joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e670
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1010be30
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.10060580
add esp, 8
test eax, eax
jne 0x1009e6ab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x1009e70d
xor ebx, ebx
test ebp, ebp
jle 0x1009e870
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x1009e6ef
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x1009e6c8
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x1009e6c0
jmp 0x1009e870
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x1009e870
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x1009e84c
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x1009e7e0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x1009e7b0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x100dd790
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
sub ebp, 1
jne 0x100dd7a2
pop esi
pop ebp
pop ebx
ret
Function at 0x100ec4c0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.1010be30
mov eax, dword [0x101870dc]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xec]
push esi
mov esi, dword [esp + 0xec]
push edi
lea ecx, [esp + 0xa8]
push ecx
push 0x20
push eax
call fcn.1009c030
mov dl, byte [esp + 0xd3]
and byte [esp + 0xb4], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esp + 0xd3], dl
lea ecx, [esp + 0xb4]
lea edx, [esp + 0x14]
call fcn.100e3d60
lea edi, [esp + 0x14]
call fcn.100e31c0
lea eax, [esp + 0xb4]
push 0x40
push eax
call fcn.10069450
mov ecx, dword [esp + 0xfc]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.10108bbf
add esp, 0xe4
ret
Function at 0x100ec590
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.1010be30
mov eax, dword [0x101870dc]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
mov byte [esp + 0x14b], cl
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x64]
mov dword [esp + 0x10], eax
call fcn.100e3d60
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb8]
mov esi, dword [esp + 0x94]
mov edi, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
add edx, eax
sub eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x90]
add edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xbc]
add esi, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0xc0]
add edi, esi
sub ecx, dword [esp + 0x90]
sub edx, dword [esp + 0x94]
sub esi, dword [esp + 0x98]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xc4]
add ebx, edi
sub edi, dword [esp + 0x9c]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0xc8]
add ebx, ebp
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc8]
sub eax, dword [esp + 0xa0]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0xcc]
add ebx, ebp
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0xd0]
add ebx, ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xd0]
sub eax, dword [esp + 0xa8]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0xd4]
add ebx, ebp
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xd4]
add ebp, ebx
sub eax, dword [esp + 0xac]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5c], eax
sub ebx, dword [esp + 0xb0]
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x64], ebx
call fcn.100e1da0
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edx
call fcn.100dfb20
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
call fcn.100df7c0
lea ecx, [esp + 0x13c]
push 0x20
push ecx
call fcn.10069450
mov ecx, dword [esp + 0x164]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10108bbf
add esp, 0x140
ret
Function at 0x10101290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5c
call fcn.1010be30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
xor edi, edi
push 0x38
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.10108c60
lea ecx, [esp + 0x3c]
sub ecx, esi
mov dword [esp + 0x20], ecx
xor eax, eax
lea ecx, [esp + 0x40]
add esp, 0xc
sub ecx, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jmp 0x101012e4
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + eax*4]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x18], 7
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebp
push ecx
push 0
push eax
call fcn.1010cc20
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + esi]
xor ebp, ebp
add eax, ecx
mov ecx, dword [esp + 0x10]
push ebp
adc edx, ebp
add edi, eax
mov eax, dword [esi + 4]
push ecx
adc ebx, edx
mov edx, dword [esp + 0x1c]
push ebp
push eax
mov dword [edx + esi], edi
call fcn.1010cc20
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + esi]
xor ebx, ebx
add eax, edi
adc edx, ebx
mov dword [ecx + esi], eax
add esi, 8
sub dword [esp + 0x18], 1
mov edi, edx
jne 0x10101300
mov ebp, dword [esp + 0x30]
imul ebp, ebp, 0xae918bc5
mov dword [esp + 0x68], edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], ebp
xor eax, eax
jmp 0x10101378
mov eax, dword [esp + 0x2c]
mov edx, dword [esi*4 + 0x10170414]
push eax
push ebp
push 0
push edx
call fcn.1010cc20
mov ecx, dword [esp + esi*4 + 0x30]
xor ebp, ebp
add eax, ecx
adc edx, ebp
add ebx, eax
adc edi, edx
test esi, esi
je 0x1010139f
mov dword [esp + esi*4 + 0x2c], ebx
mov ebp, dword [esp + 0x10]
mov edx, dword [esi*4 + 0x10170418]
xor eax, eax
push eax
push ebp
push eax
push edx
mov dword [esp + 0x3c], eax
call fcn.1010cc20
mov ecx, dword [esp + esi*4 + 0x34]
xor ebx, ebx
add eax, ecx
adc edx, ebx
xor ecx, ecx
add eax, edi
adc edx, ecx
lea ecx, [esi + 1]
test ecx, ecx
je 0x101013d4
mov dword [esp + esi*4 + 0x30], eax
add esi, 2
xor edi, edi
mov ebx, edx
cmp esi, 0xe
jb 0x10101374
mov edx, dword [esp + esi*4 + 0x30]
xor eax, eax
lea esi, [esp + esi*4 + 0x30]
xor ecx, ecx
add edx, dword [esp + 0x1c]
adc eax, ecx
add ebx, edx
adc edi, eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [esi - 4], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
cmp eax, 0xe
jb 0x101012e0
mov eax, dword [esp + 0x70]
push edi
push 0x10170414
lea edx, [esp + 0x38]
push edx
push eax
mov edx, 0x10170414
call fcn.10101170
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x10108bbf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101870dc]
jne 0x10108bc9
repz ret
jmp fcn.10112df0

Function at 0x1010fb42
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1010fb73
call fcn.1010ccd7
mov dword [eax], esi
call fcn.1010ccc4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10113ee9
add esp, 0x14
push 0x16
pop eax
jmp 0x1010fbc8
test dword [ebp + 0xc], 0xfffffff9
jne 0x1010fb4f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1010fba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1010ccea
pop ecx
call fcn.1010ccc4
mov eax, dword [eax]
jmp 0x1010fbc8
test al, 0x10
jne 0x1010fbc6
test al, 1
je 0x1010fbc6
test byte [ebp + 0xc], 2
je 0x1010fbc6
call fcn.1010ccd7
mov dword [eax], 5
call fcn.1010ccc4
mov dword [eax], 0xd
jmp 0x1010fb97
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10120b9b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10115433
and dword [ebp - 4], 0
cmp dword [0x1019d650], 0
mov ebx, eax
jne 0x10120c4c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10120cfd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10120cfd
push eax
call fcn.101153c1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1019d650], eax
call esi
push eax
call fcn.101153c1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1019d654], eax
call esi
push eax
call fcn.101153c1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1019d658], eax
call esi
push eax
call fcn.101153c1
pop ecx
mov dword [0x1019d660], eax
test eax, eax
je 0x10120c4c
push 0x10179c44
push edi
call esi
push eax
call fcn.101153c1
pop ecx
mov dword [0x1019d65c], eax
mov eax, dword [0x1019d65c]
cmp eax, ebx
je 0x10120ca4
cmp dword [0x1019d660], ebx
je 0x10120ca4
push eax
call fcn.1011543c
push dword [0x1019d660]
mov esi, eax
call fcn.1011543c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10120ca4
test edi, edi
je 0x10120ca4
call esi
test eax, eax
je 0x10120c9b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10120c9b
test byte [ebp - 0xc], 1
jne 0x10120ca4
or dword [ebp + 0x10], 0x200000
jmp 0x10120cdd
mov eax, dword [0x1019d654]
cmp eax, ebx
je 0x10120cdd
push eax
call fcn.1011543c
pop ecx
test eax, eax
je 0x10120cdd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10120cdd
mov eax, dword [0x1019d658]
cmp eax, ebx
je 0x10120cdd
push eax
call fcn.1011543c
pop ecx
test eax, eax
je 0x10120cdd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1019d650]
call fcn.1011543c
pop ecx
test eax, eax
je 0x10120cfd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10120cff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10125720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.1010be30
mov eax, dword [0x101870dc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x10125744
xor eax, eax
jmp 0x10125834
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x10125755
xor eax, eax
jmp 0x10125834
mov dword [ebp - 4], 0x1000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x2010], eax
mov edx, dword [ebp - 0x2010]
lea eax, [edx + edx + 2]
push eax
call fcn.10109636
add esp, 4
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0x200c], 0
jne 0x10125795
xor eax, eax
jmp 0x10125834
mov ecx, dword [ebp - 0x2010]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x200c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101257cd
mov eax, dword [ebp - 0x200c]
push eax
call fcn.10108bce
add esp, 4
mov dword [ebp - 0x200c], 0
xor eax, eax
jmp 0x10125834
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x200c]
push edx
push 0x1017a054
push 0x1000
lea eax, [ebp - 0x2008]
push eax
call fcn.10001b00
add esp, 0x14
push 8
push 0
lea ecx, [ebp - 0x2008]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x2014], eax
mov edx, dword [ebp - 0x200c]
push edx
call fcn.10108bce
add esp, 4
mov dword [ebp - 0x200c], 0
cmp dword [ebp - 0x2014], 0
je 0x10125832
mov eax, dword [ebp - 0x2014]
jmp 0x10125834
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret
Function at 0x101267a0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x101870dc]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], str.AhnLabAISAhnInst.ini
mov dword [ebp - 8], 0x25
mov dword [ebp - 4], str.AhnInst.ini
mov dword [ebp - 0x18], 0
jmp 0x101267e8
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jae 0x10126953
xor ecx, ecx
mov word [ebp - 0x228], cx
push 0x206
push 0
lea edx, [ebp - 0x226]
push edx
call fcn.10108c60
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*8 - 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1012694e
xor eax, eax
mov word [ebp - 0x430], ax
push 0x206
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.10108c60
add esp, 0xc
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + edx*8 - 0xc]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0x104
lea edx, [ebp - 0x430]
push edx
call fcn.10109d9f
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1012694e
mov dword [ebp - 0x644], 0
lea ecx, [ebp - 0x430]
push ecx
push 0
push str.Reboot
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x101268c2
mov dword [ebp - 0x644], 1
xor edx, edx
mov word [ebp - 0x640], dx
push 0x206
push 0
lea eax, [ebp - 0x63e]
push eax
call fcn.10108c60
add esp, 0xc
movzx ecx, word [ebp + 8]
push ecx
push 0x10180900
push 0x104
lea edx, [ebp - 0x640]
push edx
call fcn.10001b00
add esp, 0x10
mov dword [ebp - 0x434], 0
lea eax, [ebp - 0x430]
push eax
push 0
push str.Reboot
lea ecx, [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x10126933
mov dword [ebp - 0x434], 1
cmp dword [ebp - 0x644], 1
jne 0x1012694e
cmp dword [ebp - 0x434], 1
jne 0x1012694e
mov dword [ebp - 0x14], 1
jmp 0x10126953
jmp 0x101267df
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10108bbf
mov esp, ebp
pop ebp
ret
Function at 0x10126af0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x10126b08
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10126b73
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10126970
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10126b25
xor eax, eax
jmp 0x10126b73
push 0
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
call fcn.10003990
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
call fcn.100039d0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x10126e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
jne 0x10126ea6
mov eax, 0x57
jmp 0x10126f26
cmp dword [ebp + 0x10], 0
jne 0x10126eb3
mov eax, 0x57
jmp 0x10126f26
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.10126b80
push eax
push 0
push str.SoftwareAhnlabASPack9.0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10126ee4
mov eax, dword [ebp - 4]
jmp 0x10126f26
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
shl edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x101271e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 8], 0
jne 0x101271f6
mov eax, 0x57
jmp 0x101272c4
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.10126b80
push eax
push 0
push str.SoftwareAhnlabASPack9.0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101272c1
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.LastUpdate
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101272b1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.10001820
xor ecx, ecx
mov word [ebp - 0x2c], cx
xor edx, edx
mov dword [ebp - 0x2a], edx
mov dword [ebp - 0x26], edx
mov dword [ebp - 0x22], edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov byte [ebp - 0x35], al
movzx ecx, byte [ebp - 0x35]
test ecx, ecx
je 0x101272aa
push 0x10
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10109740
add esp, 0xc
jmp 0x101272b1
mov dword [ebp - 4], 0x65b
cmp dword [ebp - 8], 0
je 0x101272c1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x101272d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [ebp + 8], 0
jne 0x101272e6
mov eax, 0x57
jmp 0x101273b4
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.10126b80
push eax
push 0
push str.SoftwareAhnlabASPack9.0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101273b1
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 0x10], 8
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.LastScan
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101273a1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.10001820
xor ecx, ecx
mov word [ebp - 0x28], cx
xor edx, edx
mov dword [ebp - 0x26], edx
mov dword [ebp - 0x22], edx
mov dword [ebp - 0x1e], edx
mov word [ebp - 0x1a], dx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
call fcn.100018b0
mov byte [ebp - 0x31], al
movzx ecx, byte [ebp - 0x31]
test ecx, ecx
je 0x1012739a
push 0x10
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10109740
add esp, 0xc
jmp 0x101273a1
mov dword [ebp - 4], 0x65b
cmp dword [ebp - 8], 0
je 0x101273b1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x101273c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 8], 0
jne 0x101273d6
mov eax, 0x57
jmp 0x101274ab
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.10126b80
push eax
push 0
push str.SoftwareAhnlabASPack9.0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x101274a8
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.InstallDateTime
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10127491
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.10001820
xor ecx, ecx
mov word [ebp - 0x2c], cx
xor edx, edx
mov dword [ebp - 0x2a], edx
mov dword [ebp - 0x26], edx
mov dword [ebp - 0x22], edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov byte [ebp - 0x35], al
movzx ecx, byte [ebp - 0x35]
test ecx, ecx
je 0x1012748a
push 0x10
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10109740
add esp, 0xc
jmp 0x10127491
mov dword [ebp - 4], 0x65b
cmp dword [ebp - 8], 0
je 0x101274a8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10127980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x218]
test ecx, ecx
jne 0x1012799e
mov eax, 1
jmp 0x101279c8
mov edx, dword [ebp - 8]
add edx, 0x218
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x101279c6
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x101279c6
mov eax, 1
jmp 0x101279c8
xor eax, eax
mov esp, ebp
pop ebp
ret