joyce8/EMBER2024-capa huggingface dataset:
Function at 0x85fd70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov byte [ebp - 0x408], 0
test edi, edi
jne 0x85fda5
push str._AVPMAPP__DirAbsent_A_
push edi
call fcn.0096a780
add esp, 8
jmp 0x85ff38
mov al, byte [edi]
test al, al
jne 0x85fdca
push str._AVPMAPP__DirAbsent_B_
push 0
call fcn.0096a780
add esp, 8
test esi, esi
je 0x85ff38
mov byte [esi], 0
jmp 0x85ff38
cmp al, 0x22
jne 0x85fdd5
mov ecx, edi
call fcn.0096cfa0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x85fde3
push edi
push esi
call ebx
push 0x400
lea eax, [ebp - 0x408]
push eax
push edi
mov byte [ebp - 0x408], 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x85fee0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x57
je 0x85fe39
cmp eax, 5
je 0x85fe39
push eax
push str._AVPMAPP__DirAbsent_C_._RCode:_u
push 0
call fcn.0096a780
add esp, 0xc
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov esi, edi
call fcn.00960950
lea esi, [ebp - 0x548]
mov ecx, edi
call fcn.0094df40
cmp eax, 0xffffffff
jne 0x85feb2
call ebx
push eax
push edi
push str._AVPMAPP__DirAbsent_D____s_._LErr:_u
push 0
call fcn.0096a780
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x85fe98
call ebx
push eax
push edi
push str._AVPMAPP__DirAbsent_D1____s_._LErr:_u
push 0
call fcn.0096a780
add esp, 0x10
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
push esi
push str._AVPMAPP__DirAbsent_D1__Success__0x_x_.
push 0
call fcn.0096a780
mov eax, esi
add esp, 0xc
mov dword [ebp - 0x548], eax
jmp 0x85febf
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x548]
test al, 0x10
je 0x85fed8
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
push eax
push str._AVPMAPP__DirAbsent_E_._FileAtt:0x_x
jmp 0x85ff2e
lea ecx, [ebp - 0x408]
push ecx
push edi
call ebx
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x85ff24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._AVPMAPP__DirAbsent_F_._LErr:_u
push 0
call fcn.0096a780
add esp, 0xc
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
test al, 0x10
jne 0x85fec3
push eax
push str._AVPMAPP__DirAbsent_G_._rval:0x_x
push 0
call fcn.0096a780
add esp, 0xc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x85ff60
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
test ebx, ebx
je 0x860102
push str.Common_AppData
lea eax, [ebp - 0x114]
mov edi, ebx
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, 0x80000002
mov dword [ebp - 0x114], 0x104
mov byte [ebx], 0
call fcn.0094c020
test al, al
jne 0x85ffcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [ebp - 0x110]
call fcn.00960a40
add esp, 4
mov eax, esi
push eax
push str._AVPMAPP__ReadReg_fails___s_
jmp 0x85ffd5
push ebx
push str._AVPMAPP__TmpBuf:__s_
push 0
call fcn.0096a780
add esp, 0xc
cmp byte [ebx], 0
jne 0x85fff8
push str._AVPMAPP__Setting_Default_A_
push 0
call fcn.0096a780
add esp, 8
jmp 0x8600b2
mov ecx, ebx
call fcn.0095a450
test eax, eax
jne 0x860044
push 0x103
push eax
lea ecx, [ebp - 0x10f]
push ecx
mov byte [ebp - 0x110], al
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._AVPMAPP__Setting_Default_B____s_._LastErr_u
push 0
call fcn.0096a780
add esp, 0x10
lea ecx, [ebp - 0x110]
mov edi, ebx
call fcn.0085fd70
jmp 0x8600b2
call fcn.00968d70
test eax, eax
je 0x8600f6
mov eax, str.Common_AppData
mov ecx, eax
call fcn.0094c330
test eax, eax
jne 0x8600f6
push ebx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x110]
call fcn.00960910
push str.microsoft
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ecx, ecx
lea edi, [ebp - 0x110]
call fcn.0095a6d0
test eax, eax
jne 0x8600f6
mov ecx, edi
push ecx
push str._AVPMAPP__Setting_Default_C____s_
push eax
call fcn.0096a780
add esp, 0xc
push ebx
push str.Common_AppData
mov byte [ebx], 0
call fcn.00972d50
push ebx
push str._AVPMAPP__SetDef:__s_
push 0
call fcn.0096a780
add esp, 0x14
cmp byte [ebx], 0
je 0x860102
mov ecx, ebx
call fcn.0095a450
cmp eax, 1
jne 0x8600f6
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, str.Common_AppData
mov ecx, 0x80000002
call fcn.0094bd00
cmp byte [ebx], 0
je 0x860102
mov esi, ebx
call fcn.00960950
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00a78f21
mov esp, ebp
pop ebp
ret

Function at 0x8609c0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 1
call fcn.00860610
add esp, 4
test eax, eax
jne 0x8609ee
push eax
push eax
push 0x8609a0
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_Rld
call fcn.0085df70
pop edi
pop esi
pop ebx
ret
Function at 0x8622c0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
push 0x80000000
push 0
push 0
or ebx, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x86233e
mov eax, dword [ebp + 8]
push esi
push 0x80000000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x862336
lea ecx, [ebp - 0x1c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x18]
dec eax
cmp eax, 6
ja case.0x862311.3
jmp dword [eax*4 + 0x862348]
mov ebx, 2
jmp 0x86232f
mov ebx, 1
jmp 0x86232f
xor ebx, ebx
jmp 0x86232f
mov ebx, 3
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x862a70
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb3de7c
push str.LogRotate
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb3de7c], 0
je 0x862b46
push 0
xor ecx, ecx
call fcn.00861390
add esp, 4
push 0
push 0
push 0x862250
call fcn.00a791b2
add esp, 0xc
cmp dword [0xb54194], 0
je 0x862b46
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00a7ffb0
add esp, 0xc
push 0xb55f40
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0xaacdac
push str.SecServer
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0xb567cc], 0
je 0x862b27
cmp byte [ebp - 0x110], 0x31
jne 0x862b46
push 0
push 0
push 0x862370
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1Apa
call fcn.0085df70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x862f30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb11aa8
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x130], esi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov byte [ebp - 0x128], bl
push 0x103
push ebx
lea eax, [ebp - 0x127]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
push esi
push 0x104
lea ecx, [ebp - 0x128]
push ecx
push 0xaa1543
push str.DisableRDPConnections
push 0xaad368
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x128], bl
je 0x86305d
xor esi, esi
mov dword [ebp - 0x12c], 1
lea edx, [ebp - 0x128]
push edx
call fcn.00a7907a
add esp, 4
mov edi, eax
cmp edi, ebx
jbe 0x862fe9
lea edi, [ebx + 1]
lea eax, [ebp - 0x12c]
push eax
push str.fDenyTSConnections
mov ecx, str.SYSTEMCurrentControlSetControlTerminal_Server
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [ebp - 0x12c]
cmp eax, edi
je 0x863023
mov esi, 1
push eax
push edi
push str._RDP__Setting_DenyTSConnections_to__u__Previous_Val:__u_
push ebx
call fcn.0096a780
add esp, 0x10
cmp esi, ebx
je 0x86305d
mov eax, edi
mov esi, str.fDenyTSConnections
mov ebx, str.SYSTEMCurrentControlSetControlTerminal_Server
mov ecx, 0x80000002
call fcn.0094be90
test al, al
jne 0x863053
push edi
push str._RDP__Failed_to_set_DenyTSConnections_value_to__u_
push 0
call fcn.0096a780
add esp, 0xc
jmp 0x86305d
cmp edi, 1
jne 0x86305d
call fcn.00862b60
mov ecx, dword [ebp - 0x130]
push ecx
push 0x104
lea edx, [ebp - 0x128]
push edx
push 0xaa1543
push str.RDPPort
push 0xaad368
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x128], 0
je 0x863155
lea eax, [ebp - 0x128]
push eax
call fcn.00a7907a
add esp, 4
mov edi, eax
lea ecx, [edi - 1]
cmp ecx, 0xfffd
mov ecx, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
ja 0x86312c
xor esi, esi
mov dword [ebp - 0x12c], 0xd3d
lea edx, [ebp - 0x12c]
push edx
push str.PortNumber
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [ebp - 0x12c]
cmp eax, edi
je 0x8630f5
mov esi, 1
push eax
push edi
push str._RDP__Setting_RDP_PortNumber_to__u__Previous_Val:__u_
push 0
call fcn.0096a780
add esp, 0x10
test esi, esi
je 0x863155
mov eax, edi
mov esi, str.PortNumber
mov ebx, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
mov ecx, 0x80000002
call fcn.0094be90
test al, al
jne 0x863125
push edi
push str._RDP__Failed_to_set_RDP_PortNumber_value_to__u_
push 0
call fcn.0096a780
add esp, 0xc
jmp 0x863155
call fcn.00862b60
jmp 0x863155
mov esi, str.PortNumber
mov edx, 0x80000002
call fcn.0095f910
jmp 0x863155
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8639f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x31f]
push ebx
push eax
mov byte [ebp - 0x320], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x530], ebx
call fcn.0099b370
test eax, eax
jne 0x863c7c
cmp byte [0xbe5c90], bl
jne 0x863aa2
push 0x104
push 0xbe5c90
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0xbe5c90
call fcn.00960910
mov eax, 0xbe5c90
dec eax
nop
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x863a80
mov edx, dword [str.driversetc]
mov ecx, dword [0xaad858]
mov dword [eax], edx
mov edx, dword [0xaad85c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
push 0xbe5c90
lea eax, [ebp - 0x320]
push str._shosts
push eax
call fcn.00a78f30
add esp, 0xc
push 0xbe5c90
lea ecx, [ebp - 0x110]
push str._sesbak.hosts
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x52c]
lea ecx, [ebp - 0x320]
call fcn.0095a0f0
push ebx
push ebx
lea edx, [ebp - 0x530]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0095a0f0
add esp, 0x10
cmp esi, ebx
mov esi, dword [ebp - 0x52c]
jne 0x863bc8
cmp esi, 5
jbe 0x863bd1
cmp dword [ebp - 0x530], esi
je 0x863bc8
push ebx
lea edi, [ebp - 0x110]
lea ebx, [ebp - 0x320]
call fcn.00980a90
add esp, 4
test eax, eax
je 0x863b52
push esi
mov edx, edi
push edx
lea eax, [ebp - 0x528]
push str._HOSTS__Created_Hosts_Backup:__s__Size:_u_
push eax
call fcn.00a78f30
jmp 0x863bab
push 0x103
lea ecx, [ebp - 0x217]
push 0
push ecx
mov byte [ebp - 0x218], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [ebp - 0x218]
call fcn.00960a40
add esp, 4
mov edx, esi
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x528]
push str._HOSTS__Failed_to_Create_Hosts_Backup__s__Reason:_s
push ecx
call fcn.00a78f30
mov esi, dword [ebp - 0x52c]
add esp, 0x10
push 0
push 1
lea edx, [ebp - 0x528]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
cmp esi, 5
ja 0x863c7c
cmp dword [ebp - 0x530], ebx
jbe 0x863c7c
push ebx
lea edi, [ebp - 0x320]
lea ebx, [ebp - 0x110]
call fcn.00980a90
add esp, 4
test eax, eax
je 0x863c0e
mov eax, dword [ebp - 0x530]
push eax
mov ecx, ebx
push ecx
push str._HOSTS__Restored_from_Hosts_Backup:__s__Size:_u_
lea edx, [ebp - 0x528]
push edx
jmp 0x863c5c
push 0x103
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [ebp - 0x218]
call fcn.00960a40
add esp, 4
mov ecx, esi
push ecx
lea edx, [ebp - 0x110]
push edx
push str._HOSTS__Failed_to_Restore_from_Hosts_Backup__s__Reason:_s
lea eax, [ebp - 0x528]
push eax
call fcn.00a78f30
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x528]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x866a50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb13630
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [0xb38bf4]
mov dword [ebp - 0x480], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x230], 0
push 0x103
push 0
lea ecx, [ebp - 0x22f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0
push 0
push 0
lea edx, [ebp - 0x230]
push edx
push 0
xor edx, edx
xor ecx, ecx
call fcn.00973e00
cmp byte [ebp - 0x230], 0
je 0x866c98
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
lea ecx, [ebp - 0x128]
call fcn.00960910
push 0xaae3c4
lea edx, [ebp - 0x128]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
push 1
push 0
xor edx, edx
lea ecx, [ebp - 0x128]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x866b94
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x128]
push ecx
call esi
lea ecx, [ebp - 0x128]
call fcn.00960910
push str.protection.lnk
lea edx, [ebp - 0x128]
push edx
call edi
push 1
push 0
xor edx, edx
lea ecx, [ebp - 0x128]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x866b94
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x128]
push ecx
call esi
lea ecx, [ebp - 0x128]
call fcn.00960910
push str.eScan.lnk
lea edx, [ebp - 0x128]
push edx
call edi
push 1
push 0
xor edx, edx
lea ecx, [ebp - 0x128]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x866c98
lea edi, [eax + 1]
lea esi, [ebp - 0x478]
lea ecx, [ebp - 0x128]
call fcn.0094df40
mov dword [ebp - 0x47c], eax
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x866c98
test edi, edi
je 0x866c72
mov ebx, dword [ebp - 0x478]
test bl, 0x10
jne 0x866c54
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x338]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x338]
call fcn.00960910
lea edx, [ebp - 0x44c]
push edx
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x480], 0
je 0x866c3b
test bl, 6
je 0x866c54
push 0x80
lea ecx, [ebp - 0x338]
push ecx
jmp 0x866c4e
test bl, 2
je 0x866c45
test bl, 4
jne 0x866c54
push 6
lea edx, [ebp - 0x338]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea esi, [ebp - 0x478]
mov ecx, dword [ebp - 0x47c]
call fcn.0094e160
mov edi, eax
mov eax, dword [ebp - 0x47c]
jmp 0x866bd0
cmp eax, 0xffffffff
je 0x866c98
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x866c98
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x86af90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xb45d94], 0
push esi
je 0x86b08e
cmp dword [ebp + 8], 0
jne 0x86afc8
mov eax, dword [0xbd5784]
cmp eax, dword [0xbd5788]
je 0x86b08e
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xb55918
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push str.PBAE_Status
push 0xaafecc
push 0xaaec30
call esi
cmp dword [0xbd5784], 0
push 0xb55918
lea edx, [ebp - 0x110]
push 0x104
push edx
je 0x86b048
push str.Active
push str.LblActive
push str.EScanPro
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push str.eScan_Monitor
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0xaa154c
push 0
push 0x301
jmp 0x86b084
push str.Inactive
push str.LblInactive
push str.EScanPro
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push str.eScan_Monitor
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0xaa154c
push 0
push 0x302
mov ecx, str.eScan_Ransomware_Protection
call fcn.00982e00
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00a78f21
mov esp, ebp
pop ebp
ret

Function at 0x86b0a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xb45d94], 0
push esi
je 0x86b1b7
cmp dword [ebp + 8], 0
jne 0x86b0d8
mov eax, dword [0xb5418c]
cmp eax, dword [0xbd578c]
je 0x86b1b7
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xb55918
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push str.PBAE_Status
push 0xaafecc
push 0xaaec30
call esi
push str.SENS
lea edx, [ebp - 0x218]
push str.PBAE
push edx
call fcn.0095e130
add esp, 0xc
cmp dword [0xb5418c], 0
push 0xb55918
lea eax, [ebp - 0x110]
push 0x104
push eax
je 0x86b171
push str.Active
push str.LblActive
push str.EScanPro
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push str.eScan_Monitor
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0xaa154c
push 0
push 0x30c
jmp 0x86b1ad
push str.Inactive
push str.LblInactive
push str.EScanPro
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push str.eScan_Monitor
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0xaa154c
push 0
push 0x30d
mov ecx, str.eScan_Identity_Theft
call fcn.00982e00
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x86b3b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
mov ecx, str.MyMysaHand
mov dword [ebp - 0x114], eax
call fcn.00962f00
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x118], eax
test eax, eax
je 0x86b411
call esi
cmp eax, 0xb7
jne 0x86b411
lea ecx, [ebp - 0x118]
push ecx
call fcn.00985290
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x118]
push edx
call fcn.00985290
lea eax, [ebp - 0x114]
push eax
push 0
push 0x86b1d0
call fcn.00a791b2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x86b478
call esi
push eax
lea ecx, [ebp - 0x110]
push str.Error:_beginthread_5y_BX__fails_with_error__d
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x110]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_2cBX
call fcn.0085df70
cmp dword [ebp - 0x114], ebx
je 0x86b4a2
mov edi, edi
mov esi, 5
call fcn.0094d160
cmp dword [ebp - 0x114], ebx
jne 0x86b490
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x86d1d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb14cb0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
lea eax, [ebp - 0x128]
push eax
push 4
push ebx
push 0x86cde0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x124], esi
cmp esi, ebx
jne 0x86d29b
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.00a7ffb0
push 0x104
lea esi, [ebp - 0x120]
call fcn.00960b00
mov edx, esi
push edx
push str._THRD__A__CreateThread_Failed___s
push ebx
call fcn.0096a780
add esp, 0x1c
call fcn.00968790
test eax, eax
jne 0x86d290
lea esi, [ebx + 2]
call fcn.0086cbc0
mov dword [ebp - 4], 0xfffffffe
jmp 0x86d2ef
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x86d2ef
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [ebp - 0x128]
or esi, 0xffffffff
mov edi, str.WAV_STAT_4a
call fcn.0085df70
lea eax, [ebp - 0x124]
push eax
call fcn.00985290
jmp 0x86d2e3
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret

Function at 0x86dba0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00a7ffb0
push 0x103
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov byte [ebp - 0x20c], 0
call fcn.00a7ffb0
add esp, 0x18
push 0xb55508
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x108], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x86dc36
lea eax, [ebp - 0x108]
inc eax
cmp byte [eax], 0
jne 0x86dc12
lea ecx, [ebp - 0x108]
sub eax, ecx
je 0x86dc36
cmp byte [ebp + eax - 0x109], 0x5c
je 0x86dc36
push 0xaa1564
mov edx, ecx
push edx
call esi
push str.eServ.ini
lea eax, [ebp - 0x108]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x108]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0xaa1543
push str.ClientLogDir
push str.General
call esi
cmp byte [ebp - 0x20c], 0
jne 0x86dc88
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0xaa1543
push str.FTPDownloadDir
push str.General
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ebp - 0x20c], al
pop esi
setne al
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret