joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.1000ea60
mov edi, eax
test edi, edi
je 0x1000fd5a
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 6], 0x676e69
mov word [ebp - 0xc], 0x6f72
mov word [ebp - 9], 0x7453
mov byte [ebp - 7], 0x72
mov byte [ebp - 0xa], 0x6d
mov dword [ebp - 0x10], 0x46444949
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd53
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000fd70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x15], 0x726f4674
mov word [ebp - 6], 0x6365
mov dword [ebp - 0x11], 0x746c754d
mov word [ebp - 0x17], 0x6961
mov word [ebp - 0xa], 0x4f65
mov word [ebp - 0xd], 0x7069
mov word [ebp - 3], 0x73
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 4], 0x74
mov word [ebp - 8], 0x6a62
mov byte [ebp - 0xb], 0x6c
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fdda
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000fdf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 5], 0x6565
mov dword [ebp - 0xa], 0x466c6163
mov byte [ebp - 3], 0
mov word [ebp - 0xc], 0x6f4c
mov byte [ebp - 6], 0x72
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fe2e
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000fe40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xa], 0x72724574
mov word [ebp - 0xf], 0x7465
mov word [ebp - 0xc], 0x7361
mov word [ebp - 6], 0x726f
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 4], 0
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fe85
call eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1000fe90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 7], 0x577972
mov dword [ebp - 0xb], 0x6f746365
mov dword [ebp - 0x13], 0x74616572
mov dword [ebp - 0xf], 0x72694465
mov byte [ebp - 0x14], 0x43
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fed6
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000fee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], 0x7365636f
mov word [ebp - 0xd], 0x7461
mov word [ebp - 4], 0x5773
mov byte [ebp - 2], 0
mov word [ebp - 0x10], 0x7243
mov word [ebp - 0xb], 0x5065
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x72
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ff49
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10010030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
call fcn.1000eba0
mov esi, eax
test esi, esi
je 0x100100a8
lea eax, [ebp - 0x18]
push eax
push esi
mov word [ebp - 0x10], 0x6963
mov word [ebp - 2], 0x57
mov dword [ebp - 0xd], 0x6c6f466c
mov word [ebp - 5], 0x7461
mov dword [ebp - 0x18], 0x65474853
mov word [ebp - 8], 0x7265
mov byte [ebp - 6], 0x50
mov dword [ebp - 0x14], 0x65705374
mov byte [ebp - 3], 0x68
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 9], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100100a1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
call fcn.1000ea10
mov edi, eax
test edi, edi
je 0x10010168
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 6], 0x63657053
mov word [ebp - 0x13], 0x7461
mov dword [ebp - 0xb], 0x6c694665
mov word [ebp - 0x10], 0x6552
mov word [ebp - 0xd], 0x766f
mov word [ebp - 2], 0x57
mov byte [ebp - 0x11], 0x68
mov byte [ebp - 7], 0x65
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xe], 0x6d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010161
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100101d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x64616f4c
mov dword [ebp - 0xc], 0x7262694c
mov dword [ebp - 7], 0x577972
mov byte [ebp - 8], 0x61
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001020c
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10029fa1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001c436
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10029fd9
xor eax, eax
jmp 0x1002a005
cmp esi, dword [ebp - 4]
je 0x1002a002
cmp dword [ebp + 0xc], 0
je 0x1002a002
push dword [edi + 0x9c]
call fcn.10029baf
push dword [edi + 0x9c]
mov esi, eax
call fcn.100291c0
pop ecx
pop ecx
cmp esi, eax
je 0x10029fd5
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x10030ab8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10041594]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10015672
mov dword [ebp - 0x14], eax
cmp dword [0x10061670], edi
jne 0x10030ba9
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10030b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10030c89
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10030c89
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10030c89
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x10061670], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10061674], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10061678], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10061680], eax
test eax, eax
je 0x10030ba6
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1006167c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10030bce
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10030bc1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10030be3
push 4
pop eax
jmp 0x10030c8b
cmp dword [ebp - 0x14], edi
je 0x10030be3
push dword [0x10061670]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10030bc8
mov eax, dword [0x1006167c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10030c41
cmp dword [0x10061680], esi
je 0x10030c41
push eax
call ebx
push dword [0x10061680]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10030c41
test eax, eax
je 0x10030c41
call ecx
test eax, eax
je 0x10030c36
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10030c36
test byte [ebp - 8], 1
jne 0x10030c41
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10030c71
mov eax, dword [0x10061674]
cmp eax, esi
je 0x10030c6e
push eax
call ebx
test eax, eax
je 0x10030c6e
call eax
mov edi, eax
test edi, edi
je 0x10030c6e
mov eax, dword [0x10061678]
cmp eax, esi
je 0x10030c6e
push eax
call ebx
test eax, eax
je 0x10030c6e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x10061670]
call ebx
test eax, eax
je 0x10030c89
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10030c8b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001533d
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x3bd906bf
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, str.xHx
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x483809c8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001c30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062108
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100e57c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x100da014]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ecx
push 0x12
xor esi, esi
push esi
push esi
push 0x100685bc
mov dword [ebp - 4], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10001cca
lea edx, [ebp - 0x30]
push str.FindSmartAudioInterface__:Inside__:_Failed_to_find_SmartAudio_Interface
push edx
call fcn.10001a40
mov esi, dword [ebp - 0x30]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0xc]
cmp eax, dword [0x100da010]
je 0x10001cc2
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10001cc2
push esi
call fcn.1004b641
add esp, 4
or eax, 0xffffffff
jmp 0x10001d6e
mov dword [ebp - 0x2c], 0x1c
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x2c]
push ecx
push esi
push 0x100685bc
push 0
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x10001d03
lea edx, [ebp - 0x34]
push edx
push ebx
lea edi, [ebp - 0x2c]
call section..text
add esp, 8
test al, al
jne 0x10001d18
inc esi
cmp esi, 3
jae 0x10001d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
jne 0x10001cd8
jmp 0x10001d40
lea eax, [ebp - 0x30]
push str.FindSmartAudioInterface__:Inside__:_OpenDeviceInterface_Succeeded
push eax
call fcn.10001a40
mov ecx, dword [ebp - 0x30]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x38]
push edx
push ebx
call fcn.10001a60
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x30]
lea eax, [esi - 0xc]
cmp eax, dword [0x100da010]
je 0x10001d6b
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10001d6b
push esi
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004bb49
mov esp, ebp
pop ebp
ret
Function at 0x10002b00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100e57c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.100022e0
mov ebx, eax
cmp ebx, esi
je 0x10002b7a
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x10002b65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004bb49
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10002bfc
mov edi, edi
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.10002b00
mov ebx, eax
cmp ebx, esi
jne 0x10002b54
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10002bb0
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x10002c15
push eax
call ebx
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x218]
push eax
mov ecx, edi
mov dword [ebp - 0x20c], esi
call fcn.10002190
mov edi, eax
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x10002c38
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bb49
mov esp, ebp
pop ebp
ret 4
Function at 0x10006a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062516
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x100e57c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x10006add
call fcn.10002000
mov edi, eax
jmp 0x10006bc2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10006af6
call fcn.10002000
jmp 0x10006bb9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x10006b14
call fcn.10002000
jmp 0x10006bb9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x41c], edi
cmp eax, edi
jae 0x10006b35
mov edi, 0x8007000e
jmp 0x10006bbb
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10003710
mov dword [ebp - 4], 1
jmp 0x10006b6d
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x10006b7e
mov edi, 0x8007000e
jmp 0x10006bbb
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10006b97
call fcn.10002000
jmp 0x10006bb9
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.10005f80
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x10006be0
lea ecx, [ebp - 0x418]
call fcn.10002a20
jmp 0x10006be0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004bb49
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000a1d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006293b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100e57c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.ATL::CComAggObject_class_CCxHDMasterVolumeControl_.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], vtable.CProxy_ICxHDAudioVolumeEvents_class_CCxHDMasterVolumeControl_.0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x44], eax
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.7.0
mov dword [esi + 0xc], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.6.0
mov dword [esi + 0x10], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.5.0
mov dword [esi + 0x14], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.4.0
mov dword [esi + 0x18], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.3.0
mov dword [esi + 0x1c], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.2.0
mov dword [esi + 0x20], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.1.0
mov dword [esi + 0x24], vtable.ATL::CComContainedObject_class_CCxHDMasterVolumeControl_.0
mov dword [esi + 0x30], ecx
mov ecx, dword [0x100e6c84]
mov edx, dword [ecx]
mov dword [ebp - 4], eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000bcb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062cec
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100e57c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], vtable.CProxy_ICxHDAudioJackConfigEvents_class_CCxHDAudioJackConfig_.0
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], vtable.CCxHDAudioDeviceManager.0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
push str.CXHDMI.DLL
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
mov dword [esi + 0x30], ebx
call fcn.1000b520
mov edi, dword [esi + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x1000bd34
push 0x1006a218
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0xffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000da20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062d6b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100e57c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], vtable.CProxy_ICxHDAudioSpeakerDeviceEvents_class_CCxHDAudioSpeakerDevice_.0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.10013d10
mov ecx, dword [ebp + 8]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], vtable.CCxHDAudioPlayer.0
mov eax, dword [0x100da014]
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x58], 1
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.7.0
mov dword [esi + 4], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.6.0
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.5.0
mov dword [esi + 0x14], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.4.0
mov dword [esi + 0x18], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.3.0
mov dword [esi + 0x1c], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.2.0
mov dword [esi + 0x30], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.1.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_CCxHDAudioSpeakerDevice_.0
mov dword [esi + 0x38], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000db00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062d6b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100e57c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], vtable.CProxy_ICxHDAudioHeadphoneDeviceEvents_class_CCxHDAudioHeadphoneDevice_.0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.10013d10
mov ecx, dword [ebp + 8]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x50], vtable.CCxHDAudioPlayer.0
mov eax, dword [0x100da014]
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x54], 1
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.7.0
mov dword [esi + 4], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.6.0
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.5.0
mov dword [esi + 0x14], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.4.0
mov dword [esi + 0x18], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.3.0
mov dword [esi + 0x1c], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.2.0
mov dword [esi + 0x30], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.1.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_CCxHDAudioHeadphoneDevice_.0
mov dword [esi + 0x38], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4