joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408810
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x53c
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push esi
mov esi, dword [esp + 0x548]
push edi
mov edi, dword [esp + 0x548]
push 0x2ee0
push esi
push eax
push 0x52c
push ecx
push edi
call fcn.00408c70
add esp, 0x18
test al, al
jne 0x408851
pop edi
pop esi
add esp, 0x53c
ret
lea edx, [esp + 0x18]
push edx
call fcn.00407f20
add esp, 4
test eax, eax
jne 0x40886d
pop edi
xor al, al
pop esi
add esp, 0x53c
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40888d
pop edi
xor al, al
pop esi
add esp, 0x53c
ret
mov ecx, dword [esp + 8]
lea eax, [esp + 0x23c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4088af
pop edi
xor al, al
pop esi
add esp, 0x53c
ret
push 0x2ee0
lea eax, [esp + 0x10]
push esi
xor edx, edx
push eax
lea ecx, [esp + 0x1c]
push 8
mov dword [esp + 0x20], edx
push ecx
push edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], 1
call fcn.00408be0
add esp, 0x18
test al, al
jne 0x4088e9
pop edi
pop esi
add esp, 0x53c
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
add esp, 0x53c
ret

Function at 0x408930
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [esp + 8]
push 1
push 0
push 0
push 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
je 0x408950
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret

Function at 0x408a00
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x24
mov eax, dword [0x433028]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
xor eax, eax
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], eax
push edi
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], edx
push eax
push ebx
lea edx, [esp + 0x20]
push 1
push edx
mov dword [esp + 0x48], eax
push ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x64], eax
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x408a72
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x24
ret
cmp eax, 0xffffffff
jne 0x408ae0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x408ae0
mov eax, dword [esp + 0x4c]
push 0
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
cmp edi, 0xffffffff
je 0x408ae0
test edi, edi
je 0x408ad5
lea edx, [esp + 0x48]
lea eax, [esp + 0x20]
push edx
push 0
push ebx
push eax
push ebp
mov dword [esp + 0x5c], 0
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x24
ret
push 0xf5555555
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x24
ret
Function at 0x408af0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x24
mov eax, dword [0x433028]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov edx, dword [esp + 0x30]
xor eax, eax
push ebx
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0x20], eax
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x4c]
push ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], eax
push edx
push ebx
lea eax, [esp + 0x20]
push 1
push eax
push ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x4c], esi
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x408b66
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x24
ret
cmp eax, 0xffffffff
jne 0x408bd4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x408bd4
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x20]
push 0
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
cmp edi, 0xffffffff
je 0x408bd4
test edi, edi
je 0x408bc9
lea eax, [esp + 0x48]
lea ecx, [esp + 0x20]
push eax
push 0
push ebx
push ecx
push ebp
mov dword [esp + 0x5c], 0
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x24
ret
push 0xf5555555
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x24
ret
Function at 0x40ce80
Capabilities:
Delete file

Disassembly:
mov eax, 0x1310
call fcn.00411df0
push ebx
mov ebx, dword [esp + 0x131c]
push ebp
mov ebp, dword [esp + 0x131c]
push esi
push edi
push 0x2ee0
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x20]
push 0x208
push ecx
push ebp
call fcn.00408c70
add esp, 0x18
test al, al
je 0x40d027
cmp dword [esp + 0x10], 0x208
jne 0x40d027
lea edx, [esp + 0x21c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x21c]
push 0x5c
push eax
call fcn.00412dc0
mov byte [eax + 1], 0
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x224]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x224]
and ecx, 3
push 0x42e524
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00412549
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40d027
mov eax, dword [esp + 0x214]
xor esi, esi
test eax, eax
jbe 0x40cffd
mov ecx, eax
push 0x2ee0
sub ecx, esi
lea edx, [esp + 0x14]
cmp ecx, 0x1000
push ebx
push edx
jbe 0x40cfbb
lea eax, [esp + 0x32c]
push 0x1000
push eax
push ebp
call fcn.00408c70
add esp, 0x18
test al, al
push edi
je 0x40d055
push 0x1000
lea ecx, [esp + 0x328]
push 1
push ecx
call fcn.0041200f
add esp, 0x10
cmp eax, 0x1000
jne 0x40d013
add esi, eax
mov eax, dword [esp + 0x214]
cmp esi, eax
jae 0x40cffd
jmp 0x40cf58
sub eax, esi
push eax
lea eax, [esp + 0x330]
push eax
push ebp
call fcn.00408c70
add esp, 0x18
test al, al
push edi
je 0x40d034
mov ecx, dword [esp + 0x218]
lea edx, [esp + 0x324]
sub ecx, esi
push ecx
push 1
push edx
call fcn.0041200f
mov ecx, dword [esp + 0x224]
add esp, 0x10
sub ecx, esi
cmp eax, ecx
jne 0x40d054
push edi
call fcn.0041249b
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1310
ret
push edi
call fcn.0041249b
add esp, 4
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1310
ret
call fcn.0041249b
add esp, 4
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1310
ret
push edi
call fcn.0041249b
add esp, 4
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1310
ret
Function at 0x40dc60
Capabilities:
Check mutex on windows
Create thread
Terminate thread

Disassembly:
sub esp, 0x12c
push str.Globalwlg_ctrl
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40dc8a
xor eax, eax
add esp, 0x12c
ret 0x10
push 0x432bb8
push 0x432bbc
call fcn.00410720
add esp, 8
call fcn.004105f0
push 0
call fcn.00425893
test eax, eax
jne 0x40dcb5
add esp, 0x12c
ret 0x10
push str.CrashRpt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40dcdb
push str.Install
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40dcdb
push 2
call eax
add esp, 4
mov ecx, 0x432b80
call fcn.0040fd50
test eax, eax
jne 0x40dcf2
add esp, 0x12c
ret 0x10
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x432b84]
lea edx, [esp + 0x38]
push 0x104
push edx
push 0
mov dword [ecx + reloc.KERNEL32.dll_DeleteFileA], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x38]
push 0x5c
push eax
call fcn.00412dc0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [eax + 1], 0
push ecx
mov ecx, 0x432bd0
call fcn.0041f0bf
mov ecx, 0x432bd0
call fcn.0041f3fd
call fcn.00401c00
push 0x432b00
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40e390
push 0
push 0
mov dword [0x433028], eax
call esi
push 0
push 0
push 0
push 0x40e0e0
push 0
push 0
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.0040ea40
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 0xff
push 0xa
push 0
push 0x433028
push 1
call ebp
test eax, eax
je 0x40de0a
cmp eax, 1
jne 0x40ddba
push eax
push 0
push 0
lea edx, [esp + 0x28]
push 0
push edx
call esi
test eax, eax
je 0x40ddba
lea eax, [esp + 0x1c]
push eax
call edi
lea ecx, [esp + 0x1c]
push ecx
call ebx
push 1
push 0
push 0
lea edx, [esp + 0x28]
push 0
push edx
call esi
test eax, eax
jne 0x40dde7
jmp 0x40ddba
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push edi
call esi
push 0xffffffffffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call edi
push 0
mov ebx, dword [esp + 0x18]
push ebx
call esi
push 0xffffffffffffffff
push ebx
call edi
push 0x432b00
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x12c
ret 0x10
Function at 0x40e110
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4265c8
push eax
mov eax, dword [0x432b84]
mov dword fs:[0], esp
sub esp, 0x10
add eax, 0x5d7
push esi
push edi
push eax
call fcn.00401a00
add esp, 4
test eax, eax
je 0x40e373
mov eax, dword [0x432b84]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [eax + 0x5ee], 1
jne 0x40e2f0
cmp byte [eax + 0x5ef], 1
jne 0x40e179
call esi
sub eax, dword [0x432be4]
cmp eax, 0x1d4c0
ja 0x40e373
mov ecx, dword [0x432b84]
mov al, byte [ecx + 0x13ea2]
test al, al
je 0x40e276
call esi
mov edx, dword [0x432b84]
mov edi, eax
mov eax, dword [0x432be8]
xor ecx, ecx
mov cl, byte [edx + 0x13ea2]
sub edi, eax
mov eax, 0x3c
cdq
idiv ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cmp edi, eax
jbe 0x40e276
call esi
lea ecx, [esp + 8]
mov dword [0x432be8], eax
call fcn.00401000
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0
call fcn.00401090
test eax, eax
je 0x40e265
push 1
push str.STEP
push str.CAPSRC
push str.Server.ini
call fcn.004102b0
mov ecx, dword [0x432b84]
add esp, 0x10
mov al, byte [ecx + 0x5e9]
cmp al, 0x14
jb 0x40e217
and eax, 0xff
jmp 0x40e21c
mov eax, 0x14
mov cl, byte [ecx + 0x13ea1]
push ecx
push eax
call fcn.00401cd0
mov edx, dword [0x432b84]
add esp, 8
mov al, byte [edx + 0x13ea1]
test al, al
jne 0x40e265
call esi
lea ecx, [esp + 8]
mov dword [0x432be0], eax
mov dword [esp + 0x20], 0xffffffff
call fcn.00401070
pop edi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00401070
mov eax, dword [0x432bf0]
test eax, eax
jle 0x40e2f0
call esi
sub eax, dword [0x432bec]
cmp eax, 0x2710
jbe 0x40e2f0
call esi
push 2
push str.STEP
push str.CAPSRC
push str.Server.ini
mov dword [0x432bec], eax
call fcn.004102b0
mov eax, dword [0x432b84]
add esp, 0x10
mov al, byte [eax + 0x5e9]
cmp al, 0x14
jb 0x40e2c4
and eax, 0xff
jmp 0x40e2c9
mov eax, 0x14
push 0
push eax
call fcn.00401cd0
mov eax, dword [0x432bf0]
add esp, 8
dec eax
pop edi
mov dword [0x432bf0], eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [0x432b84]
mov eax, dword [ecx + 0x5ea]
test eax, eax
je 0x40e373
call esi
mov edi, dword [0x432b84]
mov ecx, eax
mov eax, dword [0x432be0]
sub ecx, eax
mov eax, 0xe10
cdq
idiv dword [edi + 0x5ea]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
cmp ecx, edx
jb 0x40e373
call esi
push 3
push str.STEP
push str.CAPSRC
push str.Server.ini
mov dword [0x432be0], eax
call fcn.004102b0
mov eax, dword [0x432b84]
add esp, 0x10
mov al, byte [eax + 0x5e9]
cmp al, 0x14
jb 0x40e363
and eax, 0xff
jmp 0x40e368
mov eax, 0x14
push 0
push eax
call fcn.00401cd0
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40e820
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4265eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 1
push eax
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x3c], ecx
call fcn.00408930
add esp, 8
test al, al
je 0x40ea0c
call fcn.00401c80
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00402b00
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push 0x2382
push eax
push edx
mov dword [esp + 0xc4], 0
call fcn.00408960
add esp, 0x14
lea ecx, [esp + 0x20]
test al, al
sete bl
mov dword [esp + 0xb0], 0xffffffff
call fcn.0041ef82
test bl, bl
je 0x40e8b9
mov eax, dword [esp + 0x10]
push eax
jmp 0x40ea04
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004089a0
add esp, 4
test al, al
jne 0x40e8d4
mov edx, dword [esp + 0x10]
push edx
jmp 0x40ea04
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ebp, eax
test ebp, ebp
jne 0x40e8ea
mov eax, dword [esp + 0x10]
push eax
jmp 0x40ea04
mov edx, dword [esp + 0x10]
mov ecx, dword [0x433028]
push 8
push ebp
push edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x40e924
mov eax, dword [esp + 0x10]
push eax
call fcn.004089e0
add esp, 4
push ebp
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
jmp 0x40ea0c
mov ecx, dword [0x432c04]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push 0
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x40e9f8
test eax, eax
je 0x40e9f8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x7c]
push eax
push ebp
push ecx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
je 0x40ea28
cmp dword [esp + 0x7c], 8
jne 0x40e9dc
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x2c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAAccept]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e9dc
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], ebx
push ecx
push 0
push 0x40e810
call fcn.00412f07
add esp, 0xc
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push 0
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
jne 0x40e94d
push ebp
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004089e0
add esp, 4
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
push ebp
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov eax, dword [esp + 0x10]
push eax
jmp 0x40ea04
Function at 0x40ea40
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 1
push 0
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x432c04], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push 0
push 0x40e800
call fcn.00412f07
add esp, 0xc
cmp eax, 0xffffffff
pop esi
jne 0x40ea82
mov eax, dword [0x432c04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
mov ecx, dword [0x432c04]
push 0xea60
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40eaa8
mov edx, dword [0x432c04]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
mov eax, dword [0x432c04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
Function at 0x40fa20
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4266ab
push eax
mov eax, 0x2d5e4
mov dword fs:[0], esp
call fcn.00411df0
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.00412dc0
mov byte [eax + 1], 0
mov edi, str.spy9.map
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40fb59
mov ecx, ebp
call fcn.0040fd90
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
lea edx, [esp + 0x1c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
call fcn.004219f4
push 0
lea ecx, [esp + 0x20]
push 0x1001
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2d604], 0
call fcn.00421b06
test eax, eax
je 0x40fb3e
mov ecx, 0xb534
xor eax, eax
lea edi, [esp + 0x120]
lea edx, [esp + 0x120]
rep stosd dword es:[edi], eax
push 0x2d4d0
push edx
lea ecx, [esp + 0x14]
call fcn.00421c5d
lea ecx, [esp + 0xc]
call fcn.00421d21
mov ecx, ebp
call fcn.0040fdb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2d5f8], 0xffffffff
call fcn.00421a49
mov ecx, dword [esp + 0x2d5f0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2d5f0
ret
Function at 0x40fe30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4266e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x120], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00412dc0
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
mov byte [eax + 1], 0
push edx
call fcn.0041eff0
mov eax, dword [0x42f3b0]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push ecx
push edx
lea eax, [esp + 0x10]
push str.__CMD_s__PARAM_s__
push eax
mov byte [esp + 0x12c], 3
call fcn.0041e3cc
add esp, 0x10
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push str.wlgdev.exe
push ecx
push edx
call fcn.0041f1cb
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [eax]
push 0
push ecx
push edx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call fcn.0041ef82
lea ecx, [esp + 8]
mov byte [esp + 0x11c], 2
call fcn.0041ef82
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 1
call fcn.0041ef82
lea ecx, [esp + 0x124]
mov byte [esp + 0x11c], 0
call fcn.0041ef82
lea ecx, [esp + 0x128]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0041ef82
mov ecx, dword [esp + 0x114]
pop edi
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x40ff70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.00412dc0
mov byte [eax + 1], 0
mov edi, str.server.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x118]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x11c]
push eax
mov eax, dword [esp + 0x118]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x4100e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x426708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
push 0x432af0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x6c], 1
push eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call fcn.00411964
add esp, 8
lea edx, [esp + 0x74]
test eax, eax
sete cl
push edx
lea eax, [esp + 0xc]
and ecx, 0xff
push 0x42ecbc
push eax
mov esi, ecx
call fcn.0041f23f
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x6c], 2
call fcn.0041f06f
lea ecx, [esp + 8]
mov byte [esp + 0x68], 1
call fcn.0041ef82
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x1c]
neg esi
sbb esi, esi
mov eax, dword [esp + 0x70]
not esi
and esi, ecx
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4101b2
mov eax, dword [esp + 0x78]
dec eax
je 0x41025e
dec eax
je 0x410203
dec eax
je 0x4101e4
lea ecx, [esp + 0x70]
mov byte [esp + 0x68], 0
call fcn.0041ef82
lea ecx, [esp + 0x74]
mov dword [esp + 0x68], 0xffffffff
call fcn.0041ef82
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x70]
mov byte [esp + 0x68], 0
call fcn.0041ef82
mov dword [esp + 0x68], 0xffffffff
jmp 0x410287
mov ecx, dword [esp + 0xc]
or edi, 0xffffffff
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x41022a
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x78]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x410258
lea ecx, [esp + 0x70]
mov byte [esp + 0x68], 0
call fcn.0041ef82
lea ecx, [esp + 0x74]
mov dword [esp + 0x68], edi
call fcn.0041ef82
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
mov esi, dword [esp + 0x78]
jmp 0x410275
mov ecx, dword [esp + 0xc]
or edi, 0xffffffff
push edi
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, edi
je 0x41022a
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x70]
mov byte [esp + 0x68], 0
call fcn.0041ef82
mov dword [esp + 0x68], edi
lea ecx, [esp + 0x74]
call fcn.0041ef82
mov ecx, dword [esp + 0x60]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x64
ret