joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100054b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fb50
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
mov word [ebp - 0x258], ax
push 0x206
push eax
lea eax, [ebp - 0x256]
push eax
call fcn.10055aa0
mov dword [ebp - 0x4a8], 0
push 0x24c
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.10055aa0
mov dword [ebp - 0x4ac], 0xffffffff
xor eax, eax
mov word [ebp - 0x50], ax
push 0x30
push eax
lea eax, [ebp - 0x4e]
push eax
call fcn.10055aa0
add esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
push 0x100e2400
push str._s
push 0x104
lea eax, [ebp - 0x258]
push eax
call fcn.1005211a
add esp, 0x10
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x4ac], esi
cmp esi, 0xffffffff
jne 0x10005644
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x100055cd
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10005629
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x10005608
mov byte [esi + 0xffff], 0
push esi
push str.GetMbaeVersion
push 1
mov edx, 0x98
mov ecx, str.....mbae_commonMbaeVersion.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10005620
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [ebx + 0x1e]
jmp 0x10005732
push str.0.0.0.0
push 0x19
push 0x100e22c0
call fcn.1005211a
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
push 0x100873b0
lea eax, [ebp - 0x47c]
push eax
call fcn.100513c3
add esp, 8
test eax, eax
je 0x100056ec
push 0x100873b4
lea eax, [ebp - 0x47c]
push eax
call fcn.100513c3
add esp, 8
test eax, eax
je 0x100056ec
lea eax, [ebp - 0x47c]
push eax
push 0x100e2400
push 0x10086b48
push 0x104
lea eax, [ebp - 0x258]
push eax
call fcn.1005211a
add esp, 0x14
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x258]
call fcn.10004f40
test eax, eax
jne 0x100056ec
lea edx, [ebp - 0x50]
call fcn.10005350
cmp eax, 0xffffffff
jne 0x100056ec
lea eax, [ebp - 0x50]
push eax
push 0x10086484
push 0x19
push 0x100e22c0
call fcn.1005211a
add esp, 0x10
lea eax, [ebp - 0x4a8]
push eax
push esi
call edi
test eax, eax
jne 0x10005660
mov dword [ebp - 4], eax
call fcn.1000570e
jmp 0x10005729
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x10005850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
mov eax, dword [0x1009cbc0]
xor eax, esp
mov dword [esp + 0x124], eax
push 0x11c
lea eax, [esp + 4]
push 0
push eax
call fcn.10055aa0
add esp, 0xc
mov dword [esp], 0x11c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10005a6d
xor edx, edx
lea ecx, [edx + 0xa]
call fcn.10005790
test eax, eax
je 0x100058d1
mov al, byte [esp + 0x11a]
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x4000
add eax, 0x4000
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
mov edx, 3
lea ecx, [edx + 3]
call fcn.10005790
test eax, eax
je 0x1000590e
mov al, byte [esp + 0x11a]
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x1000
add eax, 0x1000
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x100059b1
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x10005950
mov al, byte [esp + 0x11a]
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x400
add eax, 0x400
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10005981
mov al, byte [esp + 0x11a]
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x100
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x10005a6d
mov al, byte [esp + 0x11a]
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x40
add eax, 0x40
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x10005a6d
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x10005a36
test dword [esp + 0x118], 0x8000
je 0x100059e7
mov eax, 0x20
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x11a], 1
jne 0x10005a12
call fcn.10005a90
cmp eax, 0x40
jne 0x10005a12
mov eax, 0x10
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
and eax, 4
add eax, 4
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10005a52
mov eax, 2
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x10005a6d
mov eax, 1
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
xor eax, eax
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x10005a90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005ad6
lea ecx, [ebp - 0x24]
push ecx
call eax
jmp 0x10005ae0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
setne al
dec eax
and eax, 0x20
add eax, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x100064c0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x267c
call fcn.10055c30
mov eax, dword [0x1009cbc0]
xor eax, esp
mov dword [esp + 0x2678], eax
push ebx
push esi
xor eax, eax
mov dword [esp + 0xc], 0
push edi
push 0x40
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
call fcn.10055aa0
add esp, 0xc
call fcn.1003ccd0
test eax, eax
je 0x100066b1
call fcn.10037c00
push str.mbae64.exe
push 0x100e2400
lea eax, [esp + 0x70]
push 0x10086350
push eax
call fcn.1000ac10
mov eax, dword [0x100e2810]
add esp, 0x10
cmp dword [eax + 0x48], 0
je 0x10006583
cmp dword [eax + 0x4c], 0
je 0x10006583
cmp dword [eax + 0x50], 0
je 0x10006583
lea ecx, [esp + 0x68]
add ecx, 0xfffffffe
jmp 0x10006560
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10006560
mov eax, dword [str.__mbt]
mov dword [ecx], eax
mov eax, dword [0x10087494]
mov dword [ecx + 4], eax
mov eax, dword [0x10087498]
mov dword [ecx + 8], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10006696
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
push 0x1000a
lea edi, [eax + 0x1e]
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x10006603
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2678]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000665d
push esi
push str.StartService64
push 1
mov edx, 0xd5
mov byte [esi + 0xffff], 0
mov ecx, str...ApiAuxNA.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2678]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2678]
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov eax, dword [esp + 0x18]
mov dword [0x100e23fc], eax
mov ecx, dword [esp + 0x2684]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x100066d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fb98
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0x1b], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 1
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
jne 0x10006770
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x28]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100067c0
lea eax, [ebp - 0x1c]
mov ecx, 0x1008749c
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100067b0
test dl, dl
je 0x100067ac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100067b0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10006790
xor eax, eax
jmp 0x100067b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100067c0
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0
call fcn.100067d1
jmp 0x100067ec
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007ce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fc80
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], edx
mov esi, dword [0x100e2810]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov ebx, dword [ebp + 0xc]
push ebx
mov edx, eax
mov ecx, dword [ebp - 0x1c]
call fcn.10007fc0
add esp, 4
test eax, eax
jne 0x10007d69
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10007d76
mov edi, 1
xor edx, edx
mov dword [ebp - 0x20], edx
cmp edx, dword [esi + 0x4270]
jge 0x10007e21
test edi, edi
jne 0x10007df2
imul ecx, edx, 0x62c
mov eax, dword [esi + 0x4278]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax + ecx + 0x414], ebx
mov ebx, dword [ebp + 0xc]
jne 0x10007df2
mov eax, dword [eax + ecx + 0x620]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [esi + 0x4278]
add eax, 0x418
add eax, ecx
push eax
push 0x104
push ebx
call fcn.10053320
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x10007e1b
imul ecx, edx, 0x62c
add ecx, dword [esi + 0x4278]
mov eax, dword [ecx + 0x620]
mov ebx, dword [ebp + 8]
cmp eax, dword [ebx]
mov ebx, dword [ebp + 0xc]
jne 0x10007e1b
lea eax, [ecx + 0x20c]
jmp 0x10007dbf
inc edx
jmp 0x10007d78
mov dword [ebp - 4], 0
call fcn.10007e74
mov dword [ebp - 4], 0xfffffffe
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x10007e75
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi + 9]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push 9
test eax, eax
jle 0x10007ecf
mov byte [esi + 0xffff], 0
push esi
push str.GetParentProcessInfo
push 1
mov edx, 0x2ee
mov ecx, str...ApiAuxNA.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, 9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov eax, 9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a0c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fe58
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x46c], 0
push 0x224
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.10055aa0
mov dword [ebp - 0x244], 0
push 0x224
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.10055aa0
add esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x464], 6
mov dword [ebp - 0x454], ebx
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x46c]
call fcn.10008490
mov edx, 0x228
lea ecx, [ebp - 0x244]
call fcn.10005750
test eax, eax
jne 0x1000a257
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax + 0x1e]
mov dword [ebp - 0x470], 0
push 0x1000a
call fcn.1005218a
mov edi, eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov esi, eax
test edi, edi
je 0x1000a323
test esi, esi
je 0x1000a323
push dword [ebp - 0x474]
push dword [ebp - 0x244]
push str.Error__d_:_Bad_CRC__d
push 0xffff
push esi
call fcn.1005211a
add esp, 0x14
test eax, eax
jle 0x1000a23f
xor eax, eax
mov word [esi + 0x1fffe], ax
push 0xfffffffffffffffe
push esi
call fcn.10051b84
push 0xffffffffffffffff
push esi
inc eax
push eax
push edi
lea eax, [ebp - 0x470]
push eax
call fcn.10052d14
add esp, 0x1c
test eax, eax
je 0x1000a21f
push ebx
push esi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
push edi
push str.IsMbaeInjectedInProcess64
push 4
mov edx, 0x4fa
mov ecx, str...ApiAuxNA.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x1000a33b
push ebx
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x1000a335
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x22c]
jmp 0x1000a35e
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test edi, edi
je 0x1000a348
push edi
call fcn.10052152
add esp, 4
test esi, esi
je 0x1000a355
push esi
call fcn.10052152
add esp, 4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x1000a770
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fea0
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0xc20
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0xc30], edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc20], eax
mov edi, 1
mov dword [ebp - 0xc24], edi
call fcn.10005850
mov ecx, 0x10
cmp ecx, eax
sbb eax, eax
and eax, 0xc00
add eax, 0x400
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0xc28], ebx
test ebx, ebx
je 0x1000a928
push 0x400
lea eax, [ebp - 0xc1c]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000a921
push 0x208
call fcn.1005218a
add esp, 4
mov esi, eax
mov dword [ebp - 0xc2c], esi
mov dword [ebp - 4], 0
push ecx
mov edx, esi
lea ecx, [ebp - 0xc1c]
call fcn.1000a970
add esp, 4
test eax, eax
jne 0x1000a915
cmp dword [ebp + 8], eax
je 0x1000a8da
mov word [ebp - 0x21c], ax
push 0x1fe
push eax
lea eax, [ebp - 0x21a]
push eax
call fcn.10055aa0
xor eax, eax
mov word [ebp - 0x41c], ax
push 0x1fe
push eax
lea eax, [ebp - 0x41a]
push eax
call fcn.10055aa0
push 0x100
lea eax, [ebp - 0x41c]
push eax
push 0x100
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
push 0
push esi
call fcn.10051ba3
lea eax, [ebp - 0x21c]
push eax
push 0x104
push dword [ebp - 0xc20]
call fcn.10053320
add esp, 0x48
lea eax, [ebp - 0x41c]
push eax
push 0x104
push dword [ebp - 0xc20]
call fcn.10051f45
jmp 0x1000a8eb
push esi
push 0x104
push dword [ebp - 0xc20]
call fcn.10053320
add esp, 0xc
push 0x104
push dword [ebp - 0xc20]
push dword [ebp - 0xc30]
call fcn.1005385b
add esp, 0xc
neg eax
sbb eax, eax
not eax
and edi, eax
mov dword [ebp - 0xc24], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.1000a958
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
Function at 0x1000ac30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 4], 0
dec dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
jne 0x1000ae75
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.10003e10
mov edi, eax
test edi, edi
je 0x1000ad1f
push 0x1000a
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000aca6
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000acf3
push esi
push str.DllMain
push 1
mov edx, 0x7e
mov byte [esi + 0xffff], 0
mov ecx, str...ApiNA.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.100040a0
mov edi, eax
test edi, edi
je 0x1000ad8e
push 0x1000a
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
je 0x1000ac83
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000acf3
push esi
push str.DllMain
push 1
mov edx, 0x82
mov byte [esi + 0xffff], 0
mov ecx, str...ApiNA.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0xc
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
jne 0x1000ae6c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
push 0x1000a
lea edi, [eax + 0x1e]
call fcn.1005218a
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000adf1
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1000ae3f
push esi
push str.DllMain
push 1
mov edx, 0x87
mov byte [esi + 0xffff], 0
mov ecx, str...ApiNA.cpp
call fcn.10001cf0
add esp, 0x10
push esi
call fcn.10052152
add esp, 4
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
lea eax, [ebx + 0x1e]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
mov dword [0x100e23f8], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b600
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1009cbc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x218], ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x208], esi
xor edi, edi
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x214], ebx
test esi, esi
jne 0x1000b650
pop edi
pop esi
lea eax, [edx + 0x57]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b751
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x210], eax
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000b726
xor esi, esi
push 0xff
push dword [esi + 0x10085f60]
lea eax, [ebp - 0x204]
push eax
call fcn.1005385b
add esp, 0xc
test eax, eax
je 0x1000b71a
add esi, 4
cmp esi, 0x100
jb 0x1000b6b3
mov esi, dword [ebp - 0x208]
cmp ebx, dword [esi]
jae 0x1000b709
cmp dword [ebp - 0x218], 0
je 0x1000b709
lea eax, [ebp - 0x204]
push eax
push 0xff
push dword [ebp - 0x210]
call fcn.10053320
add esp, 0xc
inc edi
inc ebx
add dword [ebp - 0x210], 0x208
jmp 0x1000b680
mov esi, dword [ebp - 0x208]
inc edi
jmp 0x1000b680
cmp eax, 0x103
jne 0x1000b680
cmp dword [esi], ebx
push dword [ebp - 0x20c]
sbb esi, esi
and esi, 0xea
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x208]
mov dword [eax], ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005132c
mov esp, ebp
pop ebp
ret