joyce8/EMBER2024-capa huggingface dataset:
Function at 0x637820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1b
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x84]
mov esi, str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_http:__gcc.gnu.org_bugs.html_:_n
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
lea eax, [edx + 0x8a]
and eax, 0xfffffff0
call fcn.005d34c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x84]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
mov word [edi], ax
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
lea eax, [ebx + 0x6b]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x6a], 0
mov dword [esp], ebx
call fcn.006de350
nop
nop
nop
nop
nop
nop
nop
push esi
push ebx
sub esp, 0x24
cmp byte [0x718b5c], 0
jne 0x6378fe
mov byte [0x718b5c], 1
call fcn.006e9c50
test eax, eax
je 0x6379ad
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.005d22d0
mov esi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], eax
je 0x6378f4
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x743ccd
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x63792b
call fcn.006ea0f0
mov dword [esp], esi
call sub.msvcrt.dll_fputs
jmp 0x6378c0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], esi
call fcn.005e5c40
jmp 0x6378ef
call sub.msvcrt.dll_abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6379a8
Function at 0x6d7630
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push edi
push esi
push ebx
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor edx, edi
cmp edi, 3
jbe 0x6d76df
lea ebp, [edi - 4]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
mov eax, ebp
shr eax, 2
lea esi, [esi + eax*4 + 4]
nop
lea esi, [esi]
imul eax, dword [ebx], 0x5bd1e995
imul edx, edx, 0x5bd1e995
add ebx, 4
mov ecx, eax
shr ecx, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e995
xor edx, eax
cmp ebx, esi
jne 0x6d7660
mov eax, dword [esp + 0x14]
and ebp, 0xfffffffc
and edi, 3
lea eax, [eax + ebp + 4]
cmp edi, 2
je 0x6d76c9
cmp edi, 3
je 0x6d76c0
cmp edi, 1
je 0x6d76d2
mov eax, edx
shr eax, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
pop ebx
pop esi
mov edx, eax
shr edx, 0xf
xor eax, edx
pop edi
pop ebp
ret
movzx ecx, byte [eax + 2]
shl ecx, 0x10
xor edx, ecx
movzx ecx, byte [eax + 1]
shl ecx, 8
xor edx, ecx
movzx eax, byte [eax]
xor edx, eax
imul edx, edx, 0x5bd1e995
jmp 0x6d769f
mov eax, dword [esp + 0x14]
jmp 0x6d7690

Function at 0x6d9850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, esi
mov dword [esp], eax
call fcn.0069e284
push eax
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x48], ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov edi, dword [ebx + 8]
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x4c], ecx
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ebx]
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x38], edi
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], ebx
call fcn.006e6940
mov dword [esp + 0x18], esi
mov edx, eax
test edx, edx
jle 0x6d997d
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
mov ebx, ebp
sub ebx, dword [esp + 0x44]
mov eax, edi
sub eax, dword [esp + 0x24]
sar ebx, 3
sar eax, 3
imul ebx, ebx, 0xeeeeeeef
imul eax, eax, 0xeeeeeeef
test ebx, ebx
mov ecx, eax
jne 0x6d9908
mov ebx, dword [esp + 0x4c]
mov ebp, dword [ebx - 4]
mov ebx, 4
add ebp, 0x1e0
test eax, eax
jne 0x6d991e
mov eax, dword [esp + 0x2c]
mov ecx, 4
mov edi, dword [eax - 4]
add edi, 0x1e0
cmp ebx, edx
cmovg ebx, edx
cmp ebx, ecx
cmovg ebx, ecx
imul esi, ebx, 0x78
sar esi, 3
imul esi, esi, 0xeeeeeeef
test esi, esi
mov dword [esp + 0x1c], edx
jle 0x6d9954
sub ebp, 0x78
sub edi, 0x78
dec esi
mov dword [esp], ebp
mov ecx, edi
call fcn.005f5a24
push eax
mov edx, dword [esp + 0x1c]
jmp 0x6d9934
mov esi, ebx
lea ecx, [esp + 0x40]
neg esi
mov dword [esp], esi
call fcn.0069e220
push edx
mov ecx, dword [esp + 0x18]
mov dword [esp], esi
call fcn.0069e2cc
push ecx
mov edx, dword [esp + 0x1c]
sub edx, ebx
jmp 0x6d98c2
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069e284
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d999c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, esi
mov dword [esp], eax
call fcn.0069e3cc
push ebp
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x40], edx
mov dword [esp + 0x48], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x4c], edi
mov edi, dword [ebx + 8]
mov ebx, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.006e69b0
mov dword [esp + 0x18], ebx
mov ebp, eax
mov dword [esp + 0x1c], esi
test ebp, ebp
jle 0x6d9ad7
mov eax, dword [esp + 0x40]
mov ebx, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
sub ebx, dword [esp + 0x44]
mov edx, eax
sub edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
sar ebx, 3
imul ebx, ebx, 0xcccccccd
sar edx, 3
imul edx, edx, 0xcccccccd
test ebx, ebx
mov eax, edx
jne 0x6d9a64
mov ecx, dword [esp + 0x4c]
mov ebx, 0xc
mov ecx, dword [ecx - 4]
lea esi, [ecx + 0x1e0]
mov dword [esp + 0x10], esi
test edx, edx
jne 0x6d9a7d
mov eax, dword [esp + 0x2c]
mov eax, dword [eax - 4]
add eax, 0x1e0
mov dword [esp + 0x14], eax
mov eax, 0xc
cmp ebx, ebp
cmovg ebx, ebp
cmp ebx, eax
cmovg ebx, eax
xor edx, edx
imul eax, ebx, 0x28
sar eax, 3
imul eax, eax, 0xcccccccd
sub edx, 0x28
test eax, eax
jle 0x6d9ab2
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, 9
dec eax
add edi, edx
add esi, edx
rep movsd dword es:[edi], dword [esi]
jmp 0x6d9a95
mov ecx, dword [esp + 0x18]
mov esi, ebx
sub ebp, ebx
neg esi
mov dword [esp], esi
call fcn.0069e35c
push edx
mov ecx, dword [esp + 0x1c]
mov dword [esp], esi
call fcn.0069e414
push ecx
jmp 0x6d9a12
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069e3cc
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d9b48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
lea ebp, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, ebp
mov dword [esp], eax
call fcn.0069e670
push edi
mov edi, dword [esi + 8]
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x48], edi
mov edi, dword [esi + 0xc]
mov esi, dword [ebx + 8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], edi
mov edi, dword [ebx + 4]
mov dword [esp + 0x38], esi
mov ebx, dword [ebx]
lea esi, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
call fcn.006e6ac4
mov dword [esp + 0x1c], ebp
mov edi, eax
test edi, edi
jle 0x6d9c53
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov ebx, edx
mov ecx, eax
sub ebx, dword [esp + 0x44]
sub ecx, dword [esp + 0x24]
sar ecx, 2
sar ebx, 2
mov ebp, ecx
jne 0x6d9bf2
mov edx, dword [esp + 0x4c]
mov ebx, pe_nt_image_headers32
mov edx, dword [edx - 4]
add edx, 0x200
test ecx, ecx
jne 0x6d9c07
mov eax, dword [esp + 0x2c]
mov ebp, pe_nt_image_headers32
mov eax, dword [eax - 4]
add eax, 0x200
cmp ebx, edi
cmovg ebx, edi
cmp ebx, ebp
cmovg ebx, ebp
mov ebp, ebx
shl ebp, 2
je 0x6d9c30
mov ecx, ebp
mov dword [esp + 8], ebp
neg ecx
add edx, ecx
add eax, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov ebp, ebx
mov ecx, esi
sub edi, ebx
neg ebp
mov dword [esp], ebp
call fcn.0069e5ac
push edx
mov ecx, dword [esp + 0x1c]
mov dword [esp], ebp
call fcn.0069e6b8
push ecx
jmp 0x6d9bba
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069e670
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6e0910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
lea ecx, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov dword [esp], eax
call fcn.0069e284
push eax
mov edi, dword [esi + 0xc]
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0xc]
mov ebp, dword [esi + 8]
mov dword [esp + 0x4c], edi
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 4]
mov ebx, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], edx
mov dword [esp + 0x30], ebx
lea ebx, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x48], ebp
mov dword [esp + 4], ebx
call fcn.006e6940
mov dword [esp + 0x18], ebx
mov edi, eax
test edi, edi
jle 0x6e09fe
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
sub eax, ebp
sub ebx, edx
sar eax, 3
sar ebx, 3
imul eax, eax, 0xeeeeeeef
imul ebx, ebx, 0xeeeeeeef
cmp eax, ebx
cmovle ebx, eax
cmp ebx, edi
cmovg ebx, edi
imul esi, ebx, 0x78
sar esi, 3
imul esi, esi, 0xeeeeeeef
test esi, esi
jle 0x6e09e0
mov dword [esp], edx
mov ecx, ebp
mov dword [esp + 0x1c], edx
call fcn.005f5a24
push eax
mov edx, dword [esp + 0x1c]
add ebp, 0x78
dec esi
add edx, 0x78
jmp 0x6e09c0
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
sub edi, ebx
call fcn.0069e220
push edx
lea ecx, [esp + 0x20]
mov dword [esp], ebx
call fcn.0069e2cc
push ecx
jmp 0x6e0980
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069e284
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6e0a1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, esi
mov dword [esp], eax
call fcn.0069e3cc
push edi
mov edi, dword [ebp + 8]
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x48], edi
mov edi, dword [ebp + 0xc]
mov ebp, dword [ebx + 8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], edi
mov edi, dword [ebx + 4]
mov ebx, dword [ebx]
mov dword [esp], eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
lea ebx, [esp + 0x30]
mov dword [esp + 4], ebx
call fcn.006e69b0
mov dword [esp + 0x18], ebx
mov ebp, eax
mov dword [esp + 0x1c], esi
test ebp, ebp
jle 0x6e0b25
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
sub ebx, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
sar ebx, 3
sar eax, 3
imul eax, eax, 0xcccccccd
imul ebx, ebx, 0xcccccccd
cmp eax, ebx
cmovle ebx, eax
cmp ebx, ebp
cmovg ebx, ebp
xor edx, edx
imul eax, ebx, 0x28
sar eax, 3
imul eax, eax, 0xcccccccd
test eax, eax
jle 0x6e0b04
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
dec eax
lea edi, [esi + edx]
lea esi, [ecx + edx]
mov ecx, 9
add edx, 0x28
rep movsd dword es:[edi], dword [esi]
jmp 0x6e0ae5
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
sub ebp, ebx
call fcn.0069e35c
push edx
mov ecx, dword [esp + 0x1c]
mov dword [esp], ebx
call fcn.0069e414
push ecx
jmp 0x6e0a93
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069e3cc
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000aec0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0x10
push 0x1200000
push dword [0x100183f4]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000afa0
lea eax, [ebp - 0x10]
mov dword [esi], 0x100000
push eax
push 0x10001eb0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi + 4], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000afa2
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10001ec8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000af62
cmp dword [ebp - 8], 4
jne 0x1000af62
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x30]
lea ecx, [edx - 1]
cmp ecx, edx
ja 0x1000afc4
dec edx
add edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0xc]
jb 0x1000afc4
not ecx
and ecx, edx
mov dword [esi], ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10001edc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000af95
cmp dword [ebp - 8], 4
jne 0x1000af95
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000afa2
xor esi, esi
mov dword [0x100183e0], esi
test esi, esi
jne 0x1000afb3
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1000aeb0
int3
Function at 0x1000dcd0
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10012700
push 0x10011c70
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x10018084]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
mov edi, 1
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1000dead
sub eax, edi
jne 0x1000df17
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [ebp - 0x130], 0
cmp dword [0x1001842c], 0
jne 0x1000de26
lea eax, [ebp - 0x130]
push eax
push ecx
lea ecx, [ebp - 0x12c]
call fcn.1000e940
add esp, 8
test eax, eax
jne 0x1000dda0
push edi
call fcn.1000e4d0
push 0x100183f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x10018414], edi
mov dword [0x10018418], edi
push 0x10018420
push 0
push 0
push 0
push 0
push 0x10001498
push 0
push 0x1000ede0
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x1000de26
lea eax, [ebp - 0x12c]
mov dword [0x1001805c], eax
mov byte [ebp - 0x1f], 0
cmp dword [0x100183f0], 0
jne 0x1000ddc2
mov dword [0x100183f0], 0xfff
cmp dword [0x1001842c], 0
jne 0x1000dde5
mov ecx, 0x23fa
call fcn.1000e5e0
cmp dword [0x10018098], 0xffffffff
jne 0x1000dde5
push 1
call fcn.1000e4d0
cmp dword [0x10018010], 0x1000e2e0
jne 0x1000de1c
cmp dword [ebp - 0x130], 0
je 0x1000de1c
push 0x100024c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x1001805c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x100024c8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x1001805c], 0x100024ec
call dword [sym.imp.MSDART.DLL_MPCSInitialize]
test eax, eax
jne 0x1000de37
xor edi, edi
jmp 0x1000df17
push 0x100183e8
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
cmp dword [0x100183e8], 0
je 0x1000de30
test eax, eax
js 0x1000de30
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
mov dword [0x100183f4], eax
push 0x12
call dword [sym.imp.MSDART.DLL_FXMemAttach]
add esp, 4
cmp dword [0x100183ec], 0
jne 0x1000de8f
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x150]
mov dword [0x100183ec], eax
cmp eax, 0xfffffff
ja 0x1000de30
call fcn.100113b0
mov edi, eax
test edi, edi
je 0x1000df17
call fcn.1000aec0
movzx edi, al
test al, al
jne 0x1000df17
call fcn.10011410
jmp 0x1000df17
cmp dword [ebp + 0x10], 0
jne 0x1000df17
mov dword [ebp - 4], 0
call fcn.1000afd0
mov ecx, dword [0x100183e8]
test ecx, ecx
je 0x1000ded9
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100191b0]
call esi
mov dword [0x100183e8], 0
call dword [sym.imp.MSDART.DLL_MPCSUninitialize]
call fcn.10011410
push 0x12
call dword [sym.imp.MSDART.DLL_FXMemDetach]
add esp, 4
call fcn.1000e580
call fcn.1000ed90
jmp 0x1000df10
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10011b20
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000e830
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push edi
mov edi, ecx
push 0x10e
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000e8db
cmp eax, 0x10e
jae 0x1000e8db
push esi
mov esi, 0x10e
lea edx, [eax + edi]
mov ecx, 0
sub esi, eax
je 0x1000e86e
cmp esi, 0x7fffffff
jbe 0x1000e873
mov ecx, 0x80070057
test ecx, ecx
js 0x1000e8ca
mov ecx, esi
test esi, esi
je 0x1000e8ac
mov edi, SysReAllocString
sub edi, esi
mov esi, 0x10002458
sub esi, edx
jmp 0x1000e890
lea eax, [edi + ecx]
test eax, eax
je 0x1000e8a8
mov al, byte [esi + edx]
test al, al
je 0x1000e8a8
mov byte [edx], al
inc edx
sub ecx, 1
jne 0x1000e890
jmp 0x1000e8ac
test ecx, ecx
jne 0x1000e8ad
dec edx
neg ecx
mov byte [edx], 0
pop esi
sbb ecx, ecx
xor eax, eax
and ecx, 0x7ff8ff86
add ecx, 0x8007007a
test ecx, ecx
pop edi
setns al
ret
test esi, esi
je 0x1000e8d1
mov byte [edx], 0
xor eax, eax
test ecx, ecx
pop esi
setns al
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x1000e8e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push 2
mov dword [esi + 0x14], 0
mov byte [edi], 0
push dword [esi + 8]
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edx, eax
test edx, edx
jne 0x1000e92a
cmp dword [ebp - 4], 1
jbe 0x1000e92a
xor ecx, ecx
cmp byte [edi], 0x3a
setne cl
mov dword [esi + 0x14], ecx
xor eax, eax
test edx, edx
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ece0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10018084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x114], 0
push eax
push 0
push 2
push edx
push 0
push ecx
mov dword [esi], 0
mov dword [ebp - 0x228], 0x10e
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1000ed41
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011b20
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x224]
call fcn.1000e830
test eax, eax
je 0x1000ed6e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10011b20
mov esp, ebp
pop ebp
ret

Function at 0x100111e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10018084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, ecx
mov word [ebp - 0x30], ax
mov edi, 0x20
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push 0x100026b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10011261
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x28
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0x100026e0
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10011258
mov word [ebp - 8], ax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
mov edi, eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi + 4]
test edi, edi
je 0x1001128e
push ecx
push edi
push 0
push esi
call dword [sym.imp.MSDART.DLL_long_int___stdcall_CreateHolder_struct_IGPDispenser___int__unsigned_int__struct_IGPHolder___]
test eax, eax
jns 0x10011294
pop edi
mov dword [esi + 4], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011b20
mov esp, ebp
pop ebp
ret
mov dword [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10011b20
mov esp, ebp
pop ebp
ret

Function at 0x10011f50
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10011f8e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10011f86
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10011f90
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10011f76
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10012060
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10012076
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10012091
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret