558
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebx], 0
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.100cdd00
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebx], 0
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100635b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x100635d1
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
xor esi, esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1006362c
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.100cdee0
add esp, 8
test eax, eax
jne 0x10063616
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x120]
mov dword [ecx + esi*4], eax
inc esi
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1006362b
cmp esi, ebx
jl 0x100635f3
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret