joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021a80
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100431e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005e3c8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x38]
push 0xfde9
push eax
or edi, 0xffffffff
call fcn.10018800
mov ecx, dword [esp + 0x3c]
push 0xfde9
push ecx
mov ecx, esi
mov ebx, eax
call fcn.10018800
mov edx, dword [esp + 0x40]
push 0xfde9
push edx
mov ecx, esi
mov ebp, eax
call fcn.10018800
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
push 0xfde9
push eax
mov ecx, esi
call fcn.10018800
mov ecx, dword [esp + 0x48]
push 0xfde9
push ecx
mov ecx, esi
mov dword [esp + 0x44], eax
call fcn.10018800
mov edx, dword [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x44], eax
call fcn.1001a970
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
call fcn.10020b80
test al, al
jne 0x10021b3d
mov ecx, dword [esi]
push 0x98970e
call dword [sym.imp.XecureMacuxCSM.dll_public:_void___thiscall_XWClientSM::setError_int_]
jmp 0x10021c2b
mov edx, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.10018ea0
mov eax, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
mov dword [esp + 0x34], 0
call fcn.10018ea0
mov edx, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x38], 1
call fcn.10018ea0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebp
mov byte [esp + 0x3c], 2
call fcn.10018ea0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
mov byte [esp + 0x40], 3
call fcn.10018ea0
mov eax, dword [esp + 0x48]
push eax
mov byte [esp + 0x40], 4
call dword [sym.imp.NativeMngUAC.dll_void____cdecl_GetpObjElevator_void_]
mov ecx, eax
mov dword [esp + 0x40], 0xffffffff
call fcn.1001dad0
mov edi, eax
test edi, edi
je 0x10021c08
call dword [sym.imp.NativeMngUAC.dll_void____cdecl_GetpObjElevator_void_]
mov ecx, dword [eax]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ecx + 0x4c]
mov dword [esp + 0x38], 0
call eax
test eax, eax
jge 0x10021bf9
mov ecx, dword [esp + 0x34]
push 0x1004adf4
push ecx
push eax
call fcn.10041d70
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push edx
call dword [sym.imp.XecureMacuxCSM.dll_public:_void___thiscall_XWClientSM::setError_int_]
jmp 0x10021c2b
mov eax, 0x51eb851f
imul dword [esp + 0x34]
mov ecx, dword [esi]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
push 1
push 0
push eax
call dword [sym.imp.XecureMacuxCSM.dll_public:_char____thiscall_XWClientSM::getMediaList_int__int__int_]
call dword [sym.imp.NativeMngUAC.dll_int___stdcall_xwUACUnInitialize_void_]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
push ebp
call esi
mov ecx, dword [esp + 0x38]
push ecx
call esi
mov edx, dword [esp + 0x3c]
push edx
call esi
mov eax, dword [esp + 0x40]
push eax
call esi
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x1c
Function at 0x100222a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10043320
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005e3c8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push 0xfde9
push eax
or edi, 0xffffffff
call fcn.10018800
mov ecx, dword [esp + 0x34]
push 0xfde9
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10018800
mov edx, dword [esp + 0x38]
push 0xfde9
push edx
mov ecx, esi
mov dword [esp + 0x3c], eax
call fcn.10018800
mov ebx, dword [esp + 0x4c]
push 0xfde9
push ebx
mov ecx, esi
mov dword [esp + 0x40], eax
call fcn.10018800
mov ebp, dword [esp + 0x28]
push ebp
mov ecx, esi
mov dword [esp + 0x50], eax
call fcn.1001a970
push ebp
mov ecx, esi
call fcn.10020b80
test al, al
jne 0x10022346
mov ecx, dword [esi]
push 0x98970e
call dword [sym.imp.XecureMacuxCSM.dll_public:_void___thiscall_XWClientSM::setError_int_]
jmp 0x1002242c
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
call fcn.10018e10
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
mov dword [esp + 0x3c], 0
call fcn.10018ea0
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
mov byte [esp + 0x40], 1
call fcn.10018ea0
mov eax, dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
mov byte [esp + 0x44], 2
call fcn.10018ea0
mov ecx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.NativeMngUAC.dll_void____cdecl_GetpObjElevator_void_]
push ecx
mov byte [esp + 0x44], 3
call ebp
mov ecx, eax
mov dword [esp + 0x44], 0xffffffff
call fcn.1001e730
mov edi, eax
test edi, edi
je 0x1002240b
call ebp
mov ebx, eax
mov edx, dword [ebx]
mov ecx, dword [edx + 0x4c]
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x38], 0
call ecx
test eax, eax
jge 0x100223fc
push 0x1004adf4
push ebx
push eax
call fcn.10041d70
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push edx
call dword [sym.imp.XecureMacuxCSM.dll_public:_void___thiscall_XWClientSM::setError_int_]
jmp 0x1002242c
mov eax, 0x51eb851f
imul ebx
mov ecx, dword [esi]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
push 1
push 0
push eax
call dword [sym.imp.XecureMacuxCSM.dll_public:_char____thiscall_XWClientSM::getMediaList_int__int__int_]
call dword [sym.imp.NativeMngUAC.dll_int___stdcall_xwUACUnInitialize_void_]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
call esi
mov eax, dword [esp + 0x38]
push eax
call esi
mov ecx, dword [esp + 0x4c]
push ecx
call esi
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x28
Function at 0x100260e0
Capabilities:
Get common file path
Get program files directory
Link many functions at runtime

Disassembly:
sub esp, 0x108
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov ebx, ecx
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0xc]
add edi, 0xffffffff
cmp dword [ebx + 0x1c], 1
jne 0x10026148
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10026130
mov ecx, 0xb
mov esi, str.BeSoftEnC_OpenKeyboardDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
jmp 0x10026160
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10026148
mov ecx, 0xd
mov esi, str.SoftForumXecureWebNPPlugindllDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x10026191
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.initOpenkeyboardDll
push eax
call esi
mov dword [ebx], eax
mov eax, dword [ebx + 0x18]
push str.getOpenkeyboardData
push eax
call esi
mov ecx, dword [ebx + 0x18]
push str.getOpenkeyboardDataWinHttp
push ecx
mov dword [ebx + 4], eax
call esi
mov edx, dword [ebx + 0x18]
push str.decryptOpenkeyboardData
push edx
mov dword [ebx + 8], eax
call esi
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x18]
push str.freeOpenkeyboardDll
push eax
call esi
mov ecx, dword [ebx + 0x18]
push str.getOpenkeyboardMessage
push ecx
mov dword [ebx + 0x10], eax
call esi
mov ecx, dword [esp + 0x110]
pop edi
mov dword [ebx + 0x14], eax
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10041218
add esp, 0x108
ret
Function at 0x100264a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call ebx
lea edi, [esp + 0xc]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x100264e5
lea edx, [esp + 0xc]
mov ecx, 0xb
mov esi, str.BeSoftEnC_OpenKeyboardDllOpenkeyboard.dll
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10026210
add esp, 4
test eax, eax
jne 0x10026529
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call ebx
lea edi, [esp + 0xc]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10026551
mov ecx, 0xd
mov esi, str.SoftForumXecureWebNPPlugindllDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0xc]
push edx
movsw word es:[edi], word [esi]
call fcn.10026210
add esp, 4
test eax, eax
jne 0x1002657f
mov eax, 2
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
Function at 0x10026760
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x1004
call fcn.10041250
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push 0xffe
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100267c2
mov ecx, 0x800
lea eax, [esp + 4]
cmp word [eax], 0
je 0x100267da
add eax, 2
sub ecx, 1
jne 0x100267b4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.10041218
add esp, 0x1004
ret
test ecx, ecx
je 0x100267c2
mov eax, 0x800
sub eax, ecx
push str.INCAInternet_nProtect_Online_Security_npk_
mov edx, 0x800
sub edx, eax
push edx
lea eax, [esp + eax*2 + 0xc]
push eax
call fcn.100265a0
test eax, eax
jl 0x100267c2
lea ecx, [esp + 4]
push ecx
push 0x400
lea edx, [esi + 4]
push edx
call fcn.100265a0
test eax, eax
jl 0x100267c2
mov ecx, 0x800
lea eax, [esp + 4]
cmp word [eax], 0
je 0x10026846
add eax, 2
sub ecx, 1
jne 0x10026820
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.10041218
add esp, 0x1004
ret
test ecx, ecx
je 0x100267c2
mov eax, 0x800
sub eax, ecx
push str.nosksdk.dll
mov ecx, 0x800
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0xc]
push edx
call fcn.100265a0
test eax, eax
jl 0x100267c2
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x1004], eax
je 0x100267c2
cmp eax, 0xffffffff
je 0x100267c2
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100267c2
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x1008], eax
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.10041218
add esp, 0x1004
ret
Function at 0x10027530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ebx, ecx
push ebp
push eax
mov edi, ebx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
test esi, esi
jbe 0x100275bd
mov esi, dword [esp + 0x1c]
sub ebp, esi
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x18]
add ebp, 0xffffffff
shr ebp, 4
add ebp, 1
lea ebx, [ebx]
push esi
push 0x10
mov ecx, ebx
call fcn.10026bf0
lea ecx, [edi + 1]
lea eax, [esi + 1]
mov edi, 4
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub edi, 1
jne 0x10027585
mov eax, dword [esp + 0x14]
lea edi, [eax + esi]
add esi, 0x10
sub ebp, 1
jne 0x10027570
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov al, byte [esi + ecx - 1]
cmp al, 0x10
ja 0x100275f2
cmp al, 1
jb 0x100275f2
movzx eax, al
push eax
sub esi, eax
mov edx, ecx
lea eax, [esi + edx]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
pop edi
mov dword [ecx], esi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10

Function at 0x10027c30
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x10027c39
xor al, al
ret
mov dword [eax], 0
mov eax, dword [ecx]
mov dword [eax + 4], 0
mov edx, dword [ecx]
mov dword [edx + 8], 0x6a09e667
mov eax, dword [ecx]
mov dword [eax + 0xc], 0xbb67ae85
mov edx, dword [ecx]
mov dword [edx + 0x10], 0x3c6ef372
mov eax, dword [ecx]
mov dword [eax + 0x14], 0xa54ff53a
mov edx, dword [ecx]
mov dword [edx + 0x18], 0x510e527f
mov eax, dword [ecx]
mov dword [eax + 0x1c], 0x9b05688c
mov edx, dword [ecx]
mov dword [edx + 0x20], 0x1f83d9ab
mov eax, dword [ecx]
mov dword [eax + 0x24], 0x5be0cd19
mov al, 1
ret
Function at 0x1002b0e0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x808
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push 0x800
lea eax, [esp + 9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x10], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x801
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1002b127
mov edx, dword [str.UbiKeyWin32.dll]
mov ecx, dword [0x1004dcac]
mov dword [eax], edx
mov edx, dword [0x1004dcb0]
mov dword [eax + 4], ecx
mov ecx, dword [0x1004dcb4]
mov dword [eax + 8], edx
mov dl, byte [0x1004dcb8]
mov dword [eax + 0xc], ecx
push 8
mov byte [eax + 0x10], dl
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x1002b18c
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.10041218
add esp, 0x808
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Tranx2PC
push eax
call edi
mov ecx, dword [esi + 0x2c]
push str.Tranx2Phone
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x2c]
push str.GetCert
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x2c]
push str.GetKey
push eax
call edi
mov ecx, dword [esi + 0x2c]
push str.SetCert
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x2c]
push str.SetKey
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x2c]
push str.GetUBIKeyVer
push eax
call edi
mov ecx, dword [esp + 0x80c]
mov dword [esi + 0x1c], eax
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10041218
add esp, 0x808
ret
Function at 0x1002b4b0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x82c
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x830]
push ebp
push esi
mov dword [esp + 8], eax
xor eax, eax
push 0x800
push eax
lea ecx, [esp + 0x35]
push ecx
xor ebp, ebp
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov word [esp + 0x35], ax
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x801
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x2c]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1002b530
mov ecx, dword [str.UbiKeyWin32.dll]
mov edx, dword [0x1004dcac]
mov dword [eax], ecx
mov ecx, dword [0x1004dcb0]
mov dword [eax + 4], edx
mov edx, dword [0x1004dcb4]
mov dword [eax + 8], ecx
mov cl, byte [0x1004dcb8]
push 8
mov dword [eax + 0xc], edx
push 0
lea edx, [esp + 0x34]
push edx
mov byte [eax + 0x10], cl
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
jne 0x1002b595
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.10041218
add esp, 0x82c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Tranx2PC
push esi
call edi
test eax, eax
jne 0x1002b5b0
lea ebp, [eax - 0xb]
jmp 0x1002b64a
push str.Tranx2Phone
push esi
call edi
test eax, eax
jne 0x1002b5c4
lea ebp, [eax - 0xc]
jmp 0x1002b64a
push str.GetCert
push esi
call edi
test eax, eax
jne 0x1002b5d5
lea ebp, [eax - 0xd]
jmp 0x1002b64a
push str.GetKey
push esi
call edi
test eax, eax
jne 0x1002b5e6
lea ebp, [eax - 0xe]
jmp 0x1002b64a
push str.SetCert
push esi
call edi
test eax, eax
jne 0x1002b5f7
lea ebp, [eax - 0xf]
jmp 0x1002b64a
push str.SetKey
push esi
call edi
test eax, eax
jne 0x1002b608
lea ebp, [eax - 0x10]
jmp 0x1002b64a
push str.GetUbikeyVer
push esi
call edi
test eax, eax
jne 0x1002b619
lea ebp, [eax - 0x11]
jmp 0x1002b64a
mov edi, dword [esp + 0xc]
test edi, edi
je 0x1002b64a
lea ecx, [esp + 0x10]
push 0x20
push ecx
call eax
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1002b645
lea edx, [esp + 0x10]
push edi
push edx
call fcn.1002b210
add esp, 8
test eax, eax
je 0x1002b64a
mov ebp, 0xffffffee
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x834]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.10041218
add esp, 0x82c
ret
Function at 0x1002b6d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov ebx, ecx
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push 0
push str.K_cert.dll
call ebp
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x1002b7be
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x10]
add edi, 0xffffffff
jmp 0x1002b740
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x1002b740
mov ecx, 7
mov esi, str.AppDataLocalLowkdefense_
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
add eax, 0xffffffff
pop edi
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1002b760
mov edx, dword [str.K_cert.dll]
mov ecx, dword [0x1004dd28]
mov dword [eax], edx
mov dx, word [0x1004dd2c]
mov dword [eax + 4], ecx
mov cl, byte [0x1004dd2e]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x14]
push edx
mov byte [eax + 0xa], cl
call ebp
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x1002b7be
pop esi
pop ebp
mov eax, 0x2711
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
mov eax, dword [ebx + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfCertInit
push eax
call esi
mov ecx, dword [ebx + 0xc]
push str.kdfCertGetPwValue
push ecx
mov dword [ebx], eax
call esi
mov edx, dword [ebx + 0xc]
push str.kdfCertfree
push edx
mov dword [ebx + 4], eax
call esi
mov ecx, dword [esp + 0x110]
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10041218
add esp, 0x108
ret
Function at 0x1002b810
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
push 0x103
xor ebp, ebp
lea eax, [esp + 0x15]
push ebp
push eax
mov byte [esp + 0x1c], 0
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push ebp
push str.K_cert.dll
call ebx
mov esi, eax
test esi, esi
jne 0x1002b8dc
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x10]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x1002b878
mov ecx, 7
mov esi, str.AppDataLocalLowkdefense_
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1002b895
mov edx, dword [str.K_cert.dll]
mov ecx, dword [0x1004dd28]
mov dword [eax], edx
mov dx, word [0x1004dd2c]
mov dword [eax + 4], ecx
mov cl, byte [0x1004dd2e]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x18]
push edx
mov byte [eax + 0xa], cl
call ebx
mov esi, eax
test esi, esi
jne 0x1002b8dc
mov eax, 0x2711
jmp 0x1002b926
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfCertInit
push esi
call edi
test eax, eax
jne 0x1002b8f5
mov ebp, 0x2712
jmp 0x1002b919
push str.kdfCertGetPwValue
push esi
call edi
test eax, eax
jne 0x1002b908
mov ebp, 0x2713
jmp 0x1002b919
push str.kdfCertfree
push esi
call edi
test eax, eax
jne 0x1002b919
mov ebp, 0x2714
test esi, esi
je 0x1002b924
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebp
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
Function at 0x1002ba80
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1005e3c8]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push 0
push str.kdfdec.dll
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x1002bb42
push 0x104
lea ecx, [esp + 0xc]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 8]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1002bae5
mov edx, dword [str.kdfdec.dll]
mov ecx, dword [0x1004dda8]
mov dword [eax], edx
mov dx, word [0x1004ddac]
mov dword [eax + 4], ecx
mov cl, byte [0x1004ddae]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x10]
push edx
mov byte [eax + 0xa], cl
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x1002bb42
pop edi
mov eax, 0x4e21
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10041218
add esp, 0x108
ret
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfDecCreateContext
push eax
call edi
mov ecx, dword [esi + 0x14]
push str.kdfDecSetPrivateKeyPEMA
push ecx
mov dword [esi], eax
call edi
mov edx, dword [esi + 0x14]
push str.kdfDecSetDecryptionInfoA
push edx
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push str.kdfDecDecryptExA
push eax
call edi
mov ecx, dword [esi + 0x14]
push str.kdfDecDestroyContext
push ecx
mov dword [esi + 0xc], eax
call edi
mov ecx, dword [esp + 0x10c]
mov dword [esi + 0x10], eax
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10041218
add esp, 0x108
ret