joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026a634
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10074666
push esi
push 0x2fa
push 0x102b9918
push 0x80070057
call fcn.100048f0
mov dword [esp + 0x10], 0
mov dword [esp + 0x30], 1
mov eax, dword [ecx + 0x84]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x102b8a64
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x100746a3
push 0
push 0x2fd
push 0x102b9918
push eax
call fcn.100048f0
mov dword [esp + 0xc], 0
mov byte [esp + 0x30], 3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
jge 0x100746d7
push 0
push 0x2ff
push 0x102b9918
push eax
call fcn.100048f0
mov dword [esp + 8], 0
mov byte [esp + 0x30], 4
mov ecx, dword [esi]
mov eax, dword [ecx + 0x1c]
lea edx, [esp + 8]
push edx
push esi
call eax
test eax, eax
jge 0x10074707
push 0
push 0x301
push 0x102b9918
push eax
call fcn.100048f0
mov ecx, 9
mov word [esp + 0x14], cx
mov dword [esp + 0x1c], esi
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x30], 5
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [esp + 0x18]
push eax
push ecx
mov ecx, dword [edx + 0x20]
call ecx
test eax, eax
jge 0x10074769
push 0
push 0x303
push 0x102b9918
push eax
call fcn.100048f0
mov byte [esp + 0x30], 4
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x30], 3
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x30], 1
lea ecx, [esp + 0xc]
push ecx
call fcn.100409e0
mov dword [esp + 0x30], 0xffffffff
lea edx, [esp + 0x10]
push edx
call fcn.100409e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100748e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026a5e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x2c]
push edi
call fcn.10079630
mov dword [esp + 0x1c], 0
lea eax, [esi + 0x40]
mov dword [esi], vtable.CConfigSetupElement.0
mov dword [esi + 4], vtable.CConfigSetupElement.1.0
mov dword [esi + 8], vtable.CConfigSetupElement.2.0
mov dword [esi + 0xc], vtable.CConfigSetupElement.3.0
mov dword [esi + 0x10], vtable.CConfigSetupElement.4.0
mov dword [esi + 0x14], vtable.CConfigSetupElement.5.0
mov dword [esi + 0x18], vtable.CConfigSetupElement.6.0
mov dword [esi + 0x1c], vtable.CConfigSetupElement.7.0
mov dword [esi + 0x20], vtable.CConfigSetupElement.8.0
mov dword [esi + 0x24], vtable.CConfigSetupElement.9.0
mov dword [esi + 0x28], vtable.CConfigSetupElement.10.0
mov dword [edi], vtable.CConfigSetupElement.11.0
mov dword [esi + 0x30], vtable.CConfigSetupElement.12.0
mov dword [esp + 0x10], eax
mov dword [eax], 0
mov byte [esp + 0x1c], 3
lea ecx, [esi + 0x48]
call fcn.10002dd0
mov byte [esp + 0x1c], 4
lea ecx, [esi + 0x68]
call fcn.10002dd0
mov byte [esp + 0x1c], 5
lea ecx, [esi + 0x88]
call fcn.10002dd0
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x100749f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1025da60
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x2c]
mov dword [esi], vtable.CConfigSetupElement.0
mov dword [esi + 4], vtable.CConfigSetupElement.1.0
mov dword [esi + 8], vtable.CConfigSetupElement.2.0
mov dword [esi + 0xc], vtable.CConfigSetupElement.3.0
mov dword [esi + 0x10], vtable.CConfigSetupElement.4.0
mov dword [esi + 0x14], vtable.CConfigSetupElement.5.0
mov dword [esi + 0x18], vtable.CConfigSetupElement.6.0
mov dword [esi + 0x1c], vtable.CConfigSetupElement.7.0
mov dword [esi + 0x20], vtable.CConfigSetupElement.8.0
mov dword [esi + 0x24], vtable.CConfigSetupElement.9.0
mov dword [esi + 0x28], vtable.CConfigSetupElement.10.0
mov dword [edi], vtable.CConfigSetupElement.11.0
mov dword [esi + 0x30], vtable.CConfigSetupElement.12.0
mov dword [esp + 0x1c], 3
lea ecx, [esi + 0x88]
call fcn.10002d20
mov byte [esp + 0x1c], 2
lea ecx, [esi + 0x68]
call fcn.10002d20
mov byte [esp + 0x1c], 1
lea ecx, [esi + 0x48]
call fcn.10002d20
xor cl, cl
mov byte [esp + 0x1c], cl
lea eax, [esi + 0x40]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
push eax
call fcn.100409e0
or eax, 0xffffffff
mov dword [esp + 0x1c], eax
mov ecx, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
call fcn.101d3a10
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10074e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026a6a2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x30], 1
mov eax, dword [ecx + 0x30]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jge 0x10074e6d
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov dword [esp + 0xc], 0
mov byte [esp + 0x30], 2
mov esi, dword [ebp + 8]
mov ecx, 9
mov word [esp + 0x14], cx
mov dword [esp + 0x1c], esi
test esi, esi
je 0x10074e97
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x30], 3
mov ecx, dword [esi]
mov eax, dword [ecx + 0x1c]
lea edx, [esp + 0xc]
push edx
push esi
call eax
test eax, eax
jge 0x10074ebc
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [esp + 0x1c]
push eax
push ecx
mov ecx, dword [edx + 0x20]
call ecx
test eax, eax
jge 0x10074f00
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov byte [esp + 0x30], 2
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
call fcn.100409e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10076660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10265fea
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10076697
lea esi, [edi + 4]
jmp 0x10076699
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.1007a830
mov dword [esp + 0x30], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100d72e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10078060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026a41c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10078097
lea esi, [edi + 4]
jmp 0x10078099
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.1006b0c0
mov dword [esp + 0x30], 0
test edi, edi
je 0x100780b4
lea edx, [edi + 0x14]
jmp 0x100780b6
xor edx, edx
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.101d3a10
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100782b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026a41c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100782e7
lea esi, [edi + 4]
jmp 0x100782e9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.1006af50
mov dword [esp + 0x30], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.101d3a10
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100783c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026a41c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100783f7
lea esi, [edi + 4]
jmp 0x100783f9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.1006ade0
mov dword [esp + 0x30], 0
test edi, edi
je 0x10078414
lea edx, [edi + 0x1c]
jmp 0x10078416
xor edx, edx
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.101d3a10
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1007cdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026a20a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov eax, 9
mov dword [esp + 0x18], eax
lea esi, [edi + 0x48]
mov dword [esp + 0xc], esi
mov byte [esp + 0x18], al
call fcn.1007d320
mov byte [esp + 0x18], 8
mov eax, dword [edi + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x18], 7
lea ecx, [edi + 0x40]
call fcn.1003ca30
mov byte [esp + 0x18], 6
lea ecx, [edi + 0x3c]
call fcn.1003ca30
mov byte [esp + 0x18], 5
lea ecx, [edi + 0x38]
call fcn.1003ca30
mov byte [esp + 0x18], 4
lea ecx, [edi + 0x34]
call fcn.1003ca30
mov byte [esp + 0x18], 3
lea ecx, [edi + 0x30]
push ecx
call fcn.100409e0
mov byte [esp + 0x18], 2
lea edx, [edi + 0x2c]
push edx
call fcn.100409e0
mov byte [esp + 0x18], 1
lea eax, [edi + 0x28]
push eax
call fcn.100409e0
mov byte [esp + 0x18], 0
lea ecx, [edi + 0x24]
push ecx
call fcn.100409e0
or ecx, 0xffffffff
mov dword [esp + 0x18], ecx
lea eax, [edi + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
add eax, 4
push eax
call fcn.10056d90
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1007d7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10276012
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.1007db80
mov dword [esp + 0x38], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea eax, [esp + 4]
push eax
push ecx
mov ecx, esi
call edx
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10002d20
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x100813c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026fc51
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp + 8], 0
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
jne 0x10081410
push 0
push 0x89
push str.c:dvsp4_build_sw_relgpu_drvinstaller_core_nvi2EngineCache.h
push 0x80070057
call fcn.100048f0
mov ecx, dword [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
push edx
add ecx, 0x30
call fcn.101e5020
mov dword [esp + 0x14], 1
push eax
mov ecx, esi
call fcn.10056360
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x24]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x10089520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1028138b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x10089566
push ecx
push 0x58d
push str..EngineCache.cpp
push 0x80070057
call fcn.100048f0
lea ecx, [esp + 0xc]
call fcn.10002dd0
mov dword [esp + 0xac], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.100041b0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x100895a9
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov edx, dword [esi]
lea eax, [esp + 0x1c]
mov ecx, 8
push eax
mov word [esp + 0x18], cx
mov ecx, dword [edx + 0x5c]
push esi
mov dword [esp + 0x2c], 2
mov dword [esp + 0x24], 0
call ecx
test eax, eax
jge 0x100895e6
push 0
push 0x590
push str..EngineCache.cpp
push eax
call fcn.100048f0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
call fcn.100555b0
mov byte [esp + 0xac], 1
mov ecx, dword [esp + 0xb4]
lea eax, [esp + 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.10081ae0
mov byte [esp + 0xac], 2
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x34]
call fcn.10055790
mov esi, eax
mov byte [esp + 0xac], 3
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x50]
call fcn.10055790
mov byte [esp + 0xac], 4
mov esi, dword [esi + 0x18]
push esi
lea ecx, [eax + 0x18]
call fcn.100027d0
test eax, eax
sete bl
mov byte [esp + 0xac], 3
lea ecx, [esp + 0x68]
call fcn.10056b10
mov byte [esp + 0xac], 2
lea ecx, [esp + 0x84]
call fcn.10056b10
mov byte [esp + 0xac], 1
lea ecx, [esp + 0x4c]
call fcn.10056b10
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x30]
call fcn.10056b10
mov dword [esp + 0xac], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10002d20
mov al, bl
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xa4
ret 4
Function at 0x10090f90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1025ae4d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0x34]
push edi
call fcn.10091220
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CConfigNviElement.0
mov dword [esi + 4], vtable.CConfigNviElement.1.0
mov dword [esi + 8], vtable.CConfigNviElement.2.0
mov dword [esi + 0xc], vtable.CConfigNviElement.3.0
mov dword [esi + 0x10], vtable.CConfigNviElement.4.0
mov dword [esi + 0x14], vtable.CConfigNviElement.5.0
mov dword [esi + 0x18], vtable.CConfigNviElement.6.0
mov dword [esi + 0x1c], vtable.CConfigNviElement.7.0
mov dword [esi + 0x20], vtable.CConfigNviElement.8.0
mov dword [esi + 0x24], vtable.CConfigNviElement.9.0
mov dword [esi + 0x28], vtable.CConfigNviElement.10.0
mov dword [esi + 0x2c], vtable.CConfigNviElement.11.0
mov dword [esi + 0x30], vtable.CConfigNviElement.12.0
mov dword [edi], vtable.CConfigNviElement.13.0
mov dword [esi + 0x38], vtable.CConfigNviElement.14.0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x10092600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026f878
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.10055370
mov dword [esp + 0x30], 0
mov dword [esp + 0x30], 0xffffffff
call fcn.10051b30
add esp, 0x1c
push 0x102b21e0
push esi
call fcn.1001e560
add esp, 8
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x100932a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102538f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.10055370
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
call fcn.101dee10
mov bl, al
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10056b10
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret
Function at 0x10094330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10273b2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
lea ecx, [esi + 8]
call fcn.10002d80
xor edi, edi
mov dword [esp + 0x18], edi
lea ecx, [esi + 0xc]
call fcn.10002d80
mov byte [esp + 0x18], 1
lea ecx, [esi + 0x10]
call fcn.10002d80
mov byte [esp + 0x18], 2
lea ecx, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call fcn.10002d80
mov byte [esp + 0x18], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.10002d80
mov byte [esp + 0x18], 4
lea ecx, [esi + 0x3c]
call fcn.10002d80
mov byte [esp + 0x18], 5
lea ecx, [esi + 0x48]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.10002d80
mov byte [esp + 0x18], 6
lea ecx, [esi + 0x4c]
call fcn.10056ab0
mov byte [esp + 0x18], 7
lea ecx, [esi + 0x68]
call fcn.10056ab0
mov byte [esp + 0x18], 8
lea ecx, [esi + 0x84]
call fcn.10056ab0
mov byte [esp + 0x18], 9
lea ecx, [esi + 0xa0]
call fcn.10056ab0
mov byte [esp + 0x18], 0xa
lea ecx, [esi + 0xbc]
call fcn.10002d80
mov byte [esp + 0x18], 0xb
lea ecx, [esi + 0xc0]
call fcn.10002d80
mov byte [esp + 0x18], 0xc
lea ecx, [esi + 0xc4]
call fcn.10002d80
mov byte [esp + 0x18], 0xd
lea ecx, [esi + 0xc8]
call fcn.10002d80
mov byte [esp + 0x18], 0xe
lea ecx, [esi + 0xdc]
call fcn.10002d80
mov byte [esp + 0x18], 0xf
lea ecx, [esi + 0xe0]
call fcn.10002d80
mov byte [esp + 0x18], 0x10
lea ecx, [esi + 0xe4]
call fcn.10002d80
mov byte [esp + 0x18], 0x11
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], 0xa
mov byte [esp + 0x18], 0x12
mov eax, dword [esp + 0x24]
push eax
mov ecx, esi
call fcn.101ed710
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x100946e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10273a1f
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 8]
call fcn.10002d80
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea ecx, [esi + 0xc]
call fcn.10002d80
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x10]
call fcn.10002d80
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.10002d80
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
call fcn.10002d80
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x3c]
call fcn.10002d80
mov byte [esp + 0x14], 5
lea ecx, [esi + 0x48]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.10002d80
mov byte [esp + 0x14], 6
lea ecx, [esi + 0x4c]
call fcn.10056ab0
mov byte [esp + 0x14], 7
lea ecx, [esi + 0x68]
call fcn.10056ab0
mov byte [esp + 0x14], 8
lea ecx, [esi + 0x84]
call fcn.10056ab0
mov byte [esp + 0x14], 9
lea ecx, [esi + 0xa0]
call fcn.10056ab0
mov byte [esp + 0x14], 0xa
lea ecx, [esi + 0xbc]
call fcn.10002d80
mov byte [esp + 0x14], 0xb
lea ecx, [esi + 0xc0]
call fcn.10002d80
mov byte [esp + 0x14], 0xc
lea ecx, [esi + 0xc4]
call fcn.10002d80
mov byte [esp + 0x14], 0xd
lea ecx, [esi + 0xc8]
call fcn.10002d80
mov byte [esp + 0x14], 0xe
lea ecx, [esi + 0xdc]
call fcn.10002d80
mov byte [esp + 0x14], 0xf
lea ecx, [esi + 0xe0]
call fcn.10002d80
mov byte [esp + 0x14], 0x10
lea ecx, [esi + 0xe4]
call fcn.10002d80
mov byte [esp + 0x14], 0x11
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], 0xa
mov byte [esp + 0x14], 0x12
or eax, 0xffffffff
mov ecx, 0x800
mov byte [esi + 4], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi], bl
mov byte [esi + 1], bl
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov word [esi + 0xd8], cx
mov dword [esp + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x10096200
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x10096210
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10096220
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc