joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x324
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x320], eax
lea eax, [esp + 0x14]
push eax
call fcn.00407530
lea eax, [esp + 0x18]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e88
sub eax, edx
jne 0x407ea8
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.0042eb15
add esp, 0x324
ret
lea eax, [esp + 0x14]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407eb0
mov ecx, dword [str._npav4.ini]
mov edx, dword [0x45beb0]
mov dword [eax], ecx
mov cx, word [0x45beb4]
mov dword [eax + 4], edx
mov dl, byte [0x45beb6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x224]
push ecx
push 0x45b5a5
push 0x45bea8
push 0x45bea4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.0042eb30
movzx ecx, word [esp + 0xc]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0x12]
push ecx
push edx
push eax
lea ecx, [esp + 0x130]
push str._02d:_02d:_04d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x240]
push eax
call fcn.0045315b
mov ecx, dword [esp + 0x348]
add esp, 0x28
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.0042eb15
add esp, 0x324
ret
Function at 0x407f90
Capabilities:
Check if file exists
Copy file
Move file

Disassembly:
sub esp, 0x314
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x310], eax
call fcn.00407b00
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x10]
push ecx
call fcn.004075a0
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407fd0
sub eax, edx
je 0x408133
push 0x104
lea edx, [esp + 0x10c]
push 0
push edx
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x408000
mov cl, byte [esp + eax + 4]
mov byte [esp + eax + 0x108], cl
inc eax
test cl, cl
jne 0x408000
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408015
mov ecx, dword [str.lClean.dll]
mov edx, dword [0x45bf10]
mov dword [eax], ecx
mov ecx, dword [0x45bf14]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [esp + 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408040
mov edx, dword [str.lClean2.dll]
mov ecx, dword [0x45bf00]
mov dword [eax], edx
mov edx, dword [0x45bf04]
mov dword [eax + 4], ecx
mov cl, byte [0x45bf08]
mov dword [eax + 8], edx
lea edx, [esp + 0x108]
push edx
mov byte [eax + 0xc], cl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408133
push 0x104
lea eax, [esp + 0x210]
push 0
push eax
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 4]
mov byte [esp + eax + 0x20c], cl
inc eax
test cl, cl
jne 0x4080a0
lea eax, [esp + 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4080b8
mov ecx, dword [str..npav4]
mov dx, word [0x45bef8]
mov dword [eax], ecx
mov cl, byte [0x45befa]
mov word [eax + 4], dx
push 1
lea edx, [esp + 0x210]
mov byte [eax + 6], cl
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00407e60
test eax, eax
je 0x408129
call fcn.00407c90
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0042eb15
add esp, 0x314
ret
mov dword [0x470150], 1
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0042eb15
add esp, 0x314
ret
Function at 0x408150
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x10]
push ecx
call fcn.004075a0
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408190
sub eax, edx
je 0x40821a
lea edx, [esp + 4]
push edx
call fcn.004303aa
add esp, 4
push str.ZVSCAN
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4081bf
mov byte [eax], 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4081db
push str.td.exe_not_found_
call fcn.004073f0
add esp, 4
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4081e0
mov edx, dword [str._td.exe__d]
mov ecx, dword [0x45bf1c]
mov dword [eax], edx
mov dx, word [0x45bf20]
mov dword [eax + 4], ecx
mov cl, byte [0x45bf22]
mov word [eax + 8], dx
push 0
lea edx, [esp + 8]
push edx
mov byte [eax + 0xa], cl
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret

Function at 0x408230
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x368
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x364], eax
push esi
mov esi, dword [esp + 0x370]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408251
sub eax, edx
je 0x40836f
push str.Going_shell
call fcn.004073f0
push esi
call fcn.004073f0
push 0x103
lea eax, [esp + 0x69]
push 0
push eax
mov byte [esp + 0x70], 0
call fcn.0042eb30
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x17e]
push edx
mov word [esp + 0x180], cx
call fcn.0042eb30
push esi
lea eax, [esp + 0x184]
push 0x45bf4c
push eax
call fcn.00406ed0
push 0x44
lea ecx, [esp + 0x48]
push 0
push ecx
call fcn.0042eb30
xor eax, eax
lea edx, [esp + 0x198]
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x98]
push 0x45bf48
push eax
mov dword [esp + 0x5c], 0x44
call fcn.0042ecc6
lea ecx, [esp + 0xa0]
add esp, 0x44
push ecx
call fcn.004073f0
add esp, 4
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [esp + 0x180]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40835b
push str.Shell_Failed...
call fcn.004073f0
add esp, 4
pop esi
mov ecx, dword [esp + 0x364]
xor ecx, esp
call fcn.0042eb15
add esp, 0x368
ret
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov ecx, dword [esp + 0x368]
pop esi
xor ecx, esp
call fcn.0042eb15
add esp, 0x368
ret
Function at 0x408550
Capabilities:
Enumerate threads
Suspend thread
Terminate thread

Disassembly:
sub esp, 0x20
xor eax, eax
push ebp
push eax
push 4
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40858c
xor eax, eax
pop ebp
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
push esi
push eax
push 0
push 0x1fffff
mov dword [esp + 0x18], 0x1c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x10], eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40860f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
push edi
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x20], edx
jne 0x4085fe
mov eax, dword [esp + 0x1c]
push eax
push 0
push 0x1fffff
call ebx
mov esi, eax
cmp edi, 1
jne 0x4085f0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4085f7
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4085c6
pop edi
pop ebx
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push ebp
call esi
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x408710
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
mov esi, dword [esp + 0x138]
push edi
push 0x128
lea eax, [esp + 0xc]
push 0
push eax
mov byte [esi], 0
call fcn.0042eb30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x4087db
lea ecx, [esp + 8]
push ecx
push edi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4087db
push ebx
mov ebx, dword [esp + 0x13c]
lea edx, [esp + 0x30]
push edx
call fcn.004303aa
lea eax, [esp + 0x34]
push str._SYSTEM_PROCESS_
push eax
call fcn.0045315b
add esp, 0xc
test eax, eax
je 0x4087b2
lea ecx, [esp + 0x30]
push str.SYSTEM
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x4087b2
cmp ebx, dword [esp + 0x14]
je 0x4087c3
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408776
jmp 0x4087da
lea eax, [esp + 0x30]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4087d0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
call fcn.0042eb15
add esp, 0x12c
ret
Function at 0x408830
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push edi
push 0x128
or esi, 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
mov dword [0x467218], esi
mov dword [0x46721c], esi
mov dword [0x467220], esi
mov dword [0x467224], esi
call fcn.0042eb30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x408912
lea ecx, [esp + 8]
push ecx
push edi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x408912
nop
lea edx, [esp + 0x2c]
push edx
call fcn.004303aa
lea eax, [esp + 0x30]
push str.CSRSS.EXE
push eax
call fcn.0045315b
add esp, 0xc
test eax, eax
jne 0x408903
cmp dword [0x467218], esi
jne 0x4088d4
mov ecx, dword [esp + 0x10]
mov dword [0x467218], ecx
jmp 0x408903
cmp dword [0x46721c], esi
jne 0x4088e8
mov edx, dword [esp + 0x10]
mov dword [0x46721c], edx
jmp 0x408903
cmp dword [0x467220], esi
jne 0x4088fb
mov eax, dword [esp + 0x10]
mov dword [0x467220], eax
jmp 0x408903
cmp dword [0x467224], esi
je 0x408932
lea ecx, [esp + 8]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4088a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042eb15
add esp, 0x12c
ret
mov edx, dword [esp + 0x10]
mov dword [0x467224], edx
jmp 0x408919

Function at 0x408a30
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x160
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x15c], eax
push 0x104
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x64]
push ecx
call fcn.004075a0
lea eax, [esp + 0x68]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a70
sub eax, edx
je 0x408b42
push 0x45bf98
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x408a96
mov byte [eax], 0
lea eax, [esp + 0x58]
dec eax
jmp 0x408aa0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408aa0
mov ecx, dword [str.chkvrtb.exe]
mov edx, dword [0x45bf90]
mov dword [eax], ecx
mov ecx, dword [0x45bf94]
mov dword [eax + 4], edx
lea edx, [esp + 0x58]
push edx
mov dword [eax + 8], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408b42
push edi
lea edi, [esp + 0x5c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408ad7
mov eax, dword [0x45bf88]
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [edi], eax
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.0042eb15
add esp, 0x160
ret
Function at 0x408dd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x110], eax
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x18]
push ecx
call fcn.004075a0
lea eax, [esp + 0x1c]
add esp, 0x10
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408e07
mov edx, dword [str.MCSTRT.EXE]
mov ecx, dword [0x45bfc8]
mov dword [eax], edx
mov edx, dword [0x45bfcc]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov word [esp + 8], ax
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 4]
push 0x45bfc0
push ecx
call fcn.0042ecc6
lea eax, [esp + 0xc]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x408e57
push esi
push edi
lea edi, [esp + 0x14]
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x408e70
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea edx, [esp + 0x18]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
call fcn.0042eb15
add esp, 0x114
ret
Function at 0x408eb0
Capabilities:
Enumerate processes
Move file

Disassembly:
sub esp, 0x338
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x334], eax
push ebp
push edi
push 0x128
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0042eb30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, eax
test ebp, ebp
je 0x40903f
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40903f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
lea edx, [esp + 0x38]
push edx
call fcn.004303aa
mov eax, dword [esp + 0x20]
add esp, 4
push eax
push 0
push 0x410
call ebx
mov esi, eax
test esi, esi
je 0x40902a
push 0x104
lea ecx, [esp + 0x140]
push 0
push ecx
call fcn.0042eb30
add esp, 0xc
push 0x104
lea edx, [esp + 0x140]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call edi
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408f74
sub eax, edx
je 0x40902a
lea eax, [esp + 0x13c]
push eax
call fcn.004303aa
lea ecx, [esp + 0x140]
push str.TEMP_
push ecx
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x40902a
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408dd0
push 0x104
lea eax, [esp + 0x248]
push 0
push eax
call fcn.0042eb30
add esp, 0x10
xor eax, eax
mov cl, byte [esp + eax + 0x13c]
mov byte [esp + eax + 0x240], cl
inc eax
test cl, cl
jne 0x408fd0
lea eax, [esp + 0x240]
dec eax
jmp 0x408ff0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408ff0
mov ecx, dword [str..np4.vir]
mov edx, dword [0x45bfd4]
mov dword [eax], ecx
mov cl, byte [0x45bfd8]
mov dword [eax + 4], edx
push 1
lea edx, [esp + 0x244]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408f16
pop esi
pop ebx
push ebp
call edi
mov ecx, dword [esp + 0x33c]
pop edi
pop ebp
xor ecx, esp
call fcn.0042eb15
add esp, 0x338
ret
Function at 0x409190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x68], eax
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x78]
xor ebx, ebx
push edi
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov byte [esp + 0x10], bl
mov word [esp + 0x11], ax
mov byte [esp + 0x14], bl
mov word [esp + 0x15], cx
mov byte [esp + 0x70], bl
mov dword [esp + 0x71], eax
mov byte [esp + 0x75], al
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x16]
movzx edx, word [esp + 0x14]
mov dword [esp + 0x54], eax
movsx eax, byte [esi + 1]
mov dword [esp + 0x58], ecx
movsx ecx, byte [esi]
push eax
sub edx, 0x76c
push ecx
mov dword [esp + 0x64], edx
lea edx, [esp + 0x14]
push str._c_c
push edx
call fcn.0042ecc6
movsx eax, byte [esi + 4]
movsx ecx, byte [esi + 3]
push eax
push ecx
lea edx, [esp + 0x28]
push str._c_c
push edx
call fcn.0042ecc6
movsx eax, byte [esi + 9]
movsx ecx, byte [esi + 8]
movsx edx, byte [esi + 7]
push eax
movsx eax, byte [esi + 6]
push ecx
push edx
push eax
lea ecx, [esp + 0x9c]
push 0x45c018
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x44]
push edx
call fcn.0042f9d3
movzx esi, ax
lea eax, [esp + 0x4c]
push eax
call fcn.0042f9d3
movzx eax, ax
movzx edx, ax
movzx ecx, si
lea eax, [esp + 0xac]
add esp, 0x40
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
call fcn.0042f9d3
movzx ecx, ax
sub ecx, 0x76c
mov dword [esp + 0x3c], ecx
sub esp, 0x20
mov edi, esp
mov ecx, 9
lea esi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
sub esp, 0x24
mov ecx, 9
lea esi, [esp + 0x6c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00409110
mov ecx, dword [esp + 0xbc]
add esp, 0x48
xor edx, edx
cmp eax, ebx
setle dl
pop edi
pop esi
pop ebx
xor ecx, esp
dec edx
and eax, edx
call fcn.0042eb15
add esp, 0x6c
ret
Function at 0x409ed0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.0042eb30
add esp, 0x18
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push eax
push 0
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x104
mov byte [esp + 0x128], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea edi, [esp + 0x110]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409f50
mov ecx, 6
mov esi, str.Net_Protectorchkvrtb.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x110]
push ecx
push 0x104
lea edx, [esp + 0x14]
push edx
push 0x45c138
movsw word es:[edi], word [esi]
push str.POPUP
push str.NOTIFICATION
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x24], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
push 0x45c138
push eax
call fcn.0045315b
add esp, 8
pop edi
pop esi
test eax, eax
je 0x409fd7
lea ecx, [esp + 4]
push 0x45c11c
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x409fd7
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0042eb15
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, 1
call fcn.0042eb15
add esp, 0x210
ret

Function at 0x40a4c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 8]
push edi
push eax
mov byte [esp + 0x10], 0
call fcn.004075a0
lea ecx, [esp + 0x10]
push ecx
call fcn.004303aa
mov ebx, dword [esp + 0x124]
add esp, 8
test ebx, ebx
jne 0x40a51d
lea edx, [esp + 0xc]
push str.ZVSCAN
push edx
call fcn.0042f090
add esp, 8
test eax, eax
je 0x40a51d
mov byte [eax], bl
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a521
lea edi, [esp + 0xc]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a530
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test ebx, ebx
pop ebx
jne 0x40a556
push 5
lea eax, [esp + 4]
push eax
jmp 0x40a55d
push 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042eb15
add esp, 0x108
ret
Function at 0x40a580
Capabilities:
Get disk information

Disassembly:
sub esp, 0x210
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x218]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
push esi
push edi
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x129]
push 0
push edx
mov byte [esp + 0x130], 0
call fcn.0042eb30
add esp, 0x18
lea eax, [esp + 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
shr eax, 2
mov ebp, eax
xor edi, edi
lea esi, [esp + 0x118]
test ebp, ebp
jbe 0x40a664
push 0x104
lea ecx, [esp + 0x18]
push ecx
push esi
mov byte [esi + 2], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.0042f090
add esp, 8
test eax, eax
jne 0x40a635
inc edi
add esi, 4
cmp edi, ebp
jb 0x40a604
jmp 0x40a664
lea eax, [esp + 0x14]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a640
sub eax, edx
add eax, ebx
push eax
mov eax, dword [esp + 0x14]
push esi
push 0x45c1e0
push 0x104
push eax
call fcn.0042ed5f
add esp, 0x14
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042eb15
add esp, 0x210
ret