joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10148a2c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x102b61c8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10148a6f
cmp word [esi], dx
jne 0x10148a6f
or byte [edi + eax + 0x28], 4
jmp 0x10148a74
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10148bc7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10148ba7
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10148ab6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10148aec
cmp eax, edx
jae 0x10148af8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x10148a8e
jmp 0x10148bc7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10148ba3
cmp dword [ebp - 0x14], 0
je 0x10148ba3
mov eax, dword [ebx*4 + 0x102b61c8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10148b7b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10148b44
mov word [esi], cx
jmp 0x10148b77
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x102b61c8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x102b61c8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x102b61c8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x10148bc7
pop ebx
cmp word [ebp - 4], bx
jne 0x10148b8c
cmp esi, dword [ebp + 0xc]
jne 0x10148b8c
mov word [esi], bx
jmp 0x10148bc4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.101495fa
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10148bc7
push 0xd
jmp 0x10148bc0
mov ecx, dword [ebx*4 + 0x102b61c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10148bbe
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10148bc7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x101493e8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10149259
Function at 0x1014f168
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1014f205
push ebx
push esi
call fcn.1014f131
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1014dc72
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1014f1b2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1014f204
push edi
push eax
call fcn.10143852
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1014f1d2
call fcn.10143818
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1014f203
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1014dc72
add esp, 0x20
test eax, eax
jne 0x1014f1f1
push edi
call fcn.10143818
jmp 0x1014f1f9
push ebx
call fcn.10143818
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1014f208
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1014f219
pop esi
ret
push ebx
push edi
push esi
call fcn.1014f131
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10143852
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1014f241
push ebx
push esi
push edi
call fcn.101294d0
add esp, 0xc
push 0
call fcn.10143818
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1014f98d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014f4b4
Function at 0x101561af
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1015612b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10156327
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10156327
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x101562d6
jg 0x10156208
test eax, eax
je 0x101562cc
push 1
push 0x1000
call fcn.101467c3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1015622e
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x101562c3
push 0x8000
push ebx
call fcn.1015605c
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1015625a
jg 0x10156255
cmp ecx, 0x1000
jb 0x1015625a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.101486e0
add esp, 0x10
cmp eax, 0xffffffff
je 0x1015629f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10156255
jl 0x10156286
test ecx, ecx
jne 0x10156247
push dword [ebp - 0xc]
push ebx
call fcn.1015605c
push esi
call fcn.10143818
add esp, 0xc
xor edi, edi
jmp 0x10156338
cmp byte [edi + 0x24], 0
je 0x101562b6
cmp dword [edi + 0x20], 5
jne 0x101562b6
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x101562c1
mov edi, dword [edi + 0x18]
jmp 0x101562c3
xor edi, edi
push esi
call fcn.10143818
pop ecx
jmp 0x10156338
test ecx, ecx
jg 0x10156298
jl 0x101562d6
test eax, eax
jae 0x10156298
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.101495fa
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x101562f9
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10156298
jmp 0x10156330
push ebx
call fcn.101550ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10156298
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x10156338
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10156335
mov edi, dword [edi + 0x18]
jmp 0x10156338
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.101495fa
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10157dc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10157ded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10157ded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
test esi, esi
jne 0x404c82
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
test edx, edx
jne 0x404c99
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x404c90
sub edx, ecx
mov eax, 0xffffffff
cmp edx, 8
jb 0x404d7f
push edi
mov edi, edx
shr edi, 3
nop dword [eax]
movzx ecx, byte [esi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 1]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 2]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 3]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 4]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 5]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 6]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 7]
xor eax, 0x55555555
xor ecx, eax
add esi, 8
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + str.UUUU]
xor eax, 0x55555555
sub edi, 1
jne 0x404cb0
pop edi
test edx, edx
je 0x404da2
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
xor eax, 0x55555555
sub edx, 1
jne 0x404d83
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404db0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
xor esi, esi
push esi
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0x409e40
push eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
call edi
test eax, eax
jne 0x404e07
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0x409e40
lea eax, [ebp - 8]
push eax
call edi
test eax, eax
je 0x404ebf
test ebx, ebx
je 0x404ebf
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x404ebf
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x404e9c
push 0
push edi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x404e8e
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0xc]
push 0x6801
push dword [ebp - 8]
call dword [0x40ed80]
test eax, eax
je 0x404e8e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push 0
push 1
push 0
push dword [ebp - 0x10]
call dword [0x40ed84]
test eax, eax
mov ecx, 1
mov eax, dword [ebp - 0x10]
cmovne esi, ecx
test eax, eax
je 0x404e8e
push eax
call dword [0x40ed88]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x404e9c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x404eac
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040780e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040780e
mov esp, ebp
pop ebp
ret
Function at 0x405480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor esi, esi
mov ecx, dword [ebx + 0x3c]
mov edi, dword [ecx + ebx + 0x78]
mov ecx, dword [edi + ebx + 0x24]
add edi, ebx
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x18], esi
jbe 0x405502
nop
mov ecx, dword [eax + esi*4]
add ecx, ebx
call fcn.00405400
mov ecx, dword [ebp - 4]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4054f0
test dl, dl
je 0x4054ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4054f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4054d0
xor eax, eax
jmp 0x4054f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40550b
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4054c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001087
Capabilities:
Print debug messages

Disassembly:
jmp 0x10008380
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10020eab
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
push str.YTClientWnd
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
jne 0x100083d0
push str.SPI_NOT_FIND_CLIENT_WINDOW_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
add esp, 0x12c
ret
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x138]
lea eax, [esp + 0x24]
push eax
lea ecx, [edi + 0x464]
push ecx
call fcn.10001474
add esp, 8
lea ecx, [esp + 0x14]
call fcn.1001f284
push 0
lea edx, [esp + 0x28]
push 0x3002
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x13c], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x1000844d
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFile::GetLength
cmp eax, 0xfa0
jbe 0x10008444
push 0xf3c
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFile::SetLength
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFile::Close
xor eax, eax
lea ecx, [esp + 8]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xc60
push eax
push 0x4a
mov dword [esp + 0x1c], eax
push esi
mov dword [esp + 0x1c], 0x874
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [esp + 0x128]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x12c
ret

Function at 0x1000108c
Capabilities:
Print debug messages

Disassembly:
jmp 0x1000a380
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10021170
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov ebp, ecx
mov edx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], 0
cmp ecx, 0x400
jbe 0x1000a3c0
mov byte [edx + 0x400], al
mov edi, dword [esp + 0x1c]
mov ecx, ebp
lea esi, [edi + 0x404]
push esi
push edx
call fcn.1000109b
push esi
call fcn.1000174e
add esp, 4
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::TrimRight_1
push 0x20
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.sname_
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
push str.
call esi
push edi
mov ecx, ebp
call fcn.10001195
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x14
Function at 0x100010b4
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10015b80
push 0xffffffffffffffff
push 0x10021bda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [esi + 0xc]
mov ebx, 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0xff
mov ecx, dword [eax - 8]
mov dword [esp + 0x124], 2
test ecx, ecx
mov edi, ebx
jg 0x10015bec
mov esi, dword [esp + 0x12c]
push 0x1002dab8
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
jmp 0x10015cb6
push ecx
lea edx, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.1001f28a
mov ecx, esi
call fcn.10001357
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x10015c14
cmp eax, 2
jne 0x10015c34
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esi], eax
je 0x10015c4c
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0x134]
push eax
mov ecx, esi
call fcn.1001f28a
jmp 0x10015cb2
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi], eax
je 0x10015c78
xor edi, edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x10015c9f
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.1001f28a
jmp 0x10015cb2
mov esi, dword [esp + 0x12c]
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x130]
mov byte [esp + 0x124], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x134]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x11c
ret 0xc

Function at 0x100010dc
Capabilities:
Check os version

Disassembly:
jmp 0x10010520
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x1001056f
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x1001055d
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
jne 0x1001056f
add esp, 0x94
ret
cmp eax, 6
jne 0x1001056f
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x10010571
xor eax, eax
add esp, 0x94
ret
Function at 0x100010e1
Capabilities:
Get common file path

Disassembly:
jmp 0x1001ac10
push 0xffffffffffffffff
push 0x10022194
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebp, [esi + 4]
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x128], 0
push eax
mov dword [esi], 0x10024278
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0xc]
push str.Setupmsback1
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x130], 1
call sub.MFC42.DLL_operator_1
push eax
mov ecx, ebp
mov byte [esp + 0x128], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x10001104
Capabilities:
Check os version

Disassembly:
jmp 0x1001a7c0
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x1001a80f
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x1001a7fd
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
jne 0x1001a80f
add esp, 0x94
ret
cmp eax, 6
jne 0x1001a80f
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x1001a811
xor eax, eax
add esp, 0x94
ret
Function at 0x10001113
Capabilities:
Read file via mapping

Disassembly:
jmp 0x1000e110
sub esp, 0x20
xor eax, eax
mov dword [0x10035018], eax
push esi
mov esi, dword [esp + 0x28]
test esi, esi
je 0x1000e132
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jle 0x1000e132
mov eax, dword [esi]
mov dword [0x10035018], eax
push eax
push str.SetExcludePort_nExcludePortCount:__d_
call fcn.10001717
mov eax, dword [0x10035018]
add esp, 8
cmp eax, 1
jge 0x1000e170
mov eax, dword [0x1002e284]
test eax, eax
je 0x1000e164
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002e284], 0
mov eax, 1
pop esi
add esp, 0x20
ret 8
push ebx
xor ebx, ebx
test eax, eax
push edi
jle 0x1000e198
lea edi, [esi + 0xc]
mov eax, dword [edi]
push eax
push str.Exclude_Port_is___d_
call fcn.10001717
mov eax, dword [0x10035018]
add esp, 8
add edi, 0x10
inc ebx
cmp ebx, eax
jl 0x1000e17b
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
lea edx, [esp + 0x20]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalExcludePort_MapFile
push 0x1000
push 0
lea ecx, [esp + 0x18]
push 4
lea eax, [esp + 0x28]
push ecx
push 0xffffffffffffffff
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x1002e284], eax
je 0x1000e232
cmp eax, 0xffffffff
je 0x1000e232
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x1000e232
mov ecx, dword [esp + 0x34]
mov edi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push str.SetExcludePort_______Set_Exclude_Port_Map_success
call fcn.10001672
add esp, 4
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x20
ret 8

Function at 0x10001131
Capabilities:
Write file on windows

Disassembly:
jmp 0x10003810
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edx, dword [0x1002d6d0]
add esp, 0xc
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret