joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
shr edi, 1
cmp edi, 0x7fffffff
jbe 0x10060257
mov edi, bind
xor ecx, ecx
mov eax, edi
mov edx, 8
mul edx
seto cl
push 0x10115520
neg ecx
or ecx, eax
push ecx
call fcn.1009ad0c
mov esi, eax
add esp, 8
test esi, esi
jne 0x10060290
call dword [sym.imp.MSVCR100.dll__errno]
pop edi
mov dword [eax], 0xc
or eax, 0xffffffff
pop esi
pop ebp
ret
xor eax, eax
test edi, edi
jle 0x100602b4
lea ecx, [ebp + 0xc]
lea esp, [esp]
mov edx, dword [ecx + 4]
add ecx, 8
mov dword [esi + eax*8 + 4], edx
mov edx, dword [ecx]
mov dword [esi + eax*8], edx
inc eax
cmp eax, edi
jl 0x100602a0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push 0
push 0
push 0
lea ecx, [ebp + 0xc]
push ecx
push edi
push esi
push eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x100602fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], edi
push esi
or edi, 0xffffffff
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x10063d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009d288
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10112018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x10112018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x28]
push ecx
call edx
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x34], edx
mov ebx, dword [eax + 8]
mov dword [esp + 0x38], ebx
mov ebx, dword [eax + 0xc]
add esp, 4
add ecx, dword [edi]
mov dword [esp + 0x38], ebx
mov ebx, dword [eax + 0x10]
adc edx, dword [edi + 4]
mov dword [esp + 0x3c], ebx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], edx
js 0x10063de9
jg 0x10063de2
cmp ecx, 0x7fffffff
jbe 0x10063de9
mov eax, bind
jmp 0x10063deb
mov eax, ecx
mov ecx, dword [edi + 8]
add dword [esp + 0x34], ecx
cdq
xor ebx, ebx
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call sym.ACE.dll_private:_void___thiscall_ACE_Time_Value::normalize_bool_
mov edi, dword [esi + 0xbc]
add edi, 8
push edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x70], ebx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x1c]
push edx
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
mov dword [eax + 4], esi
mov ecx, dword [esi + 0xbc]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
lea edx, [esp + 0x20]
push edx
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10063eab
mov ecx, dword [esi + 0xbc]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [eax]
cmp ecx, dword [esp + 0x2c]
jne 0x10063eb6
mov edx, dword [eax + 4]
cmp edx, dword [esp + 0x30]
jne 0x10063eb6
mov eax, dword [eax + 8]
cmp eax, dword [esp + 0x34]
jne 0x10063eb6
mov ecx, dword [esi + 8]
add ecx, 0x5c
call sym.ACE.dll_public:_int___thiscall_ACE_Event::signal_void_
cmp eax, 0xffffffff
jne 0x10063eb6
mov esi, dword [esi + 0xbc]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 1
push 0
push ebx
mov ecx, esi
call eax
or ebx, 0xffffffff
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [edx + 4], ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.1009acfd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10065a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.100645a2
std
push cs
pushfd
ror dword [ebp - 0x72b7b], 1
call dword [eax - 0x18]
pop ss
jmp 0x10065a99
invalid

Function at 0x10065f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
jne 0x1006611d
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
invalid
movsd dword es:[edi], dword [esi]
invalid

Function at 0x10066290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx]
jne 0x1006632c
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
cmp dword [ebp - 0x6fc], 4
jne 0x100663d6
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.100645a2
fmul qword [eax + 0xb6a2d23]
lea eax, [ebp - 0x7bc]
push eax
call fcn.100645b2
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.10064513
add esp, 0xc
jmp fcn.1006651a
cmp dword [ebp - 0x6fc], 5
jne 0x10066477
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
mov byte [ebp - 0x7ca], 0x3f
and byte [ebp - 0x7c9], 0
mov byte [ebp - 0x7c8], 0x9c
mov byte [ebp - 0x7c7], 0x90
mov byte [ebp - 0x7c6], 0x93
mov byte [ebp - 0x7c5], 0x81
mov byte [ebp - 0x7c4], 0x90
mov byte [ebp - 0x7c3], 0xac
mov byte [ebp - 0x7c2], 0xee
mov byte [ebp - 0x7c1], 0xa4
mov byte [ebp - 0x7c0], 0xac
mov byte [ebp - 0x7bf], 0xac
mov byte [ebp - 0x7be], 0xc0
push 0xb
lea eax, [ebp - 0x7cc]
push eax
call fcn.100645b2
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.10064513
add esp, 0xc
jmp fcn.1006651a
cmp dword [ebp - 0x6fc], 6
invalid
invalid
Function at 0x1006b730
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp + 8]
push edx
push 0
push eax
mov eax, dword [edi]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x1006b795
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [eax + 8]
mov esi, dword [ebx + 0xc]
push ecx
mov ecx, dword [edi]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1006b7a1
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006b7b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push esi
push edi
mov esi, ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call sym.ACE.dll_public:_static_class_ACE_String_Base_char____cdecl_ACE_Registry::make_string_class_ACE_Unbounded_Set_struct_ACE_Registry::Name_Component__const__
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 8]
mov eax, dword [eax + 0xc]
add esp, 8
push edx
mov edx, dword [esi]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1006b7fa
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or esi, 0xffffffff
jmp 0x1006b7fc
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x1006b816
cmp byte [ebp - 4], 0
je 0x1006b816
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov edx, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push edx
call eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1006b820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
push esi
mov esi, dword [eax]
mov eax, dword [eax + 8]
push edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0xc]
push edx
push esi
push eax
mov eax, dword [ecx]
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1006b85c
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x1006b8c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
mov esi, ecx
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp + 8]
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
je 0x1006b906
call dword [sym.imp.MSVCR100.dll__errno]
pop edi
mov dword [eax], ebx
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [eax + 8]
mov edi, dword [edi + 0xc]
push ecx
mov ecx, dword [esi]
push edx
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1006b93d
call dword [sym.imp.MSVCR100.dll__errno]
pop edi
mov dword [eax], esi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006b950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call sym.ACE.dll_public:_static_class_ACE_String_Base_char____cdecl_ACE_Registry::make_string_class_ACE_Unbounded_Set_struct_ACE_Registry::Name_Component__const__
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov eax, dword [eax + 0xc]
add esp, 8
mov dword [ebp + 8], edx
lea edx, [ebp + 8]
push edx
mov edx, dword [esi]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x1006b9c3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
cmp dword [ebp - 0xc], 0
je 0x1006b9b9
cmp byte [ebp - 4], 0
je 0x1006b9b9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
mov edx, dword [edx + 0x10]
push eax
call edx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or esi, 0xffffffff
jmp 0x1006b99f

Function at 0x1006b9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [esi + 4]
push edi
lea edi, [ebp + 0xc]
push edi
push eax
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0xc]
lea eax, [ebp + 8]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x1006ba15
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 8], edx
xor eax, eax
pop esi
pop ebp
ret 8
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], edi
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 8
Function at 0x1006ba30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push esi
mov esi, ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call sym.ACE.dll_public:_static_class_ACE_String_Base_char____cdecl_ACE_Registry::make_string_class_ACE_Unbounded_Set_struct_ACE_Registry::Name_Component__const__
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
add esp, 8
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x1006ba69
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or esi, 0xffffffff
jmp 0x1006ba6b
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x1006ba85
cmp byte [ebp - 4], 0
je 0x1006ba85
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov edx, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1006ba90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ecx]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x1006baba
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1006be10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10112018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call sym.ACE.dll_public:_void___thiscall_ACE_Registry::Naming_Context::constructor_void_
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push ecx
push 0xf003f
mov dword [ebp - 4], 0
mov eax, dword [edi + 0xc]
mov edx, dword [esi]
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x1006be98
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp ecx, edi
je 0x1006be85
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xc]
push 1
push edx
push eax
call sym.ACE.dll_public:_void___thiscall_ACE_String_Base_char_::set_char_const___unsigned_int__bool_
mov eax, dword [edi + 0xc]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
test ebx, ebx
je 0x1006bea5
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], ebx
or esi, 0xffffffff
jmp 0x1006bebc
mov edx, dword [ebp + 0xc]
push 0
push 0xf003f
push 0
push edx
push edi
mov ecx, esi
call sym.ACE.dll_public:_int___thiscall_ACE_Registry::Naming_Context::bind_new_context_class_ACE_String_Base_char__const___class_ACE_Registry::Naming_Context___unsigned_long_int__unsigned_long_int__struct__SECURITY_ATTRIBUTES__
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1006bedf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
test edi, edi
je 0x1006bedf
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], edi
cmp dword [ebp - 0x18], 0
je 0x1006bef9
cmp byte [ebp - 0x10], 0
je 0x1006bef9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006bf10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push esi
mov esi, ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call sym.ACE.dll_public:_static_class_ACE_String_Base_char____cdecl_ACE_Registry::make_string_class_ACE_Unbounded_Set_struct_ACE_Registry::Name_Component__const__
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
add esp, 8
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x1006bf49
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or esi, 0xffffffff
jmp 0x1006bf4b
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x1006bf65
cmp byte [ebp - 4], 0
je 0x1006bf65
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov edx, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1006bf70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ecx]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
je 0x1006bf9a
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1006cf40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10112018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x108], 0x100
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x1006cfb9
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
neg eax
sbb eax, eax
neg eax
dec eax
cmp eax, 0xffffffff
jne 0x1006cfb5
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
pop esi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009acfd
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1006cfa5
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x104]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1006cff7
test al, al
je 0x1006cfde
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1006cff7
add ecx, 2
add edx, 2
test al, al
jne 0x1006cfc2
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009acfd
mov esp, ebp
pop ebp
ret
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009acfd
mov esp, ebp
pop ebp
ret
Function at 0x10070350
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, ecx
jne 0x100703f7
mov eax, dword [ebp + 8]
push 0
push 0x10113018
push 0x101130a4
push 0
push eax
call sub.MSVCR100.dll___RTDynamicCast
add esp, 0x14
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10070395
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret 0xc
push edi
push 0xffff
lea ecx, [esi + 0x1c]
call sym.ACE.dll_public:_int___thiscall_ACE_Pipe::open_int_
cmp eax, 0xffffffff
je 0x100703d7
mov eax, dword [esi + 0x1c]
lea ecx, [ebp + 0x10]
push ecx
push 0x8004667e
push eax
mov dword [ebp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x100703e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.MSVCR100.dll__errno]
mov dword [eax], esi
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0xc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push 1
push esi
push edi
call eax
pop edi
pop esi
pop ebp
ret 0xc
mov dword [esi + 0x18], 0
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x100707c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 8
push edi
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.MSVCR100.dll__errno]
cmp eax, 0xffffffff
jne 0x10070809
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call esi
mov dword [eax], edi
call esi
cmp dword [eax], 0x2733
je 0x10070800
call esi
cmp dword [eax], 0xb
jne 0x1007082c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
test eax, eax
jle 0x100707ef
cmp eax, 8
je 0x10070836
mov esi, 8
sub esi, eax
push 0
push esi
add eax, edi
push eax
push ebx
call sym.ACE.dll_int___cdecl_ACE::recv_n_i_void___void___unsigned_int__unsigned_int__
add esp, 0x10
cmp eax, esi
je 0x10070836
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8

Function at 0x10070f60
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ecx]
push ebx
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x10070fe8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x10070fe8
call esi
mov ebx, dword [sym.imp.MSVCR100.dll__errno]
mov edi, eax
call ebx
mov dword [eax], edi
call esi
mov esi, eax
call ebx
mov eax, dword [eax]
test eax, eax
je 0x10070f9a
mov esi, eax
call sym.ACE.dll_public:_static_class_ACE_Log_Msg____cdecl_ACE_Log_Msg::instance_void_
push 0x100a4a6b
push str.__P_t__Service_Config_failed_to_get_thread_key_value:__p_n
push 0x80
push eax
mov byte [eax + 0x13c], 1
mov dword [eax + 0x140], str.Service_Config.cpp
mov dword [eax + 0x144], 0x44
mov dword [eax + 0x148], 0
mov dword [eax + 0x14c], esi
call sym.ACE.dll_public:_int___cdecl_ACE_Log_Msg::log_enum_ACE_Log_Priority__char_const__
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100715c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a2628
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10112018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x400
call sym.ACE.dll_public:_static_class_ACE_Service_Repository____cdecl_ACE_Service_Repository::instance_unsigned_int_
mov edi, eax
add esp, 4
lea esi, [edi + 0xc]
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x18], 0
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x30], 0
call sym.ACE.dll_protected:_int___thiscall_ACE_Service_Repository::remove_i_char_const__const__class_ACE_Service_Type___
push esi
cmp eax, 0xffffffff
jne 0x10071651
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1007166d
push eax
call fcn.100752d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret