joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089b2
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor ecx, ecx
lea edi, [ebp - 0x114]
xor eax, eax
mov byte [ebp - 0x118], cl
mov word [ebp - 0x117], cx
mov esi, ecx
mov byte [ebp - 0x115], cl
stosd dword es:[edi], eax
mov dword [ebp - 0x11c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push 0x4d000001
call fcn.00402d5c
lea eax, [ebp - 0x110]
push eax
push 1
call fcn.00402d5c
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0xc]
call fcn.00402d5c
add esp, 0x18
lea eax, [ebp - 0x104]
push 0xff
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x408b6b
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x408a53
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.00402d5c
push 0x11
lea eax, [ebp - 0x118]
mov byte [ebp - 0x108], 2
push eax
push dword [ebp + 8]
call fcn.004027a0
add esp, 0x14
test eax, eax
je 0x408a89
mov eax, 0xe40001
jmp 0x408b6e
push ebx
lea eax, [ebp - 0x128]
or ebx, 0xffffffff
push eax
call fcn.00489035
pop ecx
xor edi, edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00402477
add esp, 0x10
test eax, eax
jne 0x408b28
mov esi, dword [ebp - 0x11c]
push esi
mov dword [ebp - 0x120], esi
call fcn.00402ce9
pop ecx
cmp eax, 0x4d000003
jne 0x408b1a
lea eax, [esi + 4]
push eax
call fcn.00402ce9
mov ecx, dword [ebp - 0x120]
mov esi, eax
add ecx, 8
push ecx
call fcn.00402ce9
pop ecx
pop ecx
cmp esi, dword [ebp + 0xc]
jne 0x408b1a
cmp eax, 0x1000f
jne 0x408b03
xor ebx, ebx
inc ebx
jmp 0x408b17
cmp eax, 0x10001
jne 0x408b0e
xor ebx, ebx
jmp 0x408b17
cmp eax, 0x2bad2bad
jne 0x408b1a
mov ebx, eax
xor edi, edi
inc edi
push dword [ebp - 0x11c]
call fcn.0041d2a0
pop ecx
jmp 0x408b5e
cmp eax, 0xfffffff4
je 0x408b5b
cmp eax, 0xfffffff5
je 0x408b5b
cmp eax, 0xffffff9d
je 0x408b5b
lea eax, [ebp - 0x124]
push eax
call fcn.00489035
mov eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x128]
pop ecx
cmp eax, dword [ebp + 0x10]
jle 0x408a9c
jmp 0x408b66
xor edi, edi
inc edi
test edi, edi
je 0x408a9c
mov eax, ebx
pop ebx
jmp 0x408b6e
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x408b7e
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor ecx, ecx
lea edi, [ebp - 0x114]
xor eax, eax
mov byte [ebp - 0x118], cl
mov word [ebp - 0x117], cx
mov esi, ecx
mov byte [ebp - 0x115], cl
stosd dword es:[edi], eax
mov dword [ebp - 0x11c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push 0x4d000001
call fcn.00402d5c
lea eax, [ebp - 0x110]
push eax
push 1
call fcn.00402d5c
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0xc]
call fcn.00402d5c
add esp, 0x18
lea eax, [ebp - 0x104]
push 0xff
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x408d2b
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x408c1f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.00402d5c
push 0x11
lea eax, [ebp - 0x118]
mov byte [ebp - 0x108], 1
push eax
push dword [ebp + 8]
call fcn.004027a0
add esp, 0x14
test eax, eax
je 0x408c55
mov eax, 0xe40001
jmp 0x408d2e
push ebx
lea eax, [ebp - 0x128]
or ebx, 0xffffffff
push eax
call fcn.00489035
pop ecx
xor edi, edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00402477
add esp, 0x10
test eax, eax
jne 0x408ce8
mov esi, dword [ebp - 0x11c]
push esi
mov dword [ebp - 0x120], esi
call fcn.00402ce9
pop ecx
cmp eax, 0x4d000003
jne 0x408cda
lea eax, [esi + 4]
push eax
call fcn.00402ce9
mov ecx, dword [ebp - 0x120]
mov esi, eax
add ecx, 8
push ecx
call fcn.00402ce9
pop ecx
pop ecx
cmp esi, dword [ebp + 0xc]
jne 0x408cda
cmp eax, 0x10000
jne 0x408cce
xor ebx, ebx
jmp 0x408cd7
cmp eax, 0x2bad2bad
jne 0x408cda
mov ebx, eax
xor edi, edi
inc edi
push dword [ebp - 0x11c]
call fcn.0041d2a0
pop ecx
jmp 0x408d1e
cmp eax, 0xfffffff4
je 0x408d1b
cmp eax, 0xfffffff5
je 0x408d1b
cmp eax, 0xffffff9d
je 0x408d1b
lea eax, [ebp - 0x124]
push eax
call fcn.00489035
mov eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x128]
pop ecx
cmp eax, dword [ebp + 0x10]
jle 0x408c68
jmp 0x408d26
xor edi, edi
inc edi
test edi, edi
je 0x408c68
mov eax, ebx
pop ebx
jmp 0x408d2e
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x408d5c
Capabilities:
Connect socket
Get socket status
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
mov dword [ebp - 0x2ac], ebx
test eax, eax
je 0x408de6
cmp byte [eax], 0
je 0x408de6
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push edi
push ebx
push 2
mov dword [ebp - 0x2b8], eax
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408dfd
call ebx
cmp eax, 0x276d
jne 0x408de6
lea ecx, [ebp - 0x2a8]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x408de6
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408dfa
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret
xor edi, edi
inc edi
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x408e71
call ebx
cmp eax, 0x2733
je 0x408e71
push 2
pop eax
push eax
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
je 0x408de6
jmp 0x408de0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x114], esi
xor edx, edx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x2b0], edx
cmp eax, ecx
jl 0x408e9d
mov dword [ebp - 0x2b4], eax
jmp 0x408ea7
mov dword [ebp - 0x2b0], 0x30d40
lea eax, [ebp - 0x2b4]
push eax
push edx
lea eax, [ebp - 0x118]
push eax
push edx
push edx
call dword [sym.imp.WS2_32.dll_select]
push 2
mov ebx, eax
pop eax
push eax
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
je 0x408edc
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp ebx, 0xffffffff
je 0x408de6
lea ecx, [ebp - 0x118]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x408f02
test ebx, ebx
jle 0x408f02
xor eax, eax
inc eax
jmp 0x408de9
xor eax, eax
jmp 0x408de9
Function at 0x40b161
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x160c
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x1400
mov dword [ebp - 0x15b4], eax
xor ebx, ebx
lea eax, [ebp - 0x1508]
push ebx
push eax
call fcn.00481190
mov esi, 0x94
lea eax, [ebp - 0x159c]
push esi
push ebx
push eax
call fcn.00481190
add esp, 0x18
mov dword [ebp - 0x159c], esi
lea eax, [ebp - 0x159c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b35b
cmp dword [ebp - 0x1598], 6
jb 0x40b35b
push edi
push 0x4a2538
mov dword [ebp - 0x15ac], ebx
mov dword [ebp - 0x15a8], ebx
mov dword [ebp - 0x15a4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x15b8], esi
test esi, esi
je 0x40b35a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push esi
call edi
mov dword [ebp - 0x15a0], eax
call fcn.00406af6
test eax, eax
je 0x40b263
push str.Wow64DisableWow64FsRedirection
push esi
call edi
push str.Wow64RevertWow64FsRedirection
push esi
mov dword [ebp - 0x15b0], eax
call edi
mov edi, eax
mov eax, dword [ebp - 0x15b0]
mov dword [ebp - 0x15ac], edi
test eax, eax
je 0x40b263
test edi, edi
je 0x40b263
lea ecx, [ebp - 0x15a8]
push ecx
call eax
test eax, eax
je 0x40b263
mov dword [ebp - 0x15a4], 1
mov eax, dword [ebp - 0x15a0]
test eax, eax
je 0x40b33e
call eax
mov dword [ebp - 0x15a0], eax
cmp eax, 0xffffffff
je 0x40b33e
push 0x44
pop edi
push edi
lea eax, [ebp - 0x160c]
push ebx
push eax
call fcn.00481190
mov dword [ebp - 0x160c], edi
xor eax, eax
mov word [ebp - 0x15dc], ax
lea edi, [ebp - 0x15c8]
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x15e0], 1
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40b33e
push dword [ebp - 0x15b4]
lea eax, [ebp - 0x108]
push dword [ebp + 0xc]
push dword [ebp - 0x15a0]
push eax
lea eax, [ebp - 0x1508]
push str._smsg.exe__d__TIME:_d__W__s
push eax
call fcn.004018a8
add esp, 0x18
lea eax, [ebp - 0x15c8]
push eax
lea eax, [ebp - 0x160c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1508]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40b33e
push dword [ebp - 0x15c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
call esi
push dword [ebp - 0x15c4]
call esi
mov esi, dword [ebp - 0x15b8]
cmp dword [ebp - 0x15a4], 0
je 0x40b353
push dword [ebp - 0x15a8]
call dword [ebp - 0x15ac]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x40b54b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x88], ebx
mov al, byte [ecx + str.SystemCurrentControlSetServicesVxDKaseya]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40b573
lea eax, [ebp - 0x8c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x84]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b633
mov ecx, ebx
mov al, byte [ecx + str.ConfigurationFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40b5ae
push esi
mov esi, 0x105
push esi
push ebx
push edi
call fcn.00481190
add esp, 0xc
mov dword [ebp - 0x88], esi
lea eax, [ebp - 0x88]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40b620
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b612
sub ecx, edx
cmp ecx, 1
jae 0x40b644
mov ecx, str..kaseyad.ini
sub edi, ecx
mov al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
test al, al
jne 0x40b627
jmp 0x40b644
mov ecx, str..kaseyad.ini
sub edi, ecx
mov al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
test al, al
jne 0x40b63a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret

Function at 0x40bcdf
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4d6a38], 0
push ebx
push esi
mov ebx, 0x4d6a38
jne 0x40bd3e
push edi
push ebx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bd05
mov ax, word [0x4a2e40]
mov edx, dword [ebp + 8]
mov esi, edx
mov word [edi], ax
mov al, byte [edx]
inc edx
test al, al
jne 0x40bd1b
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bd27
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREKaseyaRelay
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bd96
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x4d6a24
lea eax, [ebp - 0xc]
push eax
push esi
push str.TraceOptions
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bd9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x4d6a38], 0
je 0x40be07
push esi
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push 3
push 0xc0000000
push 0x4d6a38
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40be05
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40bdfe
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bde5
push edi
lea eax, [ebp - 4]
sub ecx, edx
push eax
push ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bf22
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ecx
push eax
push 0x40bea9
push ecx
push ecx
mov dword [edi], ecx
mov dword [ebp - 8], edi
call fcn.0048f2f0
add esp, 0x18
test eax, eax
je 0x40bf8f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
pop esi
jmp 0x40bf89
test esi, esi
jle 0x40bf8e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
cmp dword [edi], 0
je 0x40bf7c
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40c44d
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
jg 0x40c478
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40c4f8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x40c425
push ebx
push ebx
call fcn.0048f2f0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40c4f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
imul ecx, edi, 0x3e8
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x40c4da
lea eax, [ebp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x40c4e8
push 0xffffffffffffff9c
pop edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp + 0x18], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x18]
jmp 0x40c4f7
or eax, 0xffffffff
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c4fe
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push edi
mov edi, 0x800
xor ebx, ebx
push edi
push ebx
push eax
call fcn.00481190
push edi
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00481190
add esp, 0x18
test esi, esi
jne 0x40c581
push 0xc1a
push str.file_remove
push str.srcwinMainConnector.cpp
push str.__s:_s:_d____Invalid_input_parameter_s_:_filenameNULL__r_n
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00407ee5
lea eax, [ebp - 0x804]
mov byte [ebp - 5], bl
push eax
push ebx
call fcn.0040c0c1
add esp, 0x20
or eax, 0xffffffff
jmp 0x40c612
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
js 0x40c610
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c610
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x804]
push 0x800
push eax
push edi
call fcn.004079be
add esp, 0xc
test eax, eax
jne 0x40c612
push edi
lea eax, [ebp - 0x804]
push eax
push esi
push 0xc32
push str.file_remove
push str.srcwinMainConnector.cpp
push str.__s:_s:_d____DeleteFile__s__failed:__s___d___r_n
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00407ee5
lea eax, [ebp - 0x1004]
mov byte [ebp - 0x805], bl
push eax
push ebx
call fcn.0040c0c1
add esp, 0x2c
mov eax, edi
jmp 0x40c612
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x40ca87
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x90c]
push 0x800
xor ebx, ebx
push ebx
push eax
call fcn.00481190
push 0x105
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00481190
mov esi, dword [ebp + 0xc]
add esp, 0x18
test edi, edi
je 0x40cbbe
test esi, esi
jle 0x40cbbe
push 0x104
lea eax, [ebp - 0x10c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40cb79
mov edi, 0x800
lea eax, [ebp - 0x110c]
push edi
push ebx
push eax
call fcn.00481190
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x90c]
push edi
push eax
push esi
call fcn.004079be
add esp, 0xc
test eax, eax
jne 0x40cbff
push esi
lea eax, [ebp - 0x90c]
push eax
push ebx
push 0xbca
push str.krc_server_config_file_get
push str.srcwinMainConnector.cpp
push str.__s:_s:_d____GetEnvironmentVariable__SYSTEMDRIVE___returned__d:__s__GetLastError___d___r_n
lea eax, [ebp - 0x110c]
push edi
push eax
call fcn.00407ee5
lea eax, [ebp - 0x110c]
mov byte [ebp - 0x90d], bl
push eax
push ebx
call fcn.0040c0c1
add esp, 0x2c
mov eax, esi
jmp 0x40cbff
mov ecx, 0x104
cmp eax, ecx
jl 0x40cb9a
push eax
push ecx
push 0xbd7
push str.krc_server_config_file_get
push str.srcwinMainConnector.cpp
push str.__s:_s:_d____Buffer_size_is_too_small_to_hold_the_environment_variable_data:_buffer_size__len_drive___1__d__required_buffer_size_d__r_n
jmp 0x40cbd4
push str.krcServer.ini
push str.KaseyaKRC_Server
lea eax, [ebp - 0x10c]
push eax
push str._sProgram_Files_s_s
push esi
push edi
call fcn.00407ee5
add esp, 0x18
xor eax, eax
jmp 0x40cbff
push esi
push edi
push 0xbb8
push str.krc_server_config_file_get
push str.srcwinMainConnector.cpp
push str.__s:_s:_d____Invalid_input_parameter_s_:_path_0x_0p___len_path_d__r_n
mov edi, 0x800
lea eax, [ebp - 0x90c]
push edi
push eax
call fcn.00407ee5
lea eax, [ebp - 0x90c]
mov byte [ebp - 0x10d], bl
push eax
push ebx
call fcn.0040c0c1
add esp, 0x28
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x40e623
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf01ff
push esi
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40e6b6
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x40e6ad
jmp 0x40e6a7
mov eax, dword [ebp - 8]
cmp eax, 0x2710
jae 0x40e67b
mov eax, 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40e6ad
cmp dword [ebp - 0x1c], 1
je 0x40e6ad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x24]
cmp eax, 0x7530
ja 0x40e6ad
cmp dword [ebp - 0x1c], 1
jne 0x40e66c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x4107b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x41c
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
cmp dword [ebp + 8], 0
je 0x4107dd
cmp dword [ebp + 0xc], 0
jg 0x4107e7
mov eax, 8
jmp 0x41088f
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x414], 0
push 0x40f
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.00481190
add esp, 0xc
push 0x410
lea ecx, [ebp - 0x414]
push ecx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x41083b
mov eax, 0x11
jmp 0x41088f
push str.__x86_
lea edx, [ebp - 0x414]
push edx
call fcn.004105e0
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x410867
mov eax, dword [ebp - 0x418]
mov byte [eax], 0
push str.krc_passwd
push str.KRC_Server
lea ecx, [ebp - 0x414]
push ecx
push str._sKaseya_s_s
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00410600
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f259
mov esp, ebp
pop ebp
ret
Function at 0x416760
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4167d5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4167d5
mov esi, dword [esp + 0x110]
push 2
call fcn.0049127b
add esp, 4
lea ecx, [esp + 0x114]
push ecx
push 0
push esi
push eax
call fcn.00401871
push dword [eax + 4]
push dword [eax]
call fcn.0048866f
add esp, 0x18
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.00401871
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004886e6
add esp, 0x1c
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x416872
call fcn.00416620
test eax, eax
jle 0x416872
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret