joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013b60
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x1004
call fcn.1002d790
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push 0xffe
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10013bc2
mov ecx, 0x800
lea eax, [esp + 4]
cmp word [eax], 0
je 0x10013bda
add eax, 2
sub ecx, 1
jne 0x10013bb4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1002d777
add esp, 0x1004
ret
test ecx, ecx
je 0x10013bc2
mov eax, 0x800
sub eax, ecx
push str.INCAInternet_nProtect_Online_Security_npk_
mov edx, 0x800
sub edx, eax
push edx
lea eax, [esp + eax*2 + 0xc]
push eax
call fcn.100139a0
test eax, eax
jl 0x10013bc2
lea ecx, [esp + 4]
push ecx
push 0x400
lea edx, [esi + 4]
push edx
call fcn.100139a0
test eax, eax
jl 0x10013bc2
mov ecx, 0x800
lea eax, [esp + 4]
cmp word [eax], 0
je 0x10013c46
add eax, 2
sub ecx, 1
jne 0x10013c20
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1002d777
add esp, 0x1004
ret
test ecx, ecx
je 0x10013bc2
mov eax, 0x800
sub eax, ecx
push str.nosksdk.dll
mov ecx, 0x800
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0xc]
push edx
call fcn.100139a0
test eax, eax
jl 0x10013bc2
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x1004], eax
je 0x10013bc2
cmp eax, 0xffffffff
je 0x10013bc2
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10013bc2
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x1008], eax
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1002d777
add esp, 0x1004
ret
Function at 0x10014920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ebx, ecx
push ebp
push eax
mov edi, ebx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
test esi, esi
jbe 0x100149ad
mov esi, dword [esp + 0x1c]
sub ebp, esi
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x18]
add ebp, 0xffffffff
shr ebp, 4
add ebp, 1
lea ebx, [ebx]
push esi
push 0x10
mov ecx, ebx
call fcn.10013fe0
lea ecx, [edi + 1]
lea eax, [esi + 1]
mov edi, 4
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub edi, 1
jne 0x10014975
mov eax, dword [esp + 0x14]
lea edi, [eax + esi]
add esi, 0x10
sub ebp, 1
jne 0x10014960
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov al, byte [esi + ecx - 1]
cmp al, 0x10
ja 0x100149e2
cmp al, 1
jb 0x100149e2
movzx eax, al
push eax
sub esi, eax
mov edx, ecx
lea eax, [esi + edx]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
pop edi
mov dword [ecx], esi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10

Function at 0x10015020
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x10015029
xor al, al
ret
mov dword [eax], 0
mov eax, dword [ecx]
mov dword [eax + 4], 0
mov edx, dword [ecx]
mov dword [edx + 8], 0x6a09e667
mov eax, dword [ecx]
mov dword [eax + 0xc], 0xbb67ae85
mov edx, dword [ecx]
mov dword [edx + 0x10], 0x3c6ef372
mov eax, dword [ecx]
mov dword [eax + 0x14], 0xa54ff53a
mov edx, dword [ecx]
mov dword [edx + 0x18], 0x510e527f
mov eax, dword [ecx]
mov dword [eax + 0x1c], 0x9b05688c
mov edx, dword [ecx]
mov dword [edx + 0x20], 0x1f83d9ab
mov eax, dword [ecx]
mov dword [eax + 0x24], 0x5be0cd19
mov al, 1
ret
Function at 0x100183f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov ebx, ecx
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push 0
push str.K_cert.dll
call ebp
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x100184de
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x10]
add edi, 0xffffffff
jmp 0x10018460
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10018460
mov ecx, 7
mov esi, str.AppDataLocalLowkdefense_
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
add eax, 0xffffffff
pop edi
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10018480
mov edx, dword [str.K_cert.dll]
mov ecx, dword [0x10037b84]
mov dword [eax], edx
mov dx, word [0x10037b88]
mov dword [eax + 4], ecx
mov cl, byte [0x10037b8a]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x14]
push edx
mov byte [eax + 0xa], cl
call ebp
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x100184de
pop esi
pop ebp
mov eax, 0x2711
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
mov eax, dword [ebx + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfCertInit
push eax
call esi
mov ecx, dword [ebx + 0xc]
push str.kdfCertGetPwValue
push ecx
mov dword [ebx], eax
call esi
mov edx, dword [ebx + 0xc]
push str.kdfCertfree
push edx
mov dword [ebx + 4], eax
call esi
mov ecx, dword [esp + 0x110]
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1002d777
add esp, 0x108
ret
Function at 0x10018530
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
push 0x103
xor ebp, ebp
lea eax, [esp + 0x15]
push ebp
push eax
mov byte [esp + 0x1c], 0
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push ebp
push str.K_cert.dll
call ebx
mov esi, eax
test esi, esi
jne 0x100185fc
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x10]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10018598
mov ecx, 7
mov esi, str.AppDataLocalLowkdefense_
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x100185b5
mov edx, dword [str.K_cert.dll]
mov ecx, dword [0x10037b84]
mov dword [eax], edx
mov dx, word [0x10037b88]
mov dword [eax + 4], ecx
mov cl, byte [0x10037b8a]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x18]
push edx
mov byte [eax + 0xa], cl
call ebx
mov esi, eax
test esi, esi
jne 0x100185fc
mov eax, 0x2711
jmp 0x10018646
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfCertInit
push esi
call edi
test eax, eax
jne 0x10018615
mov ebp, 0x2712
jmp 0x10018639
push str.kdfCertGetPwValue
push esi
call edi
test eax, eax
jne 0x10018628
mov ebp, 0x2713
jmp 0x10018639
push str.kdfCertfree
push esi
call edi
test eax, eax
jne 0x10018639
mov ebp, 0x2714
test esi, esi
je 0x10018644
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebp
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
Function at 0x100187a0
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push 0
push str.kdfdec.dll
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x10018862
push 0x104
lea ecx, [esp + 0xc]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 8]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10018805
mov edx, dword [str.kdfdec.dll]
mov ecx, dword [0x10037c04]
mov dword [eax], edx
mov dx, word [0x10037c08]
mov dword [eax + 4], ecx
mov cl, byte [0x10037c0a]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x10]
push edx
mov byte [eax + 0xa], cl
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x10018862
pop edi
mov eax, 0x4e21
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfDecCreateContext
push eax
call edi
mov ecx, dword [esi + 0x14]
push str.kdfDecSetPrivateKeyPEMA
push ecx
mov dword [esi], eax
call edi
mov edx, dword [esi + 0x14]
push str.kdfDecSetDecryptionInfoA
push edx
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push str.kdfDecDecryptExA
push eax
call edi
mov ecx, dword [esi + 0x14]
push str.kdfDecDestroyContext
push ecx
mov dword [esi + 0xc], eax
call edi
mov ecx, dword [esp + 0x10c]
mov dword [esi + 0x10], eax
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1002d777
add esp, 0x108
ret
Function at 0x100188d0
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
add esp, 0xc
push 8
push ebx
push str.kdfdec.dll
call edi
mov esi, eax
test esi, esi
jne 0x1001898f
push 0x104
lea ecx, [esp + 0x10]
push ecx
push str.UserProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0xc]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10018932
mov edx, dword [str.kdfdec.dll]
mov ecx, dword [0x10037c04]
mov dword [eax], edx
mov dx, word [0x10037c08]
mov dword [eax + 4], ecx
mov cl, byte [0x10037c0a]
push 8
mov word [eax + 8], dx
push 0
lea edx, [esp + 0x14]
push edx
mov byte [eax + 0xa], cl
call edi
mov esi, eax
test esi, esi
jne 0x1001898f
pop edi
pop esi
mov eax, 0x4e21
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.kdfDecCreateContext
push esi
call edi
test eax, eax
jne 0x100189a8
mov ebx, 0x4e22
jmp 0x100189eb
push str.kdfDecSetPrivateKeyPEMA
push esi
call edi
test eax, eax
jne 0x100189bb
mov ebx, 0x4e23
jmp 0x100189eb
push str.kdfDecSetDecryptionInfoA
push esi
call edi
test eax, eax
jne 0x100189ce
mov ebx, 0x4e24
jmp 0x100189eb
push str.kdfDecDecryptExA
push esi
call edi
test eax, eax
je 0x100189e6
push str.kdfDecDestroyContext
push esi
call edi
test eax, eax
jne 0x100189eb
mov ebx, 0x4e25
test esi, esi
je 0x100189f6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
Function at 0x10018c60
Capabilities:
Get common file path
Get program files directory
Link many functions at runtime

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov ebx, ecx
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0xc]
add edi, 0xffffffff
cmp dword [ebx + 0x1c], 1
jne 0x10018cc8
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10018cb0
mov ecx, 0xb
mov esi, str.BeSoftEnC_OpenKeyboardDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
jmp 0x10018ce0
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10018cc8
mov ecx, 0xd
mov esi, str.SoftForumXecureWebNPPlugindllDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x10018d11
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.initOpenkeyboardDll
push eax
call esi
mov dword [ebx], eax
mov eax, dword [ebx + 0x18]
push str.getOpenkeyboardData
push eax
call esi
mov ecx, dword [ebx + 0x18]
push str.getOpenkeyboardDataWinHttp
push ecx
mov dword [ebx + 4], eax
call esi
mov edx, dword [ebx + 0x18]
push str.decryptOpenkeyboardData
push edx
mov dword [ebx + 8], eax
call esi
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x18]
push str.freeOpenkeyboardDll
push eax
call esi
mov ecx, dword [ebx + 0x18]
push str.getOpenkeyboardMessage
push ecx
mov dword [ebx + 0x10], eax
call esi
mov ecx, dword [esp + 0x110]
pop edi
mov dword [ebx + 0x14], eax
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1002d777
add esp, 0x108
ret
Function at 0x10019020
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call ebx
lea edi, [esp + 0xc]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10019065
lea edx, [esp + 0xc]
mov ecx, 0xb
mov esi, str.BeSoftEnC_OpenKeyboardDllOpenkeyboard.dll
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10018d90
add esp, 4
test eax, eax
jne 0x100190a9
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x14]
push ecx
push 0
call ebx
lea edi, [esp + 0xc]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x100190d1
mov ecx, 0xd
mov esi, str.SoftForumXecureWebNPPlugindllDllOpenkeyboard.dll
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0xc]
push edx
movsw word es:[edi], word [esi]
call fcn.10018d90
add esp, 4
test eax, eax
jne 0x100190ff
mov eax, 2
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002d777
add esp, 0x108
ret
Function at 0x10019230
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x808
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push 0x800
lea eax, [esp + 9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x10], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x801
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10019277
mov edx, dword [str.UbiKeyWin32.dll]
mov ecx, dword [0x10037d68]
mov dword [eax], edx
mov edx, dword [0x10037d6c]
mov dword [eax + 4], ecx
mov ecx, dword [0x10037d70]
mov dword [eax + 8], edx
mov dl, byte [0x10037d74]
mov dword [eax + 0xc], ecx
push 8
mov byte [eax + 0x10], dl
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x100192dc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1002d777
add esp, 0x808
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Tranx2PC
push eax
call edi
mov ecx, dword [esi + 0x2c]
push str.Tranx2Phone
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x2c]
push str.GetCert
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x2c]
push str.GetKey
push eax
call edi
mov ecx, dword [esi + 0x2c]
push str.SetCert
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x2c]
push str.SetKey
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x2c]
push str.GetUBIKeyVer
push eax
call edi
mov ecx, dword [esp + 0x80c]
mov dword [esi + 0x1c], eax
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1002d777
add esp, 0x808
ret
Function at 0x10019530
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x82c
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x830]
push ebp
push esi
mov dword [esp + 8], eax
xor eax, eax
push 0x800
push eax
lea ecx, [esp + 0x35]
push ecx
xor ebp, ebp
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov word [esp + 0x35], ax
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x801
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x2c]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x100195b0
mov ecx, dword [str.UbiKeyWin32.dll]
mov edx, dword [0x10037d68]
mov dword [eax], ecx
mov ecx, dword [0x10037d6c]
mov dword [eax + 4], edx
mov edx, dword [0x10037d70]
mov dword [eax + 8], ecx
mov cl, byte [0x10037d74]
push 8
mov dword [eax + 0xc], edx
push 0
lea edx, [esp + 0x34]
push edx
mov byte [eax + 0x10], cl
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
jne 0x10019615
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.1002d777
add esp, 0x82c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Tranx2PC
push esi
call edi
test eax, eax
jne 0x10019630
lea ebp, [eax - 0xb]
jmp 0x100196ca
push str.Tranx2Phone
push esi
call edi
test eax, eax
jne 0x10019644
lea ebp, [eax - 0xc]
jmp 0x100196ca
push str.GetCert
push esi
call edi
test eax, eax
jne 0x10019655
lea ebp, [eax - 0xd]
jmp 0x100196ca
push str.GetKey
push esi
call edi
test eax, eax
jne 0x10019666
lea ebp, [eax - 0xe]
jmp 0x100196ca
push str.SetCert
push esi
call edi
test eax, eax
jne 0x10019677
lea ebp, [eax - 0xf]
jmp 0x100196ca
push str.SetKey
push esi
call edi
test eax, eax
jne 0x10019688
lea ebp, [eax - 0x10]
jmp 0x100196ca
push str.GetUbikeyVer
push esi
call edi
test eax, eax
jne 0x10019699
lea ebp, [eax - 0x11]
jmp 0x100196ca
mov edi, dword [esp + 0xc]
test edi, edi
je 0x100196ca
lea ecx, [esp + 0x10]
push 0x20
push ecx
call eax
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x100196c5
lea edx, [esp + 0x10]
push edi
push edx
call fcn.10019360
add esp, 8
test eax, eax
je 0x100196ca
mov ebp, 0xffffffee
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x834]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.1002d777
add esp, 0x82c
ret
Function at 0x100197e0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1d8]
mov ecx, dword [esp + 0x1e0]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea edx, [esp + 0xe1]
push ebx
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0xe8], bl
call sub.MSVCR80.dll_memset
xor eax, eax
push 0x98
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x44]
push ebx
push eax
mov dword [esp + 0x48], ebx
call sub.MSVCR80.dll_memset
add esp, 0x18
push ebx
push 0x26
lea ecx, [esp + 0xe4]
push ecx
push ebx
or ebp, 0xffffffff
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x28], 0x100197b0
mov dword [esp + 0x30], 0x100197a0
mov dword [esp + 0x2c], 0x100197c0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0xdc]
add edi, ebp
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x100198a2
mov ecx, 0xa
mov esi, str.SoftForumXecureWebAnySigndllZip32.dll
rep movsd dword es:[edi], dword [esi]
push 8
movsw word es:[edi], word [esi]
push ebx
lea edx, [esp + 0xe4]
push edx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x10019a0c
push str.ZpArchive
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZpInit
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, ebx
je 0x10019a05
cmp eax, ebx
je 0x10019a05
lea ecx, [esp + 0x18]
push ecx
call eax
test eax, eax
je 0x10019a05
mov ecx, dword [esp + 0x1ec]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], 1
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xdc], bl
mov dword [eax + 0xc], ebx
call esi
mov ebp, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.1002d777
add esp, 0x1d4
ret
Function at 0x10019a30
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x1004a0b4]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1a8]
mov ecx, dword [esp + 0x1ac]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea edx, [esp + 0xb1]
push ebx
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xb8], bl
call sub.MSVCR80.dll_memset
push 0x50
lea eax, [esp + 0x2c]
push ebx
push eax
mov dword [esp + 0x30], ebx
call sub.MSVCR80.dll_memset
push 0x3c
lea ecx, [esp + 0x8c]
push ebx
push ecx
call sub.MSVCR80.dll_memset
add esp, 0x24
push ebx
push 0x26
lea edx, [esp + 0xb4]
push edx
push ebx
or ebp, 0xffffffff
mov dword [esp + 0x88], 0x100197a0
mov dword [esp + 0x7c], 0x100197b0
mov dword [esp + 0x84], 0x100197d0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0xac]
add edi, ebp
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x10019ae0
mov ecx, 0xb
mov esi, str.SoftForumXecureWebAnySigndllUnzip32.dll
rep movsd dword es:[edi], dword [esi]
push 8
push ebx
lea eax, [esp + 0xb4]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
je 0x10019b9c
push str.Wiz_SingleEntryUnzip
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10019b95
mov edx, dword [esp + 0x10]
mov ecx, 1
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x6c], edx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x30], 0x600
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call eax
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1b0]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.1002d777
add esp, 0x1a4
ret