joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1046bbb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10560f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.01043f33
mov dword [ebp - 0x14], eax
cmp dword [0x105eb20], esi
jne 0x1046cae
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1046c3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1046d8e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1046d8e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1046d8e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x105eb20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x105eb24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x105eb28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x105eb30], eax
test eax, eax
je 0x1046cab
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x105eb2c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1046cd3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1046cc6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1046ce8
push 4
pop eax
jmp 0x1046d90
cmp dword [ebp - 0x14], esi
je 0x1046ce8
push dword [0x105eb20]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1046ccd
mov eax, dword [0x105eb2c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1046d46
cmp dword [0x105eb30], edi
je 0x1046d46
push eax
call ebx
push dword [0x105eb30]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1046d46
test eax, eax
je 0x1046d46
call ecx
test eax, eax
je 0x1046d3b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1046d3b
test byte [ebp - 8], 1
jne 0x1046d46
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1046d76
mov eax, dword [0x105eb24]
cmp eax, edi
je 0x1046d73
push eax
call ebx
test eax, eax
je 0x1046d73
call eax
mov esi, eax
test esi, esi
je 0x1046d73
mov eax, dword [0x105eb28]
cmp eax, edi
je 0x1046d73
push eax
call ebx
test eax, eax
je 0x1046d73
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x105eb20]
call ebx
test eax, eax
je 0x1046d8e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1046d90
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103f514
mov esp, ebp
pop ebp
ret
Function at 0x418d87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x418d96
pop dword [ebp - 0x24]
mov eax, 0x418d96
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3a7c0
push 0
mov eax, 0x182f9a13
add eax, 0xe812b70d
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xbee2ebfd
sub ecx, 0xbee2abc5
xor ebx, ebx
add ebx, eax
mov edi, 0x96b71991
add edi, 0x698c146f
add edi, dword [ebp - 0x24]
mov edx, 0x86ac3d4a
add edx, 0xde6115a3
mov dword [ebp - 0x20], 0x3073427e
mov esi, dword [edi]
add esi, edx
add dword [ebp - 0x14], 0x9613943c
mov dword [ebx], esi
xor dword [ebp - 0x18], 0x7108a7e2
add ebx, 4
add edi, 4
loop 0x418df2
add eax, 0x71212279
add eax, 0x8edfd13a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x69601d3
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x477f7f86
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x70032f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x7003303
pop dword [ebp - 0x38]
mov eax, 0x7003303
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x9b536d76
add dword [ebp - 0x48], 0xb2fed7d5
mov dword [ebp - 0x44], 0xb2a88fc
add dword [ebp - 0x44], 0x2708c349
mov dword [ebp - 0x40], 0xb74a442c
sub dword [ebp - 0x40], 0x6afdfffe
mov dword [ebp - 0x3c], 0x29d939c8
add dword [ebp - 0x3c], 0xd626c638
lea eax, [ebp - 0x48]
push eax
mov eax, 0x36edfab0
add eax, 0xd0132580
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x6e088a5
add dword [ebp - 0x48], 0x6d91e0b1
mov dword [ebp - 0x44], 0x723a661f
add dword [ebp - 0x44], 0xcf31fb56
mov dword [ebp - 0x40], 0x701319d2
sub dword [ebp - 0x40], 0xca3ad66
mov dword [ebp - 0x3c], 0x3e38f11
sub dword [ebp - 0x3c], 0x3e38f11
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xa950e005
sub eax, 0xa24fbfd1
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x42cea
push 0
call eax
mov ecx, 0x1a9b555d
add ecx, 0xe5651354
xor ebx, ebx
add ebx, eax
mov edi, 0xbc14e72e
add edi, 0x4aecf8d2
add edi, dword [ebp - 0x38]
mov edx, 0xcc3a55a3
mov esi, dword [edi]
sub dword [ebp - 0x18], edx
xor esi, edx
sub dword [ebp - 0xc], ebx
mov dword [ebx], esi
sub dword [ebp - 0x28], eax
add ebx, 0xecae53c6
sub ebx, 0xecae53c2
add edi, 0xeef69513
sub edi, 0xeef6950f
loop 0x700341c
add eax, 0x19597
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe6d011fa
add ecx, 0x202fee06
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x700cd52
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010fd1
call fcn.07001bfd
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cf67
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d518
lea ecx, [ebp + 8]
call fcn.0700ccf6
mov eax, dword [edi + 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call esi
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700cdc1
mov eax, dword [eax + 0x14]
jmp 0x700cdc6
mov eax, 0x701221a
push 0x7013b90
push eax
call dword [sym.imp.MSVCR120.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x700cde6
push str.file_does_not_exist
push ebx
call fcn.070032f4
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [edi + 8], eax
mov byte [ebp - 4], 1
call esi
push dword [ebp + 8]
mov ecx, 0x701a094
call fcn.070032f4
mov eax, edi
call fcn.07001d82
ret 4
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4070e3
pop dword [ebp - 0x50]
mov eax, 0x4070e3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe8a395d7
add dword [ebp - 0x60], 0x65aeaf74
mov dword [ebp - 0x5c], 0x2c61b98f
sub dword [ebp - 0x5c], 0xfa2e6d4a
mov dword [ebp - 0x58], 0x7285bad8
sub dword [ebp - 0x58], 0x263976aa
mov dword [ebp - 0x54], 0xe9a0e30b
sub dword [ebp - 0x54], 0xe9a0e30b
lea eax, [ebp - 0x60]
push eax
mov eax, 0x63fc8e54
add eax, 0x9c43f2b0
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb079ecea
sub dword [ebp - 0x60], 0x3c078394
mov dword [ebp - 0x5c], 0x293d761c
add dword [ebp - 0x5c], 0x182eeb59
mov dword [ebp - 0x58], 0xd82d1612
sub dword [ebp - 0x58], 0x74bda9a6
mov dword [ebp - 0x54], 0xce930158
add dword [ebp - 0x54], 0x316cfea8
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x36860
push 0
call eax
mov ecx, 0x9f00f716
sub ecx, 0x9f00b139
mov edi, eax
mov edx, 0x3e9f06c5
sub edx, 0x3e5a02c5
add edx, dword [ebp - 0x50]
mov esi, 0x8ff44883
sub esi, 0x79368d5d
sub dword [ebp - 0x3c], 0x4ef19bde
mov ebx, dword [edx]
xor dword [ebp - 8], 0xcf291ba1
add ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0x1c], edi
add edi, 0xf54f794c
add edi, 0xab086b8
add edx, 4
loop 0x4071fb
add eax, 0x4e1b5a5a
sub eax, 0x4e1a5013
xor ebx, ebx
add ebx, eax
add eax, 0x9788db91
sub eax, 0x9788db8c
mov ecx, 0xdc993b11
add ecx, 0x23a6c4ef
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1000a7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10015949
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0
lea edi, [esi + 8]
push 0
mov ecx, edi
mov dword [esp + 0x10], esi
call fcn.1000bd00
lea ecx, [esi + 0x98]
mov dword [esp + 0x14], 0
call fcn.1000fb9e
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x14], 1
test eax, eax
mov dword [esi + 4], 0
push 0x80
je 0x1000a83f
push eax
lea eax, [esi + 0x18]
push eax
jmp 0x1000a848
lea ecx, [esi + 0x18]
push 0x10021fcc
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov ecx, edi
mov dword [esi], 0
push edx
push eax
call fcn.1000bdf0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x1000aa50
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
test esi, esi
je 0x1000aad2
push edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
push esi
push 1
lea eax, [esp + 0x1c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x20
test eax, eax
pop edi
je 0x1000aa96
push str.Fseek_failed
call dword [sym.imp.MSVCRT.dll_perror]
add esp, 4
mov al, byte [esp + 0xc]
cmp al, 0x53
jne 0x1000aab0
mov ecx, dword [esp + 0x10]
push ecx
push esi
mov ecx, ebx
call fcn.1000ae50
pop esi
pop ebx
ret 8
cmp al, 0x3a
jne 0x1000aac6
mov edx, dword [esp + 0x10]
mov ecx, ebx
push edx
push esi
call fcn.1000aae0
pop esi
pop ebx
ret 8
push 0
push 0x16
lea ecx, [ebx + 0x10]
call fcn.1000a8a0
pop esi
xor al, al
pop ebx
ret 8
Function at 0x1000f600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10015b59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x14]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov cl, byte [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dl, byte [esp + 0x1c]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x24], dl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov al, byte [esp + 0x1c]
mov dword [esi + 0x38], ebx
mov byte [esi + 0x34], al
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov ecx, dword [esi + 4]
mov byte [esp + 0x14], 3
cmp ecx, ebx
jne 0x1000f673
xor eax, eax
jmp 0x1000f678
mov eax, dword [esi + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jae 0x1000f71f
cmp ecx, ebx
mov eax, ecx
jge 0x1000f68c
xor eax, eax
push ebp
push edi
push eax
call sub.MFC42.DLL_operatornew
mov ebp, dword [esi + 8]
mov edi, eax
mov eax, dword [esi + 4]
add esp, 4
cmp eax, ebp
mov ecx, edi
je 0x1000f6b3
cmp ecx, ebx
je 0x1000f6ad
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
cmp eax, ebp
jne 0x1000f6a5
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x28]
add esp, 4
lea ecx, [edi + eax]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x1000f6f8
xor eax, eax
mov dword [esi + 4], edi
mov eax, edi
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov eax, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov eax, dword [esi + 8]
mov dword [esi + 4], edi
sub eax, ecx
mov dword [esi + 0x10], ebx
add eax, edi
pop edi
mov dword [esi + 8], eax
mov eax, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100106b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10015ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.1000fb9e
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.1000fb9e
mov edi, dword [esp + 0x38]
mov ebx, 1
test edi, edi
mov dword [esp + 0x30], ebx
jne 0x10010730
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.10010aa0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 4]
and ecx, 0xff00
lea eax, [esi + 8]
or ecx, 2
push eax
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esi + 0xc]
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esi]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call dword [edx + 0x34]
mov bl, al
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x10010bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10015d0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.1000fb9e
lea ebp, [esi + 0xc]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x20], edi
call fcn.1000fb9e
mov dword [esi], 0x1001957c
mov al, byte [esp + 0x2c]
mov dword [esp + 0x20], 1
mov byte [esi + 0x34], al
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov cl, byte [esp + 0x2c]
mov dword [esi + 0x48], edi
mov byte [esi + 0x44], cl
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
lea eax, [esi + 0x54]
mov byte [esp + 0x20], 3
mov dword [esp + 0x10], eax
lea ecx, [eax + 0x10]
call fcn.1000fb9e
mov edx, dword [esp + 0x10]
mov byte [esp + 0x20], 4
lea ecx, [edx + 0x14]
call fcn.1000fb9e
mov eax, dword [esp + 0x2c]
mov dword [esi], 0x1001953c
mov dword [esi + 0x84], eax
mov eax, 1
mov dword [esi + 0x80], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0xa0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
mov byte [esp + 0x20], 5
mov dword [esi + 0x30], ecx
mov ecx, ebx
call sub.MFC42.DLL_CString::Empty
mov ecx, ebp
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x28]
mov dword [esi + 0x70], edi
cmp eax, edi
mov dword [esi + 4], edi
je 0x10010ce2
push edi
push eax
mov ecx, esi
call fcn.100106b0
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x10013110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10015fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::CString_1
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x34], 1
call fcn.10013a10
mov ecx, dword [eax]
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
mov edx, dword [eax + 4]
lea eax, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], edx
call fcn.10013d20
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x10004320
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call fcn.10007af0
push eax
call fcn.1000b794
add esp, 8
mov dword [ebp - 0x10], 8
mov eax, 0x2c7
mov word [0x10024464], ax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.SoftwareCPWKey_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000437b
xorps xmm0, xmm0
movlpd qword [0x10024466], xmm0
jmp 0x100043b7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.CPW_VALUE
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [0x10024466], ecx
or ecx, eax
mov dword [0x1002446a], eax
jne 0x10004476
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0x20006
push 1
push 0
push 0
push str.SoftwareCPWKey_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100043ee
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
jmp 0x1000446b
push esi
push edi
push 0
call fcn.10007af0
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.1000b773
imul esi, eax
call fcn.1000b773
imul eax, edi
push 0
xor eax, esi
mov dword [ebp - 0x14], eax
call fcn.10007af0
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.1000b773
imul esi, eax
call fcn.1000b773
imul eax, edi
push 8
xor eax, esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.CPW_VALUE
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword [0x10024466], ecx
mov dword [0x1002446a], eax
push 0x8adfff
mov dword [0x100243f4], 0
mov dword [0x100243f8], 0
mov dword [0x100243fc], 0
mov dword [0x10024440], 0
mov dword [0x10024444], 0
call fcn.1000bcf8
push 0x1026db
mov dword [0x10024438], eax
call fcn.1000bcf8
push 0x8adfff
push 0x401000
push dword [0x10024438]
mov dword [0x1002443c], eax
call fcn.10007530
push 0x1026db
push 0xcaf924
push dword [0x1002443c]
call fcn.10007530
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
xor ecx, ebp
mov dword [0x10024458], 0
add esp, 0x20
mov dword [0x1002445c], 0xe457d0
movups xmmword [0x10024448], xmm0
mov byte [0x10024460], 0
xor eax, eax
mov dword [0x10024400], 0
mov dword [0x10024404], 0
mov dword [0x10024408], 0
call fcn.10004b6e
mov esp, ebp
pop ebp
ret