joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039a0
Capabilities:
Create service
Start service

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42bbb6
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
push edi
call fcn.00403880
test eax, eax
jne 0x403b13
call fcn.004038d0
test eax, eax
jne 0x403b13
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.tqsys
call fcn.004229a1
call fcn.00403f30
add esp, 4
call fcn.00403d10
lea eax, [esp + 0x14]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.0040fb30
mov byte [eax], bl
mov eax, dword [0x438dd0]
add esp, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x120], ebx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push 0x4384cc
push eax
mov byte [esp + 0x12c], 1
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00422cac
push 0x43cbcc
push str.TQAT
lea ecx, [esp + 0x14]
call fcn.0041daa2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push str._sTQATTQATSYS.SYS
push edx
call fcn.0041e043
add esp, 0xc
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
je 0x403b35
mov eax, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push 1
push 3
push 1
push 0xf01ff
push str.TQATSYS
push str.TQATSYS
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
cmp esi, ebx
jne 0x403ad6
push 0xf01ff
push str.TQATSYS
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x403b30
call esi
push edi
call esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], bl
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.00422933
mov eax, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x118
ret
call esi
push edi
call esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], bl
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.00422933
xor eax, eax
jmp 0x403b18
Function at 0x403b60
Capabilities:
Create service
Start service

Disassembly:
push 0xffffffffffffffff
push 0x42bbd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.0040fb30
mov byte [eax], 0
mov eax, dword [0x438dd0]
add esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 0x120], 0
mov dword [esp + 8], eax
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push 0x4384cc
push eax
mov byte [esp + 0x12c], 1
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 8]
call fcn.00422cac
push 0x43cbcc
push str.TQAT
lea ecx, [esp + 0x10]
call fcn.0041daa2
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push ecx
push str._sTQATTQSTSYS.SYS
push edx
call fcn.0041e043
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push str.TQSTSYS
call fcn.004229a1
call fcn.00403fc0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.TQSTSYS
call fcn.004229a1
call fcn.00403f30
add esp, 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x403cca
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 3
push 1
push 0xf01ff
push str.TQSTSYS
push str.TQSTSYS
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x403c91
push 0xf01ff
push str.TQSTSYS
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..TQSTSYS
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x43cd5c], eax
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call fcn.00422933
lea ecx, [esp + 0xc]
mov dword [esp + 0x120], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 0x118]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x11c
ret
Function at 0x403d10
Capabilities:
Query service configuration

Disassembly:
push 0xffffffffffffffff
push 0x42bc0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x438dd0]
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x130], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.0040fb30
mov byte [eax], 0
mov edx, dword [0x438dd0]
add esp, 8
mov dword [esp + 0xc], edx
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
push 0x4384cc
push ecx
mov byte [esp + 0x13c], 3
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00422cac
push 0x43cbcc
push str.TQAT
lea ecx, [esp + 0x14]
call fcn.0041daa2
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push str._sTQATTQATSYS.SYS
push eax
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00422cac
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0xf003f
push 0
push 0
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0xf01ff
push str.TQATSYS
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403ec9
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x403ec9
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x4384cc
push eax
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00422cac
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041dcbd
test eax, eax
jge 0x403ec9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.TQATSYS
call fcn.004229a1
call fcn.00403f30
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 2
call fcn.00422933
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], 1
call fcn.00422933
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0
call fcn.00422933
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 0xffffffff
call fcn.00422933
xor eax, eax
jmp 0x403f15
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 2
call fcn.00422933
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], 1
call fcn.00422933
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 0
call fcn.00422933
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 0xffffffff
call fcn.00422933
mov eax, 1
mov ecx, dword [esp + 0x128]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x128
ret
Function at 0x403f30
Capabilities:
Delete service

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42bc28
push eax
mov dword fs:[0], esp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x403f8f
mov eax, dword [esp + 0x18]
push 0x10000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x403f7c
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403f8f
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 8]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0x403fc0
Capabilities:
Stop service

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42bc48
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x404011
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422933
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
push edi
push 0x20
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea ecx, [esp + 8]
mov edi, eax
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 0x24]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x404060
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push edi
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTQATSYS
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.Start
push edx
call esi
mov edi, str.PNP_TDI
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.PNP_TDI
push 1
push eax
mov eax, dword [esp + 0x18]
push str.Group
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x4040e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp + 4], 3
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTQATSYS
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404125
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push eax
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
Function at 0x404140
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42bc97
push eax
mov eax, 0x1128
mov dword fs:[0], esp
call fcn.0040fb60
mov eax, dword [esp + 0x1138]
push ebx
push ebp
push esi
push edi
xor edi, edi
push eax
push edi
push 0x410
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x30], esi
je 0x404361
lea ecx, [esp + 0x28]
lea edx, [esp + 0x138]
push ecx
push 0x1000
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x404361
mov dword [esp + 0x20], edi
lea ebp, [esp + 0x138]
mov ebx, 1
mov ecx, dword [ebp]
lea eax, [esp + 0x34]
push 0x104
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x404333
mov eax, dword [0x438dd0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1140], edi
mov dword [esp + 0x18], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0x10]
push edx
push 0x4384cc
push eax
mov byte [esp + 0x114c], bl
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00422cac
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push 0x5c
call fcn.0041dc9b
inc eax
lea edx, [esp + 0x28]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.0041dc05
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1144], 2
call fcn.00422a6c
lea ecx, [esp + 0x24]
mov byte [esp + 0x1140], bl
call fcn.00422933
mov eax, dword [0x43cd38]
xor esi, esi
cmp eax, edi
jle 0x40430a
mov eax, dword [0x438dd0]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x2c]
push esi
push ecx
mov ecx, 0x43cd30
mov byte [esp + 0x1148], 3
call fcn.00404390
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1144], 4
call fcn.00422a6c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1140], 3
call fcn.00422933
mov edx, dword [esp + 0x14]
cmp dword [edx - 8], 4
jle 0x4042ec
lea ecx, [esp + 0x14]
call fcn.00422cac
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call fcn.0041dcbd
test eax, eax
jne 0x4042ec
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004226a8
call fcn.004043c0
add esp, 4
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x1140], bl
call fcn.00422933
mov eax, dword [0x43cd38]
inc esi
cmp esi, eax
jl 0x404266
lea ecx, [esp + 0x18]
mov byte [esp + 0x1140], 0
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x1140], 0xffffffff
call fcn.00422933
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
inc eax
add ebp, 4
shr ecx, 2
cmp eax, ecx
mov dword [esp + 0x20], eax
jbe 0x4041bb
mov eax, dword [esp + 0x1c]
push esi
cmp eax, ebx
jne 0x404362
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x40436a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x1138]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1134
ret
Function at 0x4044d0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42bd17
push eax
mov eax, 0x1124
mov dword fs:[0], esp
call fcn.0040fb60
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
push eax
lea ecx, [esp + 0x138]
xor edi, edi
push 0x1000
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4046d2
mov dword [esp + 0x20], edi
lea ebp, [esp + 0x134]
mov ebx, 1
mov eax, dword [ebp]
lea edx, [esp + 0x30]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4046aa
mov eax, dword [0x438dd0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x113c], edi
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x30]
lea edx, [esp + 0x10]
push ecx
push 0x4384cc
push edx
mov byte [esp + 0x1148], bl
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00422cac
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax - 8]
push eax
push 0x5c
call fcn.0041dc9b
inc eax
lea ecx, [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.0041dc05
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1140], 2
call fcn.00422a6c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x113c], bl
call fcn.00422933
mov eax, dword [0x43cd38]
xor esi, esi
cmp eax, edi
jle 0x404685
mov edx, dword [0x438dd0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x24]
push esi
push eax
mov ecx, 0x43cd30
mov byte [esp + 0x1144], 3
call fcn.00404390
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1140], 4
call fcn.00422a6c
lea ecx, [esp + 0x24]
mov byte [esp + 0x113c], 3
call fcn.00422933
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 8], 4
jle 0x404667
lea ecx, [esp + 0x14]
call fcn.00422cac
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push edx
call fcn.0041dcbd
test eax, eax
jne 0x404667
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004226a8
call fcn.004043c0
add esp, 4
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x113c], bl
call fcn.00422933
mov eax, dword [0x43cd38]
inc esi
cmp esi, eax
jl 0x4045e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x113c], 0
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x113c], 0xffffffff
call fcn.00422933
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
inc eax
add ebp, 4
shr ecx, 2
cmp eax, ecx
mov dword [esp + 0x20], eax
jbe 0x40452f
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edi
setne al
jmp 0x4046d4
xor eax, eax
mov ecx, dword [esp + 0x1134]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1130
ret
Function at 0x4046f0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x42bd3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40473f
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
add esp, 0x138
ret
lea eax, [esp + 0xc]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4047d4
push esi
mov ecx, dword [0x438dd0]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x34]
lea eax, [esp + 0xc]
push edx
push 0x4384cc
push eax
mov dword [esp + 0x14c], 0
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00422cac
push str.SOUL.EXE
lea ecx, [esp + 0x10]
call fcn.0041dcbd
test eax, eax
jne 0x4047ae
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00404140
add esp, 4
cmp eax, 1
jne 0x4047ae
mov ebx, eax
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00422933
test esi, esi
jne 0x404753
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
xor eax, eax
cmp ebx, 1
pop edi
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x404800
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42bd68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x438dd0]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
xor edi, edi
push 0xff
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00422c15
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x43cd38]
xor esi, esi
test eax, eax
jle 0x404942
lea eax, [esp + 0x14]
push esi
push eax
mov ecx, 0x43cd30
call fcn.00404390
mov ecx, dword [eax]
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x14]
cmp edx, 4
setg bl
call fcn.00422933
test bl, bl
je 0x4048fc
lea edx, [esp + 0x18]
push esi
push edx
mov ecx, 0x43cd30
call fcn.00404390
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x14]
push str._s_s
push edx
mov byte [esp + 0x38], 2
call fcn.0041e043
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.00422933
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004226a8
call fcn.004037c0
add esp, 4
test eax, eax
je 0x4048fc
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004226a8
call fcn.004043c0
add esp, 4
mov edi, 1
mov eax, dword [0x43cd38]
inc esi
cmp esi, eax
jl 0x40485c
cmp edi, 1
jne 0x404942
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422933
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00422933
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x404b40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x42bdbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push edi
push 0
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x404b8c
xor eax, eax
pop edi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
add esp, 0x138
ret
lea eax, [esp + 8]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404c58
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
mov ecx, dword [0x438dd0]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x34]
lea eax, [esp + 0xc]
push edx
push 0x4384cc
push eax
mov dword [esp + 0x14c], 0
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00422cac
push str.SOUL.EXE
lea ecx, [esp + 0x10]
call fcn.0041dcbd
test eax, eax
jl 0x404c2d
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00404140
add esp, 4
test eax, eax
je 0x404c2d
mov edx, dword [esp + 0x18]
push edx
push 0
push 0x1f0fff
call ebp
mov esi, eax
test esi, esi
je 0x404c23
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x43cc90
call fcn.0041efde
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00422933
test esi, esi
jne 0x404ba7
pop esi
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x404c80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42bdf1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x438dd0]
push esi
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0
mov dword [esp + 0x128], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.0040fb30
mov byte [eax], 0
mov eax, dword [0x438dd0]
add esp, 8
mov dword [esp + 4], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
push 0x4384cc
push edx
mov byte [esp + 0x128], 1
call fcn.0041e043
add esp, 0xc
lea ecx, [esp + 4]
call fcn.00422cac
push 0x43cbcc
push str.TQAT
lea ecx, [esp + 0xc]
call fcn.0041daa2
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push eax
push str._sTQATkrt.ini
push ecx
call fcn.0041e043
mov edx, dword [esp + 0x14]
add esp, 0xc
push edx
push 0
push str.SYSTEM4
push str.CHCEK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov eax, dword [0x438dd0]
mov dword [esp + 0xc], eax
push esi
lea ecx, [esp + 0x10]
push 0x43822c
push ecx
mov byte [esp + 0x128], 2
call fcn.0041e043
add esp, 0xc
cmp esi, 1
pop esi
jne 0x404dc2
lea ecx, [esp + 8]
mov byte [esp + 0x118], 1
call fcn.00422933
lea ecx, [esp]
mov byte [esp + 0x118], 0
call fcn.00422933
lea ecx, [esp + 4]
mov dword [esp + 0x118], 0xffffffff
call fcn.00422933
mov eax, 1
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret
mov edx, dword [esp + 4]
push edx
push 0x4385c8
push str.SYSTEM4
push str.CHCEK
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 8]
mov byte [esp + 0x118], 1
call fcn.00422933
lea ecx, [esp]
mov byte [esp + 0x118], 0
call fcn.00422933
lea ecx, [esp + 4]
mov dword [esp + 0x118], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 0x110]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x404f40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42be36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x438dd0]
mov dword [esp + 4], eax
lea ecx, [esp + 8]
push 0x104
push ecx
push 0
mov dword [esp + 0x120], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.0040fb30
mov byte [eax], 0
mov eax, dword [0x438dd0]
add esp, 8
mov dword [esp], eax
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push 0x4384cc
push edx
mov byte [esp + 0x120], 1
call fcn.0041e043
add esp, 0xc
lea ecx, [esp]
call fcn.00422cac
push 0x43cbcc
push str.TQAT
lea ecx, [esp + 8]
call fcn.0041daa2
mov eax, dword [esp]
lea ecx, [esp + 4]
push eax
push str._sTQATkrt.ini
push ecx
call fcn.0041e043
mov edx, dword [esp + 0x10]
add esp, 0xc
push edx
push 0
push str.APP4
push str.CHCEK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x405049
lea ecx, [esp]
mov byte [esp + 0x114], 0
call fcn.00422933
lea ecx, [esp + 4]
mov dword [esp + 0x114], 0xffffffff
call fcn.00422933
mov eax, 1
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret
mov eax, dword [esp + 4]
push eax
push 0x4385c8
push str.APP4
push str.CHCEK
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp]
mov byte [esp + 0x114], 0
call fcn.00422933
lea ecx, [esp + 4]
mov dword [esp + 0x114], 0xffffffff
call fcn.00422933
mov ecx, dword [esp + 0x10c]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x118
ret