joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012ab0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov dword [esp + 4], 0
mov ebx, 0x5f5e100
test esi, esi
jne 0x10012ae5
call sub.NETCA_UTIL.dll_netca_time_nowutctime
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x24
ret
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012af0
sub eax, edx
push edi
mov edi, eax
cmp edi, 0xf
jl 0x10012bef
xor eax, eax
cmp byte [esi + edi - 1], 0x5a
jne 0x10012c8d
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], al
xor ecx, ecx
lea esp, [esp]
mov al, byte [esi + ecx]
cmp al, 0x30
jl 0x10012bef
cmp al, 0x39
jg 0x10012bef
inc ecx
cmp ecx, 0xe
jl 0x10012b20
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ebp
push ecx
mov dword [esp + 0x28], eax
call fcn.1008fce0
movzx edx, word [esi + 4]
mov ebp, eax
xor eax, eax
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], al
lea eax, [esp + 0x28]
push eax
mov word [esp + 0x2c], dx
call fcn.1008fce0
movzx ecx, word [esi + 6]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x20], eax
mov word [esp + 0x30], cx
call fcn.1008fce0
mov dword [esp + 0x1c], eax
mov ax, word [esi + 8]
lea ecx, [esp + 0x30]
push ecx
mov word [esp + 0x34], ax
call fcn.1008fce0
movzx edx, word [esi + 0xa]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x34]
push eax
mov word [esp + 0x38], dx
call fcn.1008fce0
movzx ecx, word [esi + 0xc]
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x34], eax
mov word [esp + 0x3c], cx
call fcn.1008fce0
add esp, 0x18
mov edx, eax
mov dword [esp + 0x20], edx
cmp edi, 0xf
jne 0x10012c02
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
jmp 0x10012c86
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x24
ret
cmp byte [esi + 0xe], 0x2e
jne 0x10012c9e
cmp edi, 0x10
je 0x10012c9e
mov eax, 0xf
dec edi
cmp edi, eax
jle 0x10012c32
nop
mov cl, byte [esi + eax]
cmp cl, 0x30
jl 0x10012c9e
cmp cl, 0x39
jg 0x10012c9e
inc eax
cmp eax, edi
jl 0x10012c20
mov ecx, 0xf
cmp edi, ecx
jle 0x10012c6c
jmp 0x10012c40
movsx edx, byte [esi + ecx]
sub edx, 0x30
imul edx, ebx
add dword [esp + 0xc], edx
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
je 0x10012c68
inc ecx
cmp ecx, edi
jl 0x10012c40
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push ebp
call sub.NETCA_UTIL.dll_netca_time_newutctime
pop ebp
pop edi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
pop ebp
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1008e4a2
add esp, 0x24
ret
Function at 0x1001a160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x100b2138
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [ecx + 8]
cmp eax, 2
jne 0x1001a1be
mov esi, dword [ebp + 8]
push 0x100c0a60
mov ecx, esi
call fcn.10003840
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 1
jne 0x1001a237
call fcn.100809dc
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x1001a1dd
push 0x80004005
call fcn.100036a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
push 0xd800
mov dword [esp + 0x84], 0
call fcn.100809d1
test eax, eax
je 0x1001a223
push 0xd800
push eax
lea ecx, [esp + 0x10]
call fcn.10003380
test eax, eax
je 0x1001a223
lea ecx, [esp + 8]
push ecx
jmp 0x1001a385
mov esi, dword [ebp + 8]
push 0x100c1660
mov ecx, esi
call fcn.10003840
jmp 0x1001a38f
fld qword [ecx]
lea edx, [esp + 0xc]
push edx
push 0
sub esp, 8
fstp qword [esp]
call dword [sym.imp.OLEAUT32.dll_GetAltMonthNames]
test eax, eax
je 0x1001a294
lea ecx, [esp + 8]
call fcn.10004ce0
push 0xd800
lea ecx, [esp + 0xc]
mov dword [esp + 0x84], 1
call fcn.10003450
mov esi, dword [ebp + 8]
mov ecx, esi
test eax, eax
je 0x1001a285
lea eax, [esp + 8]
push eax
jmp 0x1001a38a
push 0x100c1660
call fcn.10003840
jmp 0x1001a38f
movzx edx, word [esp + 0x16]
movzx ecx, word [esp + 0x18]
movzx eax, word [esp + 0x14]
mov dword [esp + 0x24], edx
movzx edx, word [esp + 0xe]
mov dword [esp + 0x20], ecx
movzx ecx, word [esp + 0x12]
dec edx
mov dword [esp + 0x28], eax
movzx eax, word [esp + 0xc]
mov dword [esp + 0x2c], ecx
movzx ecx, word [esp + 0x10]
mov dword [esp + 0x30], edx
movzx edx, word [esp + 0x1c]
sub eax, 0x76c
mov dword [esp + 0x38], ecx
dec edx
lea ecx, [esp + 8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0
call fcn.10004ce0
mov dword [esp + 0x80], 2
mov esi, dword [esp + 8]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x100
or eax, ecx
jge 0x1001a32a
push pe_nt_image_headers32
lea ecx, [esp + 0xc]
call fcn.10003620
mov esi, dword [esp + 8]
cmp dword [esi - 8], 0x100
jge 0x1001a33d
push 0x80070057
call fcn.100036a0
lea eax, [esp + 0x20]
push eax
mov dword [esi - 0xc], 0x100
xor edx, edx
mov word [esi + 0x200], dx
mov ecx, dword [esi - 0xc]
push str._Y__m__d__H:_M:_S
push ecx
push esi
call fcn.1008ffcd
mov eax, dword [esi - 8]
push eax
push esi
call fcn.1008eba1
add esp, 0x18
test eax, eax
jl 0x1001a333
cmp eax, dword [esi - 8]
jg 0x1001a333
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
lea eax, [esp + 8]
push eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.100085f0
lea ecx, [esp + 8]
call fcn.100031f0
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001bea0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x100b0d50
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jne 0x1001bedd
mov dword [esp + 0x10], 0xffffffff
jmp 0x1001bf51
add eax, 0xfffffff0
push eax
call fcn.10008580
add eax, 0x10
add esp, 4
mov dword [esp + 4], eax
lea ecx, [esp + 4]
push ecx
mov byte [esp + 0x14], 1
call fcn.10008c20
push eax
call fcn.10008cb0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1001bf20
push eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [esp + 0x10], 0
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001bf45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001bf6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret

Function at 0x1001bf80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100b0d0b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x32]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x18], ebx
mov word [esp + 0x38], ax
call fcn.10091ac0
add esp, 0xc
cmp word [esp + 0x2c], bx
jne 0x1001c005
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x1001c005
mov edx, 0x100c0a60
mov eax, edi
call fcn.10001ea0
jmp 0x1001c084
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1001c020
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x30]
push ecx
lea esi, [esp + 0x18]
call fcn.100023d0
push 0xc
push str.NETCAKeyX_
mov eax, esi
mov dword [esp + 0x248], ebx
call fcn.10002f60
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
push eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov eax, edi
mov word [edi + 4], dx
call fcn.10002320
cmp dword [esp + 0x28], 8
jb 0x1001c084
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1007de55
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x238
ret
Function at 0x1001c0b0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100b20b6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0x10], 0
push ecx
mov word [esp + 0x1c], ax
call fcn.10091ac0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1001c137
push 0x100c0a60
mov ecx, edi
call fcn.10003840
jmp 0x1001c242
call fcn.100809dc
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x1001c151
push 0x80004005
call fcn.100036a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x224], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001c173
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.100036f0
push esi
lea ecx, [esp + 0xc]
call fcn.10003840
mov byte [esp + 0x224], 1
mov edx, dword [esp + 8]
cmp dword [edx - 0xc], 0
jle 0x1001c1cd
push 0x100c4138
lea ecx, [esp + 0x10]
call fcn.1000c1b0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.1000c290
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1001c1e5
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0xfffffff0
push esi
call fcn.10008580
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x228], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001c21e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001c242
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x220
ret
Function at 0x1001c620
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b11ca
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], 1
push eax
mov dword [edi], 0xffffffff
call fcn.1001f9b0
mov byte [esp + 0x70], 2
mov eax, dword [esp + 0x7c]
mov ebp, 0x10
cmp dword [esp + 0x90], ebp
jae 0x1001c679
lea eax, [esp + 0x7c]
mov edx, dword [esp + 0x8c]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.1001fe90
xor ebx, ebx
cmp eax, ebx
jne 0x1001c6fb
lea ecx, [esp + 0x1c]
push ecx
call fcn.1001fa10
cmp dword [esp + 0x90], ebp
jb 0x1001c6b7
mov edx, dword [esp + 0x7c]
push edx
call fcn.1007de55
add esp, 4
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
cmp dword [esp + 0xac], ebp
jb 0x1001c6e6
mov eax, dword [esp + 0x98]
push eax
call fcn.1007de55
add esp, 4
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001c726
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x1001c697
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1001c749
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x1001c697
mov eax, dword [esp + 0x98]
cmp dword [esp + 0xac], ebp
jae 0x1001c760
lea eax, [esp + 0x98]
mov edx, dword [esp + 0xa8]
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x1001c7bd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
lea eax, [esp + 0x1c]
push eax
call fcn.1001fa10
lea ecx, [esp + 0x78]
call fcn.10004280
lea ecx, [esp + 0x94]
call fcn.10004280
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0xac]
je 0x1001c7d7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
jmp 0x1001c78e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push eax
call fcn.1001fa10
lea ecx, [esp + 0x78]
call fcn.10004280
lea ecx, [esp + 0x94]
call fcn.10004280
mov al, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x1001cd40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b2080
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x100c32cc
call fcn.10003840
push ecx
mov dword [esp + 0x24], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IsWriteLog
call fcn.10003840
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x100c62c0
mov byte [esp + 0x2c], 1
call fcn.10003840
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.100053c0
mov edx, dword [esp + 4]
push 0x100c32c0
push edx
call fcn.1008f7df
add esp, 8
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 4]
jne 0x1001ce07
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001cdf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001ce20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4

Function at 0x1001ce40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b2080
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x100c32c0
call fcn.10003840
push ecx
mov dword [esp + 0x24], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IsShowSelfWhileInsertUSBKey
call fcn.10003840
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UserSetting
mov byte [esp + 0x2c], 1
call fcn.10003840
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.100053c0
mov edx, dword [esp + 4]
push 0x100c32c0
push edx
call fcn.1008f7df
add esp, 8
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 4]
jne 0x1001cf07
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001cef0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001cf20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
Function at 0x1001cf40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b2810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, str.NETCAKeyXPluginCertAppCertManagerPlugin_
lea edi, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.1001c0b0
push str.CertManagerPlugin.ini
mov eax, edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x3c], 1
call fcn.1001c820
mov bl, 2
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x48]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IsShowSelfWhileInsertUSBKey
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 4
mov ecx, esp
mov dword [esp + 0x30], esp
push str.UserSetting
call fcn.10003840
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x3c], bl
call fcn.10005c80
mov eax, dword [esp + 0x3c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IsShowSelfWhileInsertUSBKey
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.UserSetting
call fcn.10003840
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x40], bl
call fcn.10005a40
mov bl, al
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001d081
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d0a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d0ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x1001d0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b2080
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x100c32c0
call fcn.10003840
push ecx
mov dword [esp + 0x24], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IsCouldModifyPasswordWhileSecurityWeak
call fcn.10003840
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UserSetting
mov byte [esp + 0x2c], 1
call fcn.10003840
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.100053c0
mov edx, dword [esp + 4]
push 0x100c32c0
push edx
call fcn.1008f7df
add esp, 8
or edx, 0xffffffff
test eax, eax
mov eax, dword [esp + 4]
jne 0x1001d1b7
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d1a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d1d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4
Function at 0x1001d1f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b2810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, str.NETCAKeyXPluginCertAppCertManagerPlugin_
lea edi, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.1001c0b0
push str.CertManagerPlugin.ini
mov eax, edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x3c], 1
call fcn.1001c820
mov bl, 2
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x48]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IsCouldModifyPasswordWhileSecurityWeak
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 4
mov ecx, esp
mov dword [esp + 0x30], esp
push str.UserSetting
call fcn.10003840
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x3c], bl
call fcn.10005c80
mov eax, dword [esp + 0x3c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IsCouldModifyPasswordWhileSecurityWeak
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.UserSetting
call fcn.10003840
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x40], bl
call fcn.10005a40
mov bl, al
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001d331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d356
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001d37e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8