joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1048
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x1044], eax
mov eax, dword [0x10191cb8]
push ebx
push ebp
mov ebp, dword [esp + 0x1054]
push esi
push edi
xor ebx, ebx
push 0x40f
lea ecx, [esp + 0x25]
push ebx
push ecx
mov dword [esp + 0x28], eax
xor edi, edi
mov byte [esp + 0x2c], bl
call fcn.10116880
add esp, 0xc
push 0x40f
lea edx, [esp + 0x435]
push ebx
push edx
mov byte [esp + 0x43c], bl
call fcn.10116880
add esp, 0xc
mov dword [esp + 0x18], ebx
cmp byte [ebp], bl
jne 0x10014f55
lea eax, [ebx + 2]
jmp 0x1001511a
push ebp
lea eax, [esp + 0x24]
push 0x1013fb04
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, ebx
je 0x10014fa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10014f94
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp esi, 2
setne al
inc eax
jmp 0x1001511a
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc54]
push ecx
push ebx
push ebx
push str.NoOpen
push edx
mov byte [esp + 0xc68], bl
mov byte [esp + 0x448], bl
mov dword [esp + 0x2c], 0x410
call esi
test eax, eax
jne 0x10014fe0
lea edi, [eax + 1]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x434]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x2c], 0x410
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x10015116
cmp byte [esp + 0x430], bl
je 0x10015116
lea ecx, [esp + 0x430]
push 0x20
push ecx
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x10015116
lea edx, [esp + 0x430]
push edx
lea eax, [esp + 0x24]
push 0x1013fb04
push eax
call fcn.1010d6a8
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push closesocket
call edi
test eax, eax
je 0x1001510b
push ebp
lea eax, [esp + 0x24]
push str._s_shellopencommand
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push closesocket
call edi
test eax, eax
jne 0x100150ef
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x844]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x2c], 0x410
mov byte [esp + 0x858], bl
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x840], bl
je 0x100150ef
xor edi, edi
lea esi, [esp + 0x840]
call fcn.10014dd0
test eax, eax
jne 0x10015116
call fcn.10014260
test eax, eax
jne 0x10015116
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.10015140
add esp, 8
test eax, eax
jne 0x10015116
mov dword [esp + 0x18], 1
jmp 0x10015116
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1054]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x1048
ret
Function at 0x10015140
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc4c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xc44], eax
mov eax, dword [esp + 0xc50]
push ebx
push ebp
push esi
push edi
push eax
lea eax, [esp + 0x434]
push str._s_shell
push eax
xor edi, edi
call fcn.1010d6a8
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 9
push edi
lea edx, [esp + 0x43c]
push edx
push closesocket
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x100152bb
mov dword [esp + 0x14], edi
cmp dword [esp + 0xc64], edi
jne 0x100152bb
jmp 0x100151c0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x410
lea eax, [esp + 0x844]
push eax
push ecx
push edx
mov byte [esp + 0x850], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100152da
lea eax, [esp + 0x840]
push eax
lea ecx, [esp + 0x434]
push str._scommand
push ecx
xor edi, edi
call fcn.1010d6a8
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 9
push edi
lea eax, [esp + 0x43c]
push eax
push ecx
call ebp
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x100152a3
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
push esi
push esi
push esi
push ecx
mov dword [esp + 0x34], 0x410
mov byte [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x20], 0
je 0x100152a3
lea esi, [esp + 0x20]
call fcn.10014dd0
test eax, eax
jne 0x1001529e
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x100152d6
lea eax, [esp + eax + 0x20]
mov ecx, esi
cmp eax, ecx
jbe 0x1001529e
mov edi, edi
cmp byte [eax], 0x20
je 0x100152d6
dec eax
lea edx, [esp + 0x20]
cmp eax, edx
ja 0x10015290
mov edi, 1
inc dword [esp + 0x14]
cmp edi, 1
jne 0x100151c0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc54]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0xc4c
ret
xor edi, edi
jmp 0x100152a3
mov eax, dword [esp + 0x10]
push eax
jmp 0x100152b5
Function at 0x100152f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc40
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xc3c], eax
mov eax, dword [esp + 0xc44]
push ebx
push esi
push edi
mov edi, dword [0x10191cb8]
push eax
lea eax, [esp + 0x42c]
push str._s_shell
push eax
xor ebx, ebx
xor esi, esi
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20119
lea edx, [esp + 0x430]
push edx
push closesocket
call fcn.10062150
test eax, eax
jne 0x10015459
push ebp
xor ebp, ebp
cmp edi, ebx
jne 0x10015458
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
push 0x410
lea eax, [esp + 0x840]
push eax
push ebp
push ecx
mov byte [esp + 0x84c], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10015477
lea edx, [esp + 0x83c]
push edx
lea eax, [esp + 0x430]
push str._scommand
push eax
xor esi, esi
call fcn.1010d6a8
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x20119
lea edx, [esp + 0x434]
push edx
push eax
call fcn.10062150
test eax, eax
jne 0x10015443
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push ebx
push eax
mov dword [esp + 0x30], 0x410
mov byte [esp + 0x34], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x1c], bl
je 0x10015443
xor edi, edi
lea esi, [esp + 0x1c]
call fcn.10014dd0
test eax, eax
jne 0x1001543e
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10015473
lea eax, [esp + eax + 0x1c]
mov edx, esi
cmp eax, edx
jbe 0x1001543e
lea esp, [esp]
cmp byte [eax], 0x20
je 0x10015473
dec eax
lea ecx, [esp + 0x1c]
cmp eax, ecx
ja 0x10015430
mov esi, 1
inc ebp
cmp esi, 1
jne 0x10015360
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov ecx, dword [esp + 0xc48]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0xc40
ret
xor esi, esi
jmp 0x10015443
mov edx, dword [esp + 0x10]
push edx
jmp 0x10015452
Function at 0x100165d0
Capabilities:
Unmount volume via ioctl

Disassembly:
push ecx
test esi, esi
je 0x100165d8
mov byte [esi], 0
push edi
push str.Dismounting_and_Locking_the_volume...
call fcn.1010def5
mov ecx, dword [ebx]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add esp, 4
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push ecx
call edi
test eax, eax
jne 0x10016627
test esi, esi
je 0x1001666f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_dismounting_the_volume__Error0x_X__n
push esi
call fcn.1010d6a8
add esp, 0xc
mov al, 1
pop edi
pop ecx
ret
mov eax, dword [ebx]
push 0
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x90018
push eax
call edi
test eax, eax
jne 0x10016662
test esi, esi
je 0x1001666f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_locking_the_volume__Error0x_X__n
push esi
call fcn.1010d6a8
add esp, 0xc
mov al, 1
pop edi
pop ecx
ret
push str.Done__n
call fcn.1010e391
add esp, 4
mov al, 1
pop edi
pop ecx
ret

Function at 0x100166e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 0x5a
push str.Boot_sector_size___d_Bytes_n
mov esi, eax
call fcn.1010def5
add esp, 8
test ebx, ebx
je 0x100166fa
mov byte [ebx], 0
mov eax, dword [esi]
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1001672c
test ebx, ebx
je 0x10016727
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetPointer_FAILED__0x_X_n
push ebx
call fcn.1010d6a8
add esp, 0xc
xor al, al
pop esi
pop ecx
ret
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.1010ccc2
mov ecx, dword [esi]
add esp, 4
push 0
mov edi, eax
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001677c
test ebx, ebx
je 0x1001676d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_reading_from_the_file_0x_X_n
push ebx
call fcn.1010d6a8
add esp, 0xc
push edi
call fcn.1010d9f8
add esp, 4
pop edi
xor al, al
pop esi
pop ecx
ret
push 0x5a
push edi
push 0x5a
add esi, 8
push esi
call fcn.1010e8ae
push edi
call fcn.1010d9f8
add esp, 0x14
pop edi
mov al, 1
pop esi
pop ecx
ret
Function at 0x100168a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push str.Reading_FATs_Data...
mov esi, eax
call fcn.1010de46
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x100168c1
mov byte [eax], 0
mov ebx, dword [esi + 4]
imul ebx, dword [esi + 0x2c]
push ebx
call fcn.1010ccc2
mov ebp, eax
add esp, 4
xor edi, edi
mov dword [esi + 0x68], ebp
call fcn.10016a50
test al, al
je 0x1001690a
mov ecx, dword [esi]
push edi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001692c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_reading_from_the_device__Code:_0x_X_n
call fcn.1010e391
add esp, 8
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10016920
push str.readBytesFromDeviceSector_failed_1
push eax
call fcn.1010d6a8
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push ebx
call fcn.1010ccc2
mov edi, dword [esi + 0x2c]
add esp, 4
push ebx
mov dword [esi + 0x6c], eax
push eax
mov eax, esi
call fcn.10016990
test al, al
jne 0x1001696a
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10016920
push str.readBytesFromDeviceSector_failed_2
push eax
call fcn.1010d6a8
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push str.DONE__n
call fcn.1010de46
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4

Function at 0x10016990
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
call fcn.10016a50
test al, al
je 0x100169ce
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100169d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_reading_from_the_device__Code:_0x_X_n
call fcn.1010e391
add esp, 8
xor al, al
pop esi
ret 8
mov al, 1
pop esi
ret 8

Function at 0x100169e0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
movzx eax, byte [esi + 0x15]
push edi
movzx edi, byte [esi + 0x18]
imul edi, dword [esi + 0x2c]
add ecx, 0xfffffffe
imul eax, ecx
add edi, eax
call fcn.10016a50
test al, al
je 0x10016a33
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10016a3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_to_the_device__Code:_0x_X_n
call fcn.1010e391
add esp, 8
pop edi
xor al, al
pop esi
ret 8
pop edi
mov al, 1
pop esi
ret 8
Function at 0x10016ab0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov dword [esp + 0x20], 0
cmp ebx, dword [esi + 0x64]
jb 0x10016b81
nop
cmp ebp, 0xfffffff
je 0x10016c2b
movzx edi, byte [esi + 0x15]
movzx ecx, byte [esi + 0x18]
imul ecx, dword [esi + 0x2c]
mov ebx, dword [esi + 0x64]
lea eax, [ebp - 2]
imul edi, eax
movzx eax, word [esi + 0x16]
mov dword [esp + 0xc], ebx
imul ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
add edi, ecx
cdq
xor ecx, ecx
add eax, edi
adc edx, ecx
mov ecx, dword [esi + 4]
push 0
push ecx
push edx
push eax
call fcn.1011e420
push 0
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10016bec
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10016c0c
mov ecx, dword [esi + 0x68]
mov ebp, dword [ecx + ebp*4]
mov ecx, dword [esp + 0x20]
mov eax, dword [esi + 0x64]
inc ecx
mov edx, eax
imul edx, ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
sub ecx, edx
cmp ecx, eax
jae 0x10016ad0
mov ebx, dword [esp + 0x28]
mov eax, dword [esi + 0x64]
mov edx, eax
imul edx, dword [esp + 0x20]
mov ecx, ebx
sub ecx, edx
cmp ecx, eax
jae 0x10016be1
mov edx, eax
push edx
call fcn.1010ccc2
mov edi, eax
mov eax, dword [esi + 0x64]
push eax
push 0
push edi
call fcn.10116880
mov eax, dword [esi + 0x64]
imul eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
sub ebx, eax
push ebx
add eax, ecx
push eax
push edi
call fcn.101162d0
mov edx, dword [esi + 0x64]
add esp, 0x1c
push edx
push edi
mov ecx, ebp
mov eax, esi
call fcn.100169e0
push edi
mov bl, al
call fcn.1010d9f8
add esp, 4
test bl, bl
je 0x10016c3f
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_accesing_sector_number__d___SetPointer_FAILED__0x_X_n
call fcn.1010e391
add esp, 0xc
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_to_the_device__Code:_0x_X_n
call fcn.1010e391
add esp, 8
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_getting_the_next_cluster_while_writing_data._Error_code:_0x_X_n
call fcn.1010de46
add esp, 8
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0xc
Function at 0x10016c50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x18], 0
push ebx
push ebp
push edi
jne 0x10016ca0
xor ecx, ecx
cmp eax, 0xfffffff
je 0x10016c78
test eax, eax
je 0x10016c7c
mov edi, dword [esi + 0x68]
mov eax, dword [edi + eax*4]
inc ecx
cmp eax, 0xfffffff
jne 0x10016c66
test eax, eax
jne 0x10016c8d
mov dword [edx], 0
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 4
mov eax, dword [esi + 0x64]
imul eax, ecx
pop edi
pop ebp
mov dword [edx], eax
mov al, 1
pop ebx
add esp, 0x14
ret 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
cmp eax, 0xfffffff
je 0x10016c82
movzx ecx, byte [esi + 0x15]
mov edi, dword [esp + 0xc]
movzx edx, byte [esi + 0x18]
imul edx, dword [esi + 0x2c]
mov ebp, dword [esi + 0x64]
movzx eax, word [esi + 0x16]
add edi, 0xfffffffe
imul edi, ecx
mov ebx, ebp
imul ebx, dword [esp + 0x10]
add ebx, dword [esp + 0x24]
add edi, edx
cdq
xor ecx, ecx
add eax, edi
adc edx, ecx
mov ecx, dword [esi + 4]
push 0
push ecx
push edx
push eax
call fcn.1011e420
push 0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10016d4d
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10016d6d
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x68]
mov eax, dword [eax + ecx*4]
inc dword [esp + 0x10]
mov dword [esp + 0xc], eax
cmp eax, 0xfffffff
jne 0x10016cb3
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_accesing_sector_number__d___SetPointer_FAILED__0x_X_n
call fcn.1010e391
add esp, 0xc
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_reading_from_the_device__Code:_0x_X_n
call fcn.1010e391
add esp, 8
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret 4
Function at 0x10019680
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x20c], eax
test esi, esi
jne 0x100196a1
cmp byte [esi], 0
je 0x100197a5
cmp dword [0x1019c1bc], 0
jne 0x1001979e
cmp byte [0x10193808], 0
mov dword [0x1019c1bc], 1
je 0x1001979e
push edi
push 0x80
push 4
push 3
push 0xc0000000
mov edi, 0x10193808
call fcn.10033690
add esp, 0x10
mov dword [esp + 4], eax
pop edi
cmp eax, 0xffffffff
jne 0x10019795
push 0x103
lea eax, [esp + 0x10d]
push 0
push eax
mov byte [esp + 0x114], 0
call fcn.10116880
push 0x103
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.10116880
add esp, 0x18
lea edx, [esp + 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1001979e
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x108]
mov byte [esp + eax + 4], cl
inc eax
test cl, cl
jne 0x10019740
lea ecx, [esp + 4]
call fcn.10049c40
lea eax, [esp + 4]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10019760
mov ecx, dword [str.frights.log]
mov edx, dword [0x1014b4b4]
mov dword [eax], ecx
mov ecx, dword [0x1014b4b8]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
xor eax, eax
mov cl, byte [esp + eax + 4]
mov byte [eax + 0x10193808], cl
inc eax
test cl, cl
jne 0x10019784
jmp 0x1001979e
lea edx, [esp]
push edx
call fcn.100673f0
mov ecx, esi
call fcn.100578f0
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1010d699
add esp, 0x210
ret
Function at 0x1001c150
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x11c
push 0xfffffffffffffffe
push 0x1016daf0
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x118], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.10116880
push ebx
lea edx, [ebp]
xor ecx, ecx
call fcn.10056870
add esp, 0x10
lea ecx, [ebp]
push ecx
push 0x14
lea edx, [ebp + 0x104]
push edx
push 0x1013ffd0
push str.UseCT
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp + 0x104]
push eax
call fcn.1010dc05
add esp, 4
cmp eax, 1
jne 0x1001c204
call fcn.10064670
test eax, eax
je 0x1001c22b
mov dword [ebp - 0x1c], 1
jmp 0x1001c22b
cmp eax, 2
jne 0x1001c22b
call sym.EncDec.dll_IsCTServerStarted
mov dword [ebp - 0x1c], eax
jmp 0x1001c22b
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x118]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x11c
mov esp, ebp
pop ebp
ret

Function at 0x1001cc70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016ef80
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 0xc]
mov dword [esi], edi
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
call fcn.10065bf0
push esi
call sym.EncDec.dll_GetIPUsingIoctlMethod
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x1001cd13
cmp dword [esi], 0
jne 0x1001cd0e
call fcn.10066260
cmp eax, 1
jne 0x1001cd0e
cmp dword [esi], 0
jne 0x1001cd0e
call ebx
sub eax, dword [ebp - 0x20]
cmp eax, 0x7d0
jae 0x1001cd0e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call sym.EncDec.dll_GetIPUsingIoctlMethod
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
jne 0x1001cce5
cmp edi, 0xffffffff
jne 0x1001cd18
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp dword [esi], 0
jne 0x1001cd5a
mov dword [ebp + 0xc], 0
push 1
lea eax, [ebp + 0xc]
push eax
call sym.EncDec.dll_GetIPUsingAdapterInfo
cmp eax, 1
jne 0x1001cd5a
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1001cd5a
mov eax, dword [esi]
test eax, eax
je 0x1001cd50
push eax
call fcn.1010dc10
add esp, 4
mov dword [esi], 0
mov dword [esi], ebx
mov edi, 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x1001cd85
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8