joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416962
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x416aaa
xor ecx, ecx
cmp word [eax], cx
je 0x416aaa
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x4169bb
cmp eax, 3
jne 0x4169f5
cmp word [esp + 0xa], 0x3a
jne 0x4169f5
cmp eax, 2
jne 0x4169d9
lea eax, [esp + 8]
push 0x41b594
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x416aaa
push 0xfffffffffffffffe
pop edi
jmp 0x416aaa
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x416a0a
cmp ax, bx
jne 0x416a14
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x4169fd
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x416a53
test byte [esp + 0x21c], 0x10
je 0x416a3a
push 0xfffffffffffffffe
pop edi
jmp 0x416a4a
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x416aa8
cmp word [esp + 0x10], bp
jne 0x416a61
cmp word [esp + 0x12], bp
je 0x416a80
cmp word [esp + 0x10], bx
jne 0x416a6f
cmp word [esp + 0x12], bx
je 0x416a80
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x416aa8
cmp word [esp + 0x12], ax
jne 0x416aa8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x416a95
test al, 0x10
je 0x416aa8
jmp 0x416aa5
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x416aa8
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x416b76
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x416c4b
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x416c4a
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.00416f88
push esi
mov word [ebp - 0x20], ax
call fcn.00416fae
push esi
mov word [ebp - 0x1e], ax
call fcn.00416fd0
push esi
mov word [ebp - 0x1c], ax
call fcn.00416ff1
push esi
mov word [ebp - 0x1a], ax
call fcn.00417012
push esi
mov word [ebp - 0x18], ax
call fcn.00417033
push esi
mov word [ebp - 0x16], ax
call fcn.00417054
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x416c29
lea eax, [ebp - 8]
jmp 0x416c37
cmp dword [ebp + 0xc], 2
jne 0x416c34
lea ecx, [ebp - 8]
jmp 0x416c37
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4170f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41712c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4175a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x417605
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4175fd
push dword [esp + 0x10]
push dword [0x425660]
call fcn.00418484
test eax, eax
je 0x4175f3
cmp dword [eax + 4], 0
je 0x4175e2
push edi
push esi
push eax
call fcn.00417730
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x417610
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x417631
push esi
call fcn.004170f0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x4176a5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x417692
dec ecx
je 0x41767d
sub ecx, 2
je 0x41766a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4176ea
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x41770b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x417730
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x417837
cmp dword [esi + 0x14], 1
jne 0x41777b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x4177f8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x4177e3
dec eax
je 0x4177cc
sub eax, 2
je 0x4177b7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.004170f0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x417825
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x4177a1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x419079
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4190ee
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x419097
mov esi, 0x41b00c
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4190e5
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4190e5
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4
Function at 0x10004530
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
push ecx
push str._s:_
lea edx, [ebp - 0x28]
push edx
call fcn.10003cf0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000457b
xor eax, eax
jmp 0x100046b7
cmp dword [ebp - 4], 1
jne 0x1000458b
mov eax, 1
jmp 0x100046b7
cmp dword [ebp - 4], 3
jne 0x100045a3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10004628
cmp dword [ebp - 4], 2
jne 0x100045b8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 2
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10004628
cmp dword [ebp - 4], 4
jne 0x100045cd
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10004628
cmp dword [ebp - 4], 5
jne 0x100045e2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 8
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10004628
cmp dword [ebp - 4], 6
jne 0x100045f7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x10
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10004628
mov ecx, dword [ebp - 4]
push ecx
push str.New_drive_type:__d
lea edx, [ebp - 0xa8]
push edx
call fcn.10003cf0
add esp, 0xc
push 0x10000
push str.Drive_Type
lea eax, [ebp - 0xa8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x61
je 0x10004654
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x62
je 0x10004654
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
je 0x10004654
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x42
jne 0x10004666
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 0x100
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x100046b5
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
and ecx, 1
je 0x10004681
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x100
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x100046b5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
and eax, 8
jne 0x100046b5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
and edx, 2
jne 0x100046b5
lea eax, [ebp - 0x28]
push eax
call fcn.100044b0
add esp, 4
test eax, eax
je 0x100046b5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x100
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x100060e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
mov dword [ebp - 0xc], 0xf
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.10031ea0
add esp, 0xc
mov byte [ebp - 0x16], 0
movzx eax, word [ebp - 0x20]
and eax, 0x7fff
mov word [ebp - 0x20], ax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x10006138
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jge 0x10006154
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0xd]
xor eax, edx
mov byte [ebp - 0xd], al
jmp 0x1000612f
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xe]
movzx eax, byte [ebp - 0xd]
cmp edx, eax
jne 0x10006167
xor eax, eax
jmp 0x1000616c
mov eax, 2
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret

Function at 0x100061e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0xd], 0
mov dword [ebp - 0xc], 0xa
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.10031ea0
add esp, 0xc
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x10006221
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jge 0x1000623d
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xd]
xor edx, ecx
mov byte [ebp - 0xd], dl
jmp 0x10006218
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 9]
movzx edx, byte [ebp - 0xd]
cmp ecx, edx
jne 0x10006250
xor eax, eax
jmp 0x10006255
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x10006ad0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 0x38], 0xf
cmp dword [ebp + 0x10], 0
je 0x10006b0c
mov eax, dword [ebp + 0x10]
push eax
call fcn.1002d6f0
add esp, 4
cmp eax, 0x10
jbe 0x10006b0c
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 0x10], 0
push 0x10195970
mov edx, dword [ebp + 8]
push edx
call fcn.10003c90
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10006b30
mov eax, 0xc9
jmp 0x10006c7c
mov eax, 3
mov word [ebp - 4], ax
cmp dword [ebp + 0x10], 0
jne 0x10006b7b
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.10032e00
add esp, 0x10
cmp eax, dword [ebp - 0x38]
je 0x10006b70
mov ecx, dword [ebp - 8]
push ecx
call fcn.1002ac50
add esp, 4
mov eax, 0xca
jmp 0x10006c7c
xor edx, edx
mov word [ebp - 4], dx
jmp 0x10006c42
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10033a60
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.10032e00
add esp, 0x10
cmp eax, dword [ebp - 0xc]
jne 0x10006c42
lea eax, [ebp - 0x30]
push eax
call fcn.10006a20
add esp, 4
movzx ecx, ax
test ecx, ecx
jne 0x10006c1f
mov edx, dword [ebp + 0x10]
push edx
call fcn.1002d6f0
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.10033170
add esp, 0xc
test eax, eax
jne 0x10006c1f
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10032e00
add esp, 0x10
cmp eax, dword [ebp - 0x38]
je 0x10006c17
mov edx, dword [ebp - 8]
push edx
call fcn.1002ac50
add esp, 4
mov eax, 0xca
jmp 0x10006c7c
xor eax, eax
mov word [ebp - 4], ax
jmp 0x10006c42
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10033a60
add esp, 0xc
jmp 0x10006b96
mov ecx, dword [ebp - 8]
push ecx
call fcn.1002ac50
add esp, 4
movzx edx, word [ebp - 4]
test edx, edx
je 0x10006c5c
mov ax, word [ebp - 4]
jmp 0x10006c7c
lea eax, [ebp - 0x38]
push eax
push 0
push 0xf
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100068a0
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
call fcn.100060e0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x10006c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x10195868
push 0x10195974
lea eax, [ebp - 0x218]
push eax
call fcn.10003cf0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.10006ad0
add esp, 0xc
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
test ecx, ecx
jne 0x10006ce5
mov ax, word [ebp - 4]
jmp 0x10006d3d
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x110]
push eax
push 0x10195988
lea ecx, [ebp - 0x218]
push ecx
call fcn.10003cf0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10006ad0
add esp, 0xc
mov word [ebp - 4], ax
movzx edx, word [ebp - 4]
test edx, edx
jne 0x10006d39
xor eax, eax
jmp 0x10006d3d
mov ax, word [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x100078d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x100078ff
push 0x10195a14
lea eax, [ebp - 0x12c]
push eax
call fcn.10003cb0
add esp, 8
jmp 0x10007912
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.10003cb0
add esp, 8
lea eax, [ebp - 0x12c]
push eax
push 0x10195a1c
lea ecx, [ebp - 0x108]
push ecx
call fcn.10003cf0
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x130]
push eax
push 0
push 0x20019
push 0
push 0x10195a38
push 0
lea ecx, [ebp - 0x108]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10007976
mov eax, 0x19a
jmp 0x10007a13
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x134]
push edx
push 0
push 0x10195a4c
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100079bd
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x10007a13
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x134]
push edx
push 0
push 0x10195a5c
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10007a04
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x10007a13
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x10007a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x10007a5f
push 0x10195a68
lea eax, [ebp - 0x12c]
push eax
call fcn.10003cb0
add esp, 8
jmp 0x10007a7b
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.10003d40
add esp, 0xc
mov byte [ebp - 0x10d], 0
lea eax, [ebp - 0x12c]
push eax
push str.SoftwareRADinfo_sCOMMON
lea ecx, [ebp - 0x108]
push ecx
call fcn.10003cf0
add esp, 0xc
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x130]
push eax
push 0
push 0xf003f
push 0
push str.RADinfo_Software
push 0
lea ecx, [ebp - 0x108]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10007adc
mov eax, 0x19a
jmp 0x10007b3f
mov edx, dword [ebp + 8]
push edx
call fcn.1002d6f0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.ApplicationCode
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 0xc]
push edx
call fcn.1002d6f0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.SerialCode
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret

Function at 0x10007b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xe6a97384
mov dword [ebp - 4], 0
jmp 0x10007b6f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10007bb5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
shl eax, 0x10
and eax, 0xff0000
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
and edx, 0xff
or eax, edx
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp - 8]
shr ecx, 0x1c
and ecx, 0xf
or eax, ecx
mov dword [ebp - 8], eax
jmp 0x10007b66
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret