joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021f80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x14], ax
xor ecx, ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov dword [ebp - 0xa], ecx
mov word [ebp - 6], cx
cmp dword [ebp + 0xc], 0
je 0x10021fae
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
cmp dword [ebp + 8], 0
je 0x10021fba
cmp dword [ebp + 0xc], 0
jne 0x10021fc4
jmp 0x100220dd
cmp dword [ebp + 0x14], 1
jne 0x10022017
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10021ff0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10021ff0
jmp 0x10021ffa
jmp 0x100220dd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10001950
mov dword [ebp - 4], 1
jmp 0x100220dd
cmp dword [ebp + 0x14], 2
jne 0x1002206f
mov edx, dword [ebp + 8]
push edx
push str._s.old.log
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10001aa0
add esp, 0x10
test eax, eax
jge 0x10022044
jmp 0x100220dd
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x10022066
jmp 0x100220dd
mov dword [ebp - 4], 1
jmp 0x100220dd
cmp dword [ebp + 0x14], 3
jne 0x100220dd
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 0xa]
push ecx
movzx edx, word [ebp - 0xc]
push edx
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x12]
push ecx
movzx edx, word [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s._.4d_.2d_.2d_.2d_.2d_.2d.log
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10001aa0
add esp, 0x28
test eax, eax
jge 0x100220be
jmp 0x100220dd
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x100220d6
jmp 0x100220dd
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10022440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x1002246b
jmp 0x10022550
push 0x2c
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.10108c60
add esp, 0xc
cmp dword [0x10199500], 0
jne 0x1002248e
jmp 0x10022550
cmp dword [0x10199918], 1
jne 0x100224b9
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push 0x1019970e
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
jmp 0x100224d9
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push 0x10199609
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0x2c
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100224f7
jmp 0x10022550
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov edx, dword [ebp + 8]
push edx
call fcn.10022570
add esp, 4
test eax, eax
jne 0x10022524
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10022550
push 0
push 0
push 0x10
mov eax, dword [ebp + 8]
add eax, 0x1b
push eax
call fcn.10022a10
add esp, 0x10
test eax, eax
jne 0x10022549
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10022550
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0xffffffff
je 0x10022567
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10022570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 9], 0
cmp dword [ebp + 8], 0
jne 0x10022598
jmp 0x1002267c
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x19]
test ecx, ecx
jne 0x100225ad
jmp 0x1002267c
push 0x10
push 0x10199930
mov edx, dword [ebp + 8]
add edx, 8
push edx
call fcn.1010a00c
add esp, 0xc
test eax, eax
je 0x100225d1
jmp 0x1002267c
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x73
jne 0x10022626
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x6c
jne 0x10022626
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 2]
cmp edx, 0x70
jne 0x10022626
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 3]
cmp ecx, 0x6b
jne 0x10022626
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 4]
cmp eax, 0x20
jne 0x10022626
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 5]
cmp edx, 0x61
jne 0x10022626
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 6]
cmp ecx, 0x30
jne 0x10022626
jmp 0x1002262a
jmp 0x1002267c
mov dword [ebp - 4], 9
jmp 0x1002263c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x2b
jae 0x10022656
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 9]
add edx, ecx
mov byte [ebp - 9], dl
jmp 0x10022633
movzx eax, byte [ebp - 9]
xor eax, 0xf4
mov byte [ebp - 9], al
movzx ecx, byte [ebp - 9]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x2b]
cmp ecx, eax
je 0x10022675
jmp 0x1002267c
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10022690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x100226b0
cmp dword [ebp + 0xc], 0
jne 0x100226b4
jmp 0x100226f5
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100226cd
jmp 0x100226f5
push 0
lea ecx, [ebp - 8]
push ecx
push 0x80
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100226ee
jmp 0x100226f5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10022700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x1002272d
push 0x80
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.10108c60
add esp, 0xc
cmp dword [ebp + 8], 0xffffffff
je 0x10022739
cmp dword [ebp + 0xc], 0
jne 0x10022743
jmp 0x10022846
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10022762
jmp 0x10022846
push 0
lea edx, [ebp - 8]
push edx
push 0x80
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10022789
jmp 0x10022846
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + 0x1d]
test eax, eax
jg 0x1002279e
jmp 0x10022846
push 0x10
push 0x10199930
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
push ecx
call fcn.1010a00c
add esp, 0xc
test eax, eax
je 0x100227c2
jmp 0x10022846
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
cmp eax, 0x41
jne 0x1002283b
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 1]
cmp edx, 0x53
jne 0x1002283b
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax + 2]
cmp ecx, 0x4c
jne 0x1002283b
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 3]
cmp eax, 0x46
jne 0x1002283b
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 4]
cmp edx, 0x49
jne 0x1002283b
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax + 5]
cmp ecx, 0x4c
jne 0x1002283b
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 6]
cmp eax, 0x45
jne 0x1002283b
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 7]
cmp edx, 0x31
jne 0x1002283b
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax + 8]
cmp ecx, 0x2e
jne 0x1002283b
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 9]
cmp eax, 0x30
jne 0x1002283b
jmp 0x1002283f
jmp 0x10022846
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10023c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
je 0x10023c9e
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push 0x10131810
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10023cca
cmp dword [ebp - 8], 0
je 0x10023cca
jmp 0x10023cd4
jmp 0x10023db4
mov dword [ebp - 4], 4
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push str.DebugLog
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10023d04
jmp 0x10023db4
cmp dword [ebp - 0x18], 1
je 0x10023d14
jmp 0x10023db4
cmp dword [ebp + 8], 0
je 0x10023dad
cmp dword [ebp + 0xc], 0
je 0x10023dad
cmp dword [ebp + 0x10], 0
jbe 0x10023dad
mov eax, dword [ebp + 0x10]
lea ecx, [eax + eax - 2]
mov dword [ebp - 4], ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push str.DebugLogPath
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10023d9c
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.10003650
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10023d72
jmp 0x10023db4
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 2]
test ecx, ecx
jne 0x10023d81
jmp 0x10023db4
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10001a40
test eax, eax
jge 0x10023d9a
jmp 0x10023db4
jmp 0x10023dad
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100019a0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x10023dcb
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10023de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
je 0x10023e1c
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SoftwareAhnLabACA
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10023e48
cmp dword [ebp - 8], 0
je 0x10023e48
jmp 0x10023e52
jmp 0x10023f31
mov dword [ebp - 4], 4
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x10131848
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10023e82
jmp 0x10023f31
cmp dword [ebp - 0x18], 1
je 0x10023e92
jmp 0x10023f31
cmp dword [ebp + 8], 0
je 0x10023f2a
cmp dword [ebp + 0xc], 0
je 0x10023f2a
cmp dword [ebp + 0x10], 0
jbe 0x10023f2a
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0x10131838
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10023f19
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.100247d0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10023eef
jmp 0x10023f31
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx + 1]
test edx, edx
jne 0x10023efe
jmp 0x10023f31
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.100019f0
test eax, eax
jge 0x10023f17
jmp 0x10023f31
jmp 0x10023f2a
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10001950
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x10023f48
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100241d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101870dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.10108c60
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10024213
jmp 0x10024261
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1002422d
jmp 0x10024261
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x1017a054
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.10001b00
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret
Function at 0x10024280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x101870dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.10108c60
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x100242c1
jmp 0x10024317
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x100242db
jmp 0x10024317
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x10131868
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.10001aa0
add esp, 0x14
test eax, eax
jge 0x10024307
jmp 0x10024317
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret
Function at 0x100250a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x101870dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
cmp dword [ebp + 8], 0
jne 0x100250c6
xor eax, eax
jmp 0x10025258
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.10108c60
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x808]
push eax
call fcn.100019a0
push str.PdCfg.dll
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x80c], 0
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x810]
mov dword [ecx], eax
mov edx, dword [ebp - 0x810]
cmp dword [edx], 0
je 0x10025252
push str.B4810203714C47f9BFD73684A92A2C1E
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 4], eax
push str.CCDF4192812041dfA8DACC3CBB9DC580
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 8], eax
push str.D5B387C9DE8F4e50BCFFA929BBF11CC8
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0xc], eax
push str.F4265D584B2B43539CA86DEB0DCBA606
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x10], eax
push str.A125FF8C57D44c5cA3E46E28A664B999
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x14], eax
push str.B0F3D869E9F64d799510D2849AF5921A
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x18], eax
push str.FB48E6154AF2459eA7404A3161D766FE
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x1c], eax
push str.F6F5B4EC76A24c00A7CC6F8133E7F7C2
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x810]
call fcn.10025310
test eax, eax
jne 0x10025248
mov ecx, dword [ebp - 0x810]
call fcn.10025270
mov dword [ebp - 0x80c], 0
jmp 0x10025252
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret 4
Function at 0x10025e40
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x101870dc]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x10025eab
lea esi, [edi + 0x10]
mov edx, 0x104
mov eax, esi
sub ebx, esi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x10025e9a
movzx ecx, word [ebx + eax]
test cx, cx
je 0x10025e9a
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10025e71
sub eax, 2
mov word [eax], dx
jmp 0x10025fb5
test edx, edx
jne 0x10025ea1
sub eax, 2
xor edx, edx
mov word [eax], dx
jmp 0x10025fb5
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov ebx, 1
mov word [esp + 0x1c], ax
call fcn.10108c60
add esp, 0xc
push 0x104
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.SHFolder.dll
push 0x104
lea eax, [esp + 0x18]
push eax
call fcn.10001a40
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10025f83
push 0x101322e0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10025f26
lea edx, [edi + 0x10]
push edx
push 0
push 0
push 0x8023
push 0
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x10025f83
push str.AhnLab
push 0x104
lea esi, [edi + 0x10]
push esi
call fcn.10001a40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10025f61
call ebp
cmp eax, 0xb7
jne 0x10025f83
push str.AIS
push 0x104
push esi
call fcn.10001a40
push 0
push esi
call ebx
test eax, eax
jne 0x10025fa5
call ebp
cmp eax, 0xb7
je 0x10025fa5
push 0x104
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10025fa5
cmp word [edi + eax*2 + 0xe], 0x5c
jne 0x10025fa5
xor ecx, ecx
mov word [edi + eax*2 + 0xe], cx
push str._ai.log
push 0x104
push esi
call fcn.10001a40
push 0x2e
push esi
call fcn.10109347
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10026013
add edi, 0x218
mov edx, 0x104
mov eax, edi
sub esi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x10026000
movzx ecx, word [esi + eax]
test cx, cx
je 0x10026000
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10025fd5
sub eax, 2
mov word [eax], dx
push 0x101322ac
jmp 0x1002607e
test edx, edx
jne 0x10026007
sub eax, 2
xor edx, edx
mov word [eax], dx
push 0x101322ac
jmp 0x1002607e
mov ebx, ebp
sub ebx, edi
sub ebx, 0x10
sar ebx, 1
add edi, 0x218
cmp ebx, 0x7ffffffe
jbe 0x10026031
xor eax, eax
mov word [edi], ax
jmp 0x1002606d
mov edx, 0x104
mov eax, edi
sub esi, edi
lea ebx, [ebx]
lea ecx, [ebx + edx - 0x104]
test ecx, ecx
je 0x10026061
movzx ecx, word [esi + eax]
test cx, cx
je 0x10026061
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10026040
jmp 0x10026065
test edx, edx
jne 0x10026068
sub eax, 2
xor edx, edx
mov word [eax], dx
push 0x101322ac
push 0x104
push edi
call fcn.10001a40
push ebp
push 0x104
push edi
call fcn.10001a40
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10108bbf
add esp, 0x20c
ret 4
Function at 0x100260b0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1012f100
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x101870dc]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x101870dc]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
cmp word [esi + 0x10], 0
lea edi, [esi + 0x10]
mov dword [esp + 0x28], eax
jne 0x10026104
push 0
call fcn.10025e40
mov ebx, dword [esi + 4]
mov dword [esp + 0x2c], vtable.CLogMutex.0
mov dword [esp + 0x30], ebx
test ebx, ebx
je 0x10026123
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x88], 0
mov dword [esp + 0x10], vtable.CAhnI2s_File.0
mov dword [esp + 0x14], 0xffffffff
push 1
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
call fcn.10029070
lea ecx, [esp + 0x10]
test eax, eax
je 0x100262e0
call fcn.10029100
test eax, eax
jl 0x100262dc
cmp eax, dword [esi + 0x430]
jl 0x100261c8
lea ecx, [esp + 0x10]
call fcn.100290e0
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
push edi
lea ecx, [esp + 0x18]
call fcn.10029070
lea ecx, [esp + 0x10]
test eax, eax
je 0x100262e0
call fcn.10029100
test eax, eax
jl 0x100262dc
cmp eax, dword [esi + 0x430]
jge 0x100262dc
push 2
push 0
lea ecx, [esp + 0x18]
call fcn.100291a0
test eax, eax
jl 0x100262dc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x26]
movzx eax, word [esp + 0x24]
movzx ecx, word [esp + 0x22]
push edx
movzx edx, word [esp + 0x24]
push eax
movzx eax, word [esp + 0x26]
push ecx
movzx ecx, word [esp + 0x26]
push edx
push eax
movzx eax, word [esp + 0x2c]
push ecx
cdq
mov ecx, 0xa
idiv ecx
push edx
push str._d_x_02d._02d_02d_02d_03d.
lea edx, [esp + 0x54]
push 0x40
push edx
call fcn.10001aa0
lea eax, [esp + 0x5c]
push 0x40
push eax
call fcn.100258f0
add esp, 0x30
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
call fcn.10029170
mov edx, dword [0x101999a8]
push edx
push 0x10199998
lea ecx, [esp + 0x18]
call fcn.10029170
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._x:
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.10001aa0
lea ecx, [esp + 0x44]
push 0x40
push ecx
call fcn.100258f0
add esp, 0x18
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x18]
call fcn.10029170
mov edi, dword [esp + 0x28]
push closesocket
push edi
call fcn.100258f0
add esp, 8
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.10029170
push 2
push 0x101316f0
lea ecx, [esp + 0x18]
call fcn.10029170
lea ecx, [esp + 0x10]
call fcn.100291c0
test byte [esi + 0x42c], 1
je 0x100262dc
lea ecx, [esp + 0x10]
call fcn.100291e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x88], 0
call fcn.100291f0
test ebx, ebx
je 0x100262f8
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret 8
Function at 0x100291c0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [ecx + 4]
push eax
call fcn.1010df9c
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
ret

Function at 0x10029240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
push 1
push edx
push eax
mov dword [esp + 0x18], 4
call fcn.10029200
add esp, 0x14
test eax, eax
jne 0x100292a7
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100292a7
cmp dword [esp + 4], 4
mov eax, dword [esp + 8]
je 0x100292ab
mov eax, dword [esp + 0x1c]
add esp, 0xc
ret