joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011da9b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101d6bf4], 0
mov byte [0x101d6bf8], 0
mov dword [0x101d6be8], 0x719
mov dword [0x101d6bf0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1011daf9
xor eax, eax
mov dword [0x101d6bf0], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1011db37
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101d6bec]
add eax, 0xfffff13a
mov dword [0x101d6be8], eax
mov esi, dword [0x101d6bf0]
add esi, 1
mov dword [0x101d6bf0], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x1011daf9
jmp 0x1011dae2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x101d6bfc], 0
mov esi, dword [0x101d6bf4]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x101d6bfc], ebx
mov dword [0x101d6bec], 0xde7
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x30]
idiv ebx
mov dword [0x101d6bf4], edx
mov esi, dword [ebp - 0x2c]
mov bl, byte [edi + esi]
mov byte [0x101d6bf8], bl
add ecx, 0x17b0
mov dword [0x101d6be8], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov dword [0x101d6be8], 0x20e9
mov bl, byte [0x101d6bf8]
mov ecx, dword [0x101d6bf4]
mov byte [edi + ecx], bl
mov ecx, dword [0x101d6bf0]
add ecx, 1
mov dword [0x101d6bf0], ecx
cmp ecx, 0x100
mov dword [ebp - 0x34], ecx
jge 0x1011dbfe
mov eax, dword [0x101d6be8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1011db37
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011dc99
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x101d6be8], 0x1c02
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1011dd0e
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x1d], cl
mov al, byte [ebp - 0x1d]
test al, 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
jne 0x1011dccd
jmp 0x1011dd0e
mov eax, dword [ebp - 0x18]
mov dword [0x101d6be8], 0x848
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
jne 0x1011ddb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1011ddb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x26], dx
mov ax, word [ebp - 0x26]
cmp ax, 0x61
jne 0x1011ddb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x27], dl
mov al, byte [ebp - 0x27]
test al, 1
jne 0x1011dd72
jmp 0x1011ddb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x28], dl
mov al, byte [ebp - 0x28]
test al, 1
jne 0x1011dd8e
jmp 0x1011ddb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1011ddb4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x1011ddbb
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1011ddbb
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop ebp
ret
Function at 0x1011ddc3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001064
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x1011df2f
lea eax, [esp + 0x38]
mov ecx, dword [0x101d6bec]
add ecx, 0xffffe60f
mov dword [0x101d6be8], ecx
mov dword [esp + 0x20], eax
call fcn.1011dc99
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x1011df27
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.1011ca1c
lea ecx, [0x1011d15f]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x54], edx
mov dword [esp + 0x7c], 0x12fc00
mov edx, dword [0x101d6bd4]
mov dword [esp + 0x74], edx
mov edx, dword [0x101d6bd8]
mov dword [esp + 0x38], edx
mov edx, dword [0x101d6bdc]
mov dword [esp + 0x64], edx
mov edx, dword [0x101d6be0]
mov dword [esp + 0x3c], edx
mov edx, dword [0x101d6be4]
mov dword [esp + 0x44], edx
mov dword [0x101d6bec], 0x5db
mov dword [0x101d6be8], 0x183f
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1011dea9
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1011debd
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1011de86
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x80], ecx
mov dword [0x101d6bec], 0xffffffce
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x84], esi
mov dword [0x101d6be8], 0x108a
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1011d34c
mov dword [esp + 8], eax
mov dword [0x101d6bec], 0x159a
mov eax, esp
lea ecx, [esp + 0x38]
mov dword [eax], ecx
mov eax, dword [esp + 8]
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x401130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x28], ecx
mov ebx, esi
mov dword [ebp - 0x2c], 0x30
and ebx, 0x3fc0
or ebx, 0x154000
push edi
shr ebx, 6
xor edi, edi
mov ecx, 0x1f
mov edx, esi
sub ecx, edi
mov eax, esi
shl edx, cl
mov ecx, edi
shr eax, cl
or edx, eax
mov eax, 0x38e38e39
xor ebx, edx
mul ebx
mov cl, bl
shr edx, 3
mov al, dl
shl dl, 3
add al, dl
mov edx, 0x30
shl al, 2
sub cl, al
mov eax, 0x37
cmp cl, 0xa
cmovl eax, edx
add al, cl
mov byte [ebp + edi - 0x24], al
inc edi
cmp edi, 0x1f
jl 0x401162
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub eax, esi
lea ebx, [edx - 0x11]
mov dword [ebp - 0x28], eax
lea esp, [esp]
movsx eax, byte [esi]
push eax
call fcn.0040568d
mov edi, eax
push edi
call fcn.004035af
add esp, 8
test eax, eax
je 0x401220
mov eax, dword [ebp - 0x28]
mov ecx, 0x37
movsx edx, byte [eax + esi]
mov eax, 0x30
cmp edx, 0x41
cmovl ecx, eax
cmp edi, 0x41
mov eax, 0x37
cmovl eax, dword [ebp - 0x2c]
sub ecx, eax
lea eax, [edi + 0x24]
sub ecx, edx
add eax, ecx
cmp eax, 0x23
jle 0x40120c
sub eax, 0x24
cmp eax, 0xa
mov ecx, 0x37
mov edx, 0x30
cmovl ecx, edx
add cl, al
mov byte [esi], cl
inc esi
dec ebx
jne 0x4011c0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404375
mov esp, ebp
pop ebp
ret

Function at 0x401300
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0
mov edi, ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x32
jne 0x401349
push str.IP_Helper_API_not_supported_on_this_system__n
call fcn.00404bf5
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 0x28]
call fcn.00404b4e
mov esi, eax
add esp, 4
test esi, esi
je 0x4013d1
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
jmp 0x401370
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x24]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.004042d5
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x24]
add esp, 0x20
cmp eax, dword [ecx]
jne 0x4013cb
mov eax, dword [edi + 8]
cmp eax, dword [ecx + 4]
jne 0x4013cb
mov eax, dword [edi + 0xc]
cmp eax, dword [ecx + 8]
je 0x4013e6
mov esi, dword [esi]
test esi, esi
jne 0x401370
pop esi
mov eax, 0xfffffffc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x401620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0
push 0
push eax
call fcn.00404b21
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x40165e
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
push edi
push 0x23
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.00404ca4
push esi
mov edi, eax
call fcn.004056b9
add esp, 0x10
test edi, edi
jg 0x401690
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
cmp edi, 0x23
je 0x4016ab
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x28]
call fcn.00401490
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x4016d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
mov edi, ecx
mov dword [ebp - 0x4b8], 0x104
push 0
push edi
call fcn.00404910
push 0x104
lea ebx, [edi + 0x208]
push 0
push ebx
call fcn.00404910
add esp, 0x18
lea eax, [ebp - 0x4c0]
push eax
push 1
push 0
push str.SoftwareRetiaReDat_Recorder
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x401774
push 0
push 0
lea eax, [ebp - 0x4bc]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x4bc]
lea eax, [ebp - 0x4b4]
push esi
push str.SoftwareRetiaReDat_Recorder
push str.CRRDir:_RegOpenKeyEx:___s__err:_d____s_n
push eax
call fcn.004042d5
add esp, 0x14
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0x104
push eax
push ebx
push 0
push 0
push str.Dir001
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x4017df
push 0
push 0
lea eax, [ebp - 0x4bc]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x4bc]
lea eax, [ebp - 0x2c0]
push esi
push str.Dir001
push str.CRRDir:_RegQueryValueEx:___s__err:_d__s_n
push eax
call fcn.004042d5
add esp, 0x14
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0x104
push eax
push edi
push 0
push 0
push str.ROOT
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x40184a
push 0
push 0
lea eax, [ebp - 0x4bc]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x4bc]
lea eax, [ebp - 0x2c0]
push esi
push str.ROOT
push str.CRRDir:_RegQueryValueEx:___s__err:_d__s_n
push eax
call fcn.004042d5
add esp, 0x14
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x401860
cmp byte [ebx], 0
jne 0x401879
push str.SoftwareRetiaReDat_Recorder
lea eax, [ebp - 0xcc]
push str.CRRDir:_nenalezena_cesta_v_registrech:_s_n
push eax
call fcn.004042d5
add esp, 0xc
push 0x5c
push edi
lea eax, [edi + 0x104]
push str._s_clog
push eax
call fcn.004042d5
push 0x4196e8
push 0x5c
push edi
lea esi, [edi + 0x30c]
push str._s_c_s
push esi
call fcn.004042d5
push esi
lea eax, [edi + 0x514]
push 0x4196f4
push eax
call fcn.004042d5
push esi
lea eax, [edi + 0x618]
push 0x4196f4
push eax
call fcn.004042d5
push str.language
push 0x5c
push edi
lea ecx, [edi + 0x410]
push str._s_c_s
push ecx
call fcn.004042d5
mov ecx, dword [ebp - 4]
add esp, 0x50
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x401900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
call fcn.004016d0
push 0x419704
push dword [ebp + 8]
lea eax, [edi + 0x30c]
push 0x5c
push eax
lea esi, [edi + 0x71c]
push str._s_c_s._s
push esi
call fcn.004042d5
push 0x2000
lea ebx, [edi + 0x824]
push 0
push ebx
call fcn.00404910
push 0x419714
push esi
call fcn.004040a9
add esp, 0x2c
mov dword [edi + 0x820], eax
test eax, eax
je 0x40197d
push eax
push 0x2000
push 1
push ebx
call fcn.00405ab3
mov byte [edi + 0x2823], 0
push dword [edi + 0x820]
call fcn.00403d7e
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x401a10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push 0x124
push 0
push eax
mov dword [ebp - 0x12c], 0
call fcn.00404910
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x401a7e
push str.Error:_GetProcessList:_CreateToolhelp32Snapshot
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401adf
lea esp, [esp]
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ab0
sub eax, edx
push eax
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.00403640
add esp, 0xc
test eax, eax
je 0x401af8
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401aa0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x124]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x401b38
push edi
push str.Error:_GetProcessList:__ProcName:_s__OpenProcess
push 0x41c6b8
call fcn.004042d5
add esp, 0xc
push 0x41c6b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x401b50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004036c0
lea ebx, [ebp - 0x108]
mov byte [ebp - 5], 0
mov edi, ebx
add esp, 0xc
lea ecx, [edi + 1]
lea ecx, [ecx]
mov al, byte [edi]
inc edi
test al, al
jne 0x401b90
sub edi, ecx
mov esi, 1
mov dword [ebp - 0x10c], edi
cmp edi, esi
jle 0x401bf7
mov eax, edi
lea ebx, [ebx]
lea edi, [ebp - 0x107]
add edi, esi
cmp byte [edi - 1], 0x5c
je 0x401bc5
cmp byte [edi], 0
jne 0x401bf2
jmp 0x401bdb
cmp byte [ebp + esi - 0x109], 0x3a
je 0x401bf2
cmp esi, 0x104
jae 0x401c08
mov byte [edi - 1], 0
push ebx
call fcn.00403cd0
push ebx
call fcn.00403bb4
mov eax, dword [ebp - 0x10c]
mov ebx, edi
add esp, 8
inc esi
cmp esi, eax
jl 0x401bb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404375
mov esp, ebp
pop ebp
ret
call fcn.00403349
int3

Function at 0x401ec0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x401f28
push esi
push str.Error:_PrintFileVersion:___s__GetFileVersionInfoSize:
push 0x41c6b8
call fcn.004042d5
add esp, 0xc
push 0x41c6b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
push edi
push ebx
call fcn.00403196
add esp, 4
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x401f4a
push esi
push str.Error:_PrintFileVersion:___s__GetFileVersionInfo:
jmp 0x401f67
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4197a8
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x401f9f
push esi
push str.Error:_PrintFileVersion:___s__VerQueryValue:
push 0x41c6b8
call fcn.004042d5
add esp, 0xc
push 0x41c6b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
push edi
call fcn.0040320c
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0xe]
movzx edi, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, esi
mov dword [ebp - 0x14], eax
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401fc0
sub ecx, edx
lea eax, [ebp - 0xc]
cmp ecx, 0x10
jae 0x401fd8
push 0x4197dc
jmp 0x401fdd
push 0x4197e0
push eax
call fcn.004042d5
add esp, 8
lea eax, [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
push edi
push eax
push esi
push str._t_s_s_d._d._d._d_n
push 0x41c6b8
call fcn.004042d5
push 0x41c6b8
call fcn.00402ac0
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x402050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4020a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push str.taskkill.exe
push str._s___IM__s__F_
push eax
call fcn.004042d5
push 0x44
lea eax, [ebp - 0x544]
push 0
push eax
call fcn.00404910
add esp, 0x1c
mov dword [ebp - 0x544], 0x44
lea eax, [ebp - 0x500]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x500], xmm0
push eax
lea eax, [ebp - 0x544]
push eax
push 0
push 0
push 0x80
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402157
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x4f0]
push str.Error:_RunTaskKill:__ProcName:_s__CreateProcess
push eax
call fcn.004042d5
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
add esp, 8
push 0xbb8
push dword [ebp - 0x500]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4021cc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x4f0]
push str.Eror:_RunTaskKill:__ProcName:_s__WaitForSingleObject
push eax
call fcn.004042d5
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
push esi
lea eax, [ebp - 0x4f0]
push str.RunTaskKill:_nepovedlo_se_ukoncit_process:_s_pomoci_utility_taskkill.exe_n
push eax
call fcn.004042d5
lea eax, [ebp - 0x4f0]
push eax
call fcn.00402ac0
add esp, 0x18
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404375
mov esp, ebp
pop ebp
ret
push esi
push str.RunTaskKill:_process:_s_ukoncen_pomoci_utility_taskkill.exe_n
push 0x41c6b8
call fcn.004042d5
push 0x41c6b8
call fcn.00402ac0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00404375
mov esp, ebp
pop ebp
ret
Function at 0x402620
Capabilities:
Terminate process

Disassembly:
push 0x66c
push 0
push 0x41eae8
call fcn.00404910
push str.redat_recorder_voip.exe
push 0x4196f4
push 0x41eaec
call fcn.004042d5
push str.RRVOIP
push 0x4196f4
push 0x41ebf0
call fcn.004042d5
push str.redat_recorder_screen.exe
push 0x4196f4
push 0x41ed10
mov dword [0x41ed00], 0
mov dword [0x41ed04], 1
mov dword [0x41ed08], 0
mov dword [0x41eae8], 0
call fcn.004042d5
push str.RRSCREEN
push 0x4196f4
push 0x41ee14
call fcn.004042d5
movzx eax, byte [0x41c384]
push str.redat_recorder_telephony.exe
and eax, 1
mov dword [0x41ef24], 9
push 0x4196f4
push 0x41ef34
mov dword [0x41ef28], eax
mov dword [0x41ef2c], 1
mov dword [0x41ed0c], 0
call fcn.004042d5
add esp, 0x48
push str.RRTELEPHONY
push 0x4196f4
push 0x41f038
call fcn.004042d5
movzx eax, byte [0x41c384]
add esp, 0xc
and eax, 2
mov dword [0x41f148], 8
mov dword [0x41f14c], eax
mov dword [0x41f150], 2
push 0
push 0
push 0
push 0
mov dword [0x41ef30], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x41eae4], eax
test eax, eax
je 0x402800
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402760
mov dword [0x41eae0], 0
mov esi, 0x41ed08
nop
push dword [esi]
call fcn.00402e50
add esp, 4
test eax, eax
jne 0x402795
mov edi, edi
push 0x4e20
call edi
push dword [esi]
call fcn.00402e50
add esp, 4
test eax, eax
je 0x402780
add esi, 0x224
cmp esi, 0x41f374
jl 0x402770
push 0xffffffffffffffff
push 0
push 0x41f154
push dword [0x41eae0]
call ebx
cmp dword [0x41c6b4], 0
jne 0x4027db
cmp dword [0x41ecf4], 0xffffffff
jne 0x4027cb
call fcn.00403050
push 0x3e8
call edi
cmp dword [0x41c6b4], 0
je 0x402760
push str.WaitingLoop:_konec_n
push 0x2400
push 0x41c6b8
call fcn.00404359
push 0x41c6b8
call fcn.00402ac0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
push str.WaitingLoop:_CreateEvent
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401990
add esp, 8
push 1
call fcn.00403b83
int3