joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ade37
mov eax, dword fs:[0]
push eax
sub esp, 0x910
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x918], esi
cmp dword [eax + 0x14], 0x10
jb 0x1003c0b3
mov eax, dword [eax]
push 0xfde9
push eax
lea ecx, [ebp - 0x914]
call fcn.10038ad0
push dword [eax]
lea ecx, [ebp - 0x91c]
mov dword [ebp - 4], 0
call fcn.10012420
mov eax, dword [ebp - 0x914]
lea ecx, [ebp - 0x910]
mov byte [ebp - 4], 2
cmp eax, ecx
je 0x1003c0f5
push eax
call fcn.10083bc1
add esp, 4
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.100805f0
add esp, 0xc
lea eax, [ebp - 0x810]
push dword [edi]
push 0x400
push eax
push 0x100b6050
push 0x100b9a2c
push dword [ebp - 0x91c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c140
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jae 0x1003c1c4
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1003c2aa
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x100b6050
mov byte [ebp - 4], 3
mov ecx, esi
test eax, 0xffff0000
jne 0x1003c18a
movzx eax, ax
push eax
call fcn.1000baf0
jmp 0x1003c196
push 0
push 0x100b6050
call fcn.10017410
mov edi, dword [ebp - 0x91c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003c28b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x1003c28b
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1003c2b4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x918], eax
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x1003c203
movzx eax, ax
lea ecx, [ebp - 0x918]
push eax
call fcn.1000baf0
jmp 0x1003c232
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c210
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x918]
call fcn.10017410
lea eax, [ebp - 0x918]
mov byte [ebp - 4], 5
push eax
push esi
mov ecx, edi
call fcn.10039230
mov edx, dword [ebp - 0x918]
or edi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003c269
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x91c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1003c28b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.1000a5d0
push 0x80004005
call fcn.1000a5d0
int3
Function at 0x1003cab0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a823b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.100607f0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003cbf9
push 0x7d
push str.d:jenkins.jenkinsworkspacemaster_lu_benchmark_suite_benchmark_suite_aimarkbenchmarksuite_benchmarksuitehelperconfig.cpp
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000eb90
push 3
push 0x100b5ad0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000eb90
mov byte [ebp - 4], 1
call fcn.100607f0
mov edi, eax
lea ecx, [ebp - 0xd8]
push 0x73
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100087f0
mov esi, eax
push str.ResetScoreAndRank
push esi
mov byte [ebp - 4], 2
call fcn.10009970
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd8]
call fcn.10009b90
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1003cbb7
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003cbad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003cc1d
push edx
push ecx
call fcn.1007559a
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x1003cbf9
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003cbef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003cc22
push edx
push ecx
call fcn.1007559a
add esp, 8
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret
call fcn.10083519
call fcn.10083519
int3
Function at 0x10046ec0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x10046ee4
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x10046f50
push 0
push 0
call fcn.10091dc4
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret
Function at 0x1004a080
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af9f6
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100805f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1004a101
lea eax, [ebp - 0x218]
push eax
call ebx
sub esi, 1
jne 0x1004a0f3
push str.netul.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1004a271
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x1004a155
movzx eax, ax
lea ecx, [ebp - 0x21c]
push eax
call fcn.1000baf0
jmp 0x1004a182
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004a160
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.10017410
mov esi, dword [ebp - 0x21c]
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004a19e
mov bl, 1
jmp 0x1004a1ac
push esi
call fcn.10054e50
add esp, 4
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004a1cb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x1004a251
cmp dword [edi], 0
jne 0x1004a238
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x1004a251
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x1004a238
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x1004a251
cmp dword [edi + 4], 0
je 0x1004a251
cmp dword [edi + 0xc], 0
je 0x1004a251
mov eax, 1
jmp 0x1004a253
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.1000a5d0
int3
Function at 0x1004f3c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
je 0x1004f4a1
test eax, eax
je 0x1004f4a1
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1004f4a1
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x1004f4a1
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1004f48c
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call fcn.10091e9a
add esp, 0xc
test eax, eax
je 0x1004f4b4
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x1004f430
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1004f502
cmp edi, 0x7fffffff
ja 0x1004f502
mov ecx, dword [ebp - 0x4c0]
lea ebx, [ebp - 0xc]
mov esi, 0x7ffffffe
mov edx, edi
sub esi, edi
sub ebx, ecx
lea eax, [esi + edx]
test eax, eax
je 0x1004f4ef
movzx eax, word [ebx + ecx]
test ax, ax
je 0x1004f4ef
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1004f4d4
mov ebx, dword [ebp - 0x4c8]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor ecx, ecx
test edi, edi
je 0x1004f510
cmp edi, 0x7fffffff
jbe 0x1004f515
mov ecx, 0x80070057
test ecx, ecx
js 0x1004f54b
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x1004f533
cmp word [eax], 0
je 0x1004f533
add eax, 2
sub esi, 1
jne 0x1004f525
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x1004f54d
xor esi, esi
test ecx, ecx
js 0x1004f59e
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x1004f591
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7fffffff
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x1004f591
movzx eax, word [edi + ecx]
test ax, ax
je 0x1004f591
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x1004f578
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007590b
mov esp, ebp
pop ebp
ret
Function at 0x100507e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10050858
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret
Function at 0x10050d10
Capabilities:
Check if file exists
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d6f28
push 0x10080ad0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3a14
call fcn.100759e0
mov eax, dword [0x100de514]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3a2c], esi
test esi, esi
je 0x10050f88
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10050f88
mov dword [ebp - 4], 0
call fcn.100507e0
mov dword [ebp - 4], 0xfffffffe
jmp 0x10050d9b
push 0x800
push 0
lea eax, [ebp - 0x1224]
push eax
call fcn.100805f0
mov dword [ebp - 0x3a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x3a24]
push eax
call fcn.100805f0
add esp, 0x18
lea eax, [ebp - 0x3a28]
push eax
push 0x800
lea eax, [ebp - 0x3a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10050f88
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.100805f0
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.10091e57
lea eax, [ebp - 0x224]
push eax
call fcn.10091bcd
add esp, 0x1c
xor edi, edi
cmp dword [ebp - 0x3a28], edi
jbe 0x10050f88
mov ebx, dword [ebp + edi*4 - 0x3a24]
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10050e62
push ebx
push eax
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10050f7b
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.100805f0
add esp, 0xc
xor ebx, ebx
push 0x400
lea eax, [ebp - 0xa24]
push eax
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x10050f17
mov ebx, 1
push 0x800
push 0
lea eax, [ebp - 0x1a24]
push eax
call fcn.100805f0
push 0x7e
lea eax, [ebp - 0xa24]
push eax
call fcn.100809c6
add esp, 0x14
test eax, eax
je 0x10050efd
push 0x400
lea eax, [ebp - 0x1a24]
push eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x10050efd
push 0x400
lea eax, [ebp - 0x1a24]
push eax
lea eax, [ebp - 0x1224]
push eax
call fcn.10091e57
jmp 0x10050f47
push 0x400
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x1224]
push eax
call fcn.10091e57
jmp 0x10050f47
push 0x400
lea eax, [ebp - 0xa24]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10050f4a
push 0x400
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0xa24]
push eax
call fcn.1004f3c0
mov ebx, eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10050f7b
lea eax, [ebp - 0x1224]
push eax
call fcn.10091bcd
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1008f903
add esp, 0xc
test eax, eax
je 0x10050fa6
inc edi
cmp edi, dword [ebp - 0x3a28]
jb 0x10050e30
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret
mov eax, 1
jmp 0x10050f8a
Function at 0x10057820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0ef1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x100579b4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10057975
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10057967
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10057975
add eax, 0x10
push 0x100e0c62
push eax
mov dword [ebp - 0x20], eax
call fcn.10075cc8
mov esi, eax
add esp, 8
test esi, esi
je 0x10057975
push dword [ebp - 0x20]
push 0
push esi
call fcn.100805f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1005792a
push esi
call fcn.10075ac8
add esp, 4
jmp 0x10057975
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057930
sub ecx, edx
sar ecx, 1
je 0x1005795e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057946
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.10017410
push esi
call fcn.10075ac8
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10057975
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10057994
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007590b
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.1000a5d0
int3
Function at 0x100579c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100de514]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100579e4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x10057a46
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x10057a46
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10057a61
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007590b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1005fc30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b14fa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100de514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1005fdf4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1005fdfe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.1000ac40
mov ecx, eax
test ecx, ecx
je 0x1005fe08
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1005fd12
xor ecx, ecx
jmp 0x1005fd30
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005fd20
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10017410
push edi
mov ecx, ebx
call fcn.1001b940
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1005fd4c
xor ecx, ecx
jmp 0x1005fd64
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005fd54
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10017410
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10060570
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1001b940
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005fda5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1005fdde
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005fdde
cmp dword [esi + 0x10], 0
je 0x1005fdd5
push dword [edi]
call fcn.100943b5
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.1000a5d0
push 0x80004005
call fcn.1000a5d0
push 0x80004005
call fcn.1000a5d0
int3