joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57652040
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
push ebx
push ebp
push esi
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
xor ebp, ebp
call sub.KERNEL32.dll_Process32First
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, byte [0x576876ec]
mov dword [esp + 0x10], eax
mov byte [esp + 0x13c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x13c]
push str.secuauth.exe
push edx
stosb byte es:[edi], al
call sub.MSVCRT.dll_sprintf
add esp, 8
test bl, bl
je 0x576520fc
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x13c]
push eax
push ecx
call edi
test eax, eax
jne 0x576520d4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jne 0x576520f7
lea eax, [esp + 0x14]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test al, al
jne 0x576520b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x230
ret
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x230
ret

Function at 0x57653860
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x314
push ebx
mov ebx, dword [esp + 0x31c]
test ebx, ebx
push esi
je 0x57653944
push 0
call sub.MSVCRT.dll_time
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
call sub.MSVCRT.dll_localtime
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
inc edx
add eax, 0x76c
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push str._04d_02d_02d
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0x114]
push 0x576897b0
push 0x5768352c
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x114]
lea edx, [esp + 0x218]
push eax
push ecx
push str._sHK_s.log
push edx
call esi
push 0
push 0x80
push 4
push 0
push 0
lea eax, [esp + 0x23c]
push 0x40000000
push eax
call fcn.57661420
mov esi, eax
add esp, 0x2c
cmp esi, 0xffffffff
je 0x57653944
push edi
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x314
ret
Function at 0x5765c5d0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x208
mov al, byte [0x576876ec]
push ebp
push esi
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x114]
push 0x100
push ecx
stosb byte es:[edi], al
call sub.WS2_32.dll_gethostname
lea edx, [esp + 0x114]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
mov dword [esp + 0xc], eax
je 0x5765c6ce
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x5765c6ce
xor edi, edi
mov eax, dword [edi + eax]
mov ebp, dword [eax]
push ebp
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [esp + 0x14]
push 0x5768352c
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov esi, str.127.0.0.1
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5765c676
test cl, cl
je 0x5765c672
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5765c676
add eax, 2
add esi, 2
test cl, cl
jne 0x5765c652
xor eax, eax
jmp 0x5765c67b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5765c6b5
mov esi, str.localhost
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5765c6ac
test cl, cl
je 0x5765c6a8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5765c6ac
add eax, 2
add esi, 2
test cl, cl
jne 0x5765c688
xor eax, eax
jmp 0x5765c6b1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5765c6da
mov eax, dword [esp + 0xc]
mov byte [esp + 0x10], 0
add edi, 4
mov eax, dword [eax + 0xc]
cmp dword [edi + eax], 0
jne 0x5765c62b
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x208
ret
push ebp
call sub.WS2_32.dll_inet_ntoa
pop edi
pop esi
pop ebp
add esp, 0x208
ret

Function at 0x5765c7f0
Capabilities:
Read .ini file

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x576894a4
push 0
push str.SERVER
push str.TIME
call edi
push 0x576894a4
push 0
push str.CLIENT
push str.TIME
mov esi, eax
call edi
test esi, esi
mov edi, eax
jbe 0x5765c82b
test edi, edi
ja 0x5765c82f
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x418]
test eax, eax
jne 0x5765c846
push eax
call sub.MSVCRT.dll_time
add esp, 4
sub eax, edi
lea ecx, [esp + 8]
add eax, esi
push ecx
mov dword [esp + 0xc], eax
call sub.MSVCRT.dll_localtime
mov edx, dword [eax]
mov ecx, dword [eax + 4]
add esp, 4
push edx
mov edx, dword [eax + 8]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
inc edx
push ecx
mov ecx, dword [esp + 0x24]
add eax, 0x76c
push edx
push eax
push str.__04d_02d_02d_02d_02d_02d
push ecx
call sub.MSVCRT.dll_swprintf
add esp, 0x20
pop edi
pop esi
pop ecx
ret 8
Function at 0x5765d4b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x218
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.watermark.ini
push 0
push str.WATERCHECK
mov ebp, ecx
push str.SETUP
call esi
test eax, eax
jne 0x5765d4ef
push str.DrawUserWaterMark_GetPrivateProfileIntW_error
call fcn.57653a20
add esp, 4
pop esi
pop ebp
add esp, 0x218
ret 8
push ebx
push edi
push str.watermark.ini
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x14]
push 1
push str.FONTSIZE
rep stosd dword es:[edi], eax
push str.WATER
call esi
push str.watermark.ini
push 0
push 0x576868f8
push str.WATER
mov dword [esp + 0x230], eax
call esi
push str.watermark.ini
push 0
push str.WATERMARK
push str.WATER
mov dword [esp + 0x22c], eax
call esi
push str.watermark.ini
push 0
push str.FONT
push str.WATER
mov dword [esp + 0x228], eax
call esi
test eax, eax
jne 0x5765d56a
mov eax, 0x66
jmp 0x5765d577
xor ecx, ecx
cmp eax, 1
setne cl
add ecx, 0x67
mov eax, ecx
lea edx, [esp + 0x10]
push 0x104
push edx
push eax
mov eax, dword [0x57687724]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push str.watermark.ini
push 0xc8
push str.BLUE
push str.COLOR
call esi
push str.watermark.ini
push 0xc8
xor ebx, ebx
push str.GREEN
push str.COLOR
mov bh, al
call esi
push str.watermark.ini
push 0xc8
mov bl, al
push 0x576868ac
push str.COLOR
shl ebx, 8
call esi
mov esi, dword [esp + 0x230]
mov edi, dword [esp + 0x22c]
lea ecx, [esp + 0x10]
and eax, 0xff
push ecx
or ebx, eax
push esi
push edi
mov ecx, ebp
mov dword [esp + 0x230], ebx
call fcn.5765b3b0
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
push esi
push edi
call fcn.5765b3b0
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x218
ret 8

Function at 0x5765d890
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ebx, ebx
push 0x576894a4
push ebx
push str.SERVER
push str.TIME
call edi
push 0x576894a4
push ebx
push str.CLIENT
push str.TIME
mov esi, eax
call edi
push ebx
mov edi, eax
call sub.MSVCRT.dll_time
mov ecx, dword [esp + 0x14]
sub esi, edi
add esp, 4
add eax, esi
test ecx, ecx
je 0x5765d8f3
mov edx, dword [esp + 0x14]
test edx, edx
je 0x5765d8f3
cmp ecx, eax
ja 0x5765d8e8
cmp edx, eax
jae 0x5765d8f3
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret 8

Function at 0x5765d900
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
push 0x576894a4
push 0
push str.FORCE
mov edi, ecx
push str.OPTION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp word [0x57688138], 0
mov esi, eax
jne 0x5765d92c
pop edi
xor eax, eax
pop esi
ret
test esi, esi
je 0x5765d96a
mov eax, dword [0x57688050]
mov ecx, dword [0x57688054]
test eax, eax
jne 0x5765d958
test ecx, ecx
jne 0x5765d958
push str.CMark::IsOfficial_sets_TRUE__from__to__0_
call fcn.57653a20
add esp, 4
mov eax, 1
pop edi
pop esi
ret
push ecx
push eax
mov ecx, edi
call fcn.5765d890
test eax, eax
je 0x5765d96a
pop edi
xor eax, eax
pop esi
ret
mov eax, esi
pop edi
pop esi
ret
Function at 0x5765ddc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x104
lea ebp, [esi + 0x518]
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esi + 0xa2c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [esi + 0xc34], 2
ja 0x5765de24
lea edi, [esi + 0x414]
push ebp
push str._sPaperSecu
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ebx, [esi + 0x310]
push ebp
push str._sSysback
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x5765de7d
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, byte [esp + 0x10]
xor ecx, ecx
test al, al
je 0x5765de52
cmp al, 0x5c
je 0x5765de4d
mov al, byte [esp + ecx + 0x11]
inc ecx
test al, al
jne 0x5765de3e
jmp 0x5765de52
mov byte [esp + ecx + 0x10], 0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x10]
lea edi, [esi + 0x414]
push edx
push str._sPaperSecu
push edi
call ebp
add esp, 0xc
lea ebx, [esi + 0x310]
push edi
push str._sSysback
push ebx
call ebp
add esp, 0xc
lea eax, [esi + 0x824]
push 0x104
push eax
push edi
call fcn.57661060
add esi, 0x61c
push 0x104
push esi
push ebx
call fcn.57661060
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x5765dfc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
mov dl, byte [0x576876ec]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], dl
mov byte [esp + 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x576894a4
lea eax, [esp + 0x114]
push 0x400
push eax
push 0x576876ec
push str.SERIAL
push str.Setup
xor edi, edi
call esi
push 0x576894a4
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0x576876ec
push str.Certify
push str.CERTINFO
call esi
mov al, byte [esp + 0xc]
test al, al
jne 0x5765e072
lea edx, [esp + 0xc]
push edx
push str.GetCertify_:_Read_certpath_failed__s
call fcn.57653a20
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret 4
mov esi, dword [esp + 0x218]
push ebp
lea eax, [esp + 0x114]
push esi
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebx
call fcn.5765e7e0
mov ebp, eax
test ebp, ebp
je 0x5765e0a8
mov eax, dword [esi + 0xc]
test eax, eax
jbe 0x5765e0b5
push eax
mov ecx, ebx
call fcn.5765e8f0
mov edi, eax
jmp 0x5765e0b5
push str.GetCertify_:_LoadCertify_failed
call fcn.57653a20
add esp, 4
test ebp, ebp
pop ebp
je 0x5765e064
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x5765e7e0
Capabilities:
Read .ini file
Read file on windows

Disassembly:
sub esp, 0x10c
mov al, byte [0x576876ec]
push ebx
push esi
mov dword [esp + 8], ecx
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
push 3
stosb byte es:[edi], al
mov edi, dword [esp + 0x128]
push 0
push 0
push SysReAllocStringLen
push edi
mov ebx, 1
mov dword [esp + 0x2c], 0
call fcn.57661420
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x5765e858
push edi
push str.LoadCertify_:_Create_File_error__s
call fcn.57653a20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 0xc
push ebp
mov ebp, dword [esp + 0x128]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0xf50
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5765e88a
push edi
push str.LoadCertify_:_Read_File_error__s
call fcn.57653a20
add esp, 8
xor ebx, ebx
jmp 0x5765e8d1
cmp word [ebp + 0x8c4], 0x84
jle 0x5765e8a4
push str.LoadCertify_:_SaveType_error
call fcn.57653a20
add esp, 4
xor ebx, ebx
push 0x576894a4
lea edx, [esp + 0x1c]
push 0x104
push edx
push 0x576876ec
push 0x57683138
push str.Setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x10]
call fcn.5765ed90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret 0xc
Function at 0x5765e8f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x60c
mov dl, byte [0x576876ec]
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], dl
mov byte [esp + 0x21c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x21d]
push 0x576894a4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
push 0x576876ec
push str.Reject
push str.CERTINFO
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x14]
test al, al
je 0x5765eadb
lea ecx, [esp + 0x14]
push ecx
push ebx
push str.COUNT
push str.Reject
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x5765e98d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60c
ret 4
cmp dword [esp + 0x620], esi
je 0x5765e9a5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60c
ret 4
push 0x10c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5765e9c5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60c
ret 4
mov ecx, 0x43
xor eax, eax
mov edi, ebx
xor ebp, ebp
rep stosd dword es:[edi], eax
test esi, esi
mov dword [ebx + 0x104], ebx
mov dword [ebx + 0x108], ebx
jbe 0x5765eae8
mov dl, byte [0x576876ec]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x21c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x119]
mov byte [esp + 0x118], dl
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x11c]
push str.EXEREJECT_d
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x21c]
lea eax, [esp + 0x118]
push ecx
push 0x400
push edx
push 0x576876ec
push eax
push str.REJECT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x21c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5765eac3
push 0x10c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x5765eabf
mov ecx, 0x43
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x21c]
push ecx
push 0x5768352c
push esi
call sub.MSVCRT.dll_sprintf
mov dword [esi + 0x104], ebx
mov edx, dword [ebx + 0x108]
mov dword [esi + 0x108], edx
mov eax, dword [ebx + 0x108]
add esp, 0xc
mov dword [eax + 0x104], esi
mov dword [ebx + 0x108], esi
mov esi, dword [esp + 0x10]
inc ebp
cmp ebp, esi
jb 0x5765e9e6
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x60c
ret 4
push str.LoadRejectFile_:_RegRead_failed
call fcn.57653a20
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x60c
ret 4
Function at 0x5765ed90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
push esi
push edi
mov ecx, 0x33
xor eax, eax
mov edi, 0x57687780
push 0x576897b0
rep stosd dword es:[edi], eax
mov al, byte [0x576876ec]
mov ecx, 0x40
mov byte [esp + 0x10], al
xor eax, eax
lea edi, [esp + 0x11]
push str._sSecuPop.cer
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push 0x80
push 3
push 0
push 0
lea edx, [esp + 0x2c]
push SysReAllocStringLen
push edx
call fcn.57661420
mov esi, eax
add esp, 0x28
cmp esi, 0xffffffff
je 0x5765ee27
lea eax, [esp + 8]
push 0
push eax
push 0xcc
push 0x57687780
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x5765ef50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov al, byte [0x576876ec]
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
push 0x576897b0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push str._spc.pol
push ecx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
xor edi, edi
lea edx, [esp + 0x18]
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocStringLen
push edx
call fcn.57661420
mov esi, eax
add esp, 0x28
cmp esi, 0xffffffff
jne 0x5765efc4
mov word [0x57688808], di
pop edi
mov word [0x5768880a], 1
pop esi
add esp, 0x108
ret
lea eax, [esp + 8]
push edi
push eax
push 4
push 0x57688808
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5765efec
mov word [0x57688808], di
mov word [0x5768880a], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x108
ret

Function at 0x5765f020
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x57687780]
sub esp, 0x30c
test eax, eax
je 0x5765f110
push 0x57687784
call sub.MSVCRT.dll_wcslen
add esp, 4
test eax, eax
jbe 0x5765f110
mov eax, dword [0x5768a2f8]
test eax, eax
jne 0x5765f110
mov dl, byte [0x576876ec]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x20d]
mov byte [esp + 0x20c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x576898b4
lea eax, [esp + 8]
push str._sSecuPOP.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x114]
push 0x104
push ecx
push 0x57687784
call fcn.57661030
add esp, 0x18
lea edx, [esp + 0x108]
lea eax, [esp + 4]
lea ecx, [esp + 0x20c]
push edx
push eax
push str._s___s_
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea edx, [esp + 0x20c]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x5768a2f8], 1
pop edi
add esp, 0x30c
ret
Function at 0x5765fbc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.LogoRequestStrInsert___in
call fcn.57653a20
add esp, 4
push str.GlobalSecuPrintShareMemory
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x5765fc41
push eax
push eax
lea eax, [esp + 0x20]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [esp + 0x18]
push ecx
push 0x5768352c
call fcn.57653a20
mov edx, dword [esp + 0x20]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.LogoRequestStrInsert___hMapFileNULL_ERROR
call fcn.57653a20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push 0x62208
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x5765fc73
push str.LogoRequestStrInsert___psharedInfoNULL_ERROR
call fcn.57653a20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
call fcn.5765f2c0
mov eax, dword [esi + 0x42184]
mov edi, eax
and edi, 0x8000001f
jns 0x5765fc8d
dec edi
or edi, 0xffffffe0
inc edi
inc eax
mov dword [esi + 0x42184], eax
mov eax, dword [esi + edi*4 + 0x62188]
test eax, eax
je 0x5765fd0c
cmp eax, 4
je 0x5765fd0c
cmp eax, 0xf
je 0x5765fd0c
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, eax
mov eax, dword [esi + edi*4 + 0x62188]
test eax, eax
je 0x5765fd38
cmp eax, 4
je 0x5765fd38
cmp eax, 0xf
je 0x5765fd38
call ebx
sub eax, ebp
cmp eax, 0x2710
jbe 0x5765fcb3
push esi
mov dword [esi + edi*4 + 0x62188], 0xf
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.LogoRequestStrInsert___LOGO_ERROR_Return
call fcn.57653a20
add esp, 4
call fcn.5765f2d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0x18]
mov edx, edi
shl edx, 0xc
push 0x1000
push ecx
lea eax, [edx + esi + 0x42188]
push eax
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov dword [esi + edi*4 + 0x62188], 1
jmp 0x5765fd3c
mov ebx, dword [esp + 0x10]
call fcn.5765f2d0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.LogoRequestStrInsert___End
call fcn.57653a20
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x57660350
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x576894a4
push 0
push str.SERVER
push str.TIME
call edi
push 0x576894a4
push 0
push str.CLIENT
push str.TIME
mov esi, eax
call edi
test esi, esi
mov edi, eax
jbe 0x5766038a
test edi, edi
ja 0x5766038e
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x418]
test eax, eax
jne 0x576603a5
push eax
call sub.MSVCRT.dll_time
add esp, 4
sub eax, edi
pop edi
add eax, esi
pop esi
ret 4

Function at 0x57660450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x420]
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [esp + 0x428]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push 0
push eax
push 8
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x424]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x57660559
push edi
mov dword [esp + 0x10], 0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x20]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push 0x400
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57660513
mov eax, dword [esp + 0x18]
test eax, eax
je 0x57660513
lea edx, [esp + 0x14]
push 0
push edx
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x10], eax
jmp 0x576604bf
push 1
push 0
push 0
push esi
call ebp
mov edx, dword [esp + 0x1c]
push 0
push 0
push edx
push esi
mov edi, eax
call ebp
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push 8
push eax
push esi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push edi
push esi
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 0xc