joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e350
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0
call fcn.004075a0
lea eax, [esp + 8]
add esp, 4
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e380
sub eax, edx
jne 0x40e3a2
xor eax, eax
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e3a7
mov ecx, dword [str.NPNETLIB.DLL]
mov edx, dword [0x45c87c]
mov dword [eax], ecx
mov ecx, dword [0x45c880]
mov dword [eax + 4], edx
mov dx, word [0x45c884]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40e38b
push esi
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40e40b
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.INIIR
push esi
mov dword [0x470174], 0
call edi
push str.StopRDPPort
push esi
mov dword [0x470174], eax
mov dword [0x470178], 0
call edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
mov dword [0x470178], eax
xor ecx, esp
mov eax, 1
call fcn.0042eb15
add esp, 0x10c
ret

Function at 0x40e460
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
lea eax, [esp + 8]
xor ebx, ebx
push eax
mov byte [esp + 0xc], bl
call fcn.004075a0
lea eax, [esp + 0xc]
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e490
sub eax, edx
jne 0x40e4b3
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret
lea eax, [esp + 8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x40e4b8
mov ecx, dword [str.APC_API.DLL]
mov edx, dword [0x45c8d0]
mov dword [eax], ecx
mov ecx, dword [0x45c8d4]
mov dword [eax + 4], edx
mov dl, byte [0x45c8d8]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40e49b
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x40e51d
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddtoSuspeciousLog
push esi
mov dword [0x47017c], ebx
call edi
push str.IsNPExpired
push esi
mov dword [0x47017c], eax
mov dword [0x470180], ebx
call edi
push str.IsFileGood
push esi
mov dword [0x470180], eax
mov dword [0x470184], ebx
call edi
push str.AddToImageFileExecution
push esi
mov dword [0x470184], eax
mov dword [0x470188], ebx
call edi
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
mov dword [0x470188], eax
xor ecx, esp
mov eax, 1
call fcn.0042eb15
add esp, 0x10c
ret
Function at 0x40e6b0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x160
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x15c], eax
push 0x104
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x64]
push ecx
call fcn.004075a0
lea eax, [esp + 0x68]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e6f0
sub eax, edx
je 0x40e7e1
lea edx, [esp + 0x58]
push edx
call fcn.004303aa
lea eax, [esp + 0x5c]
push str.ZVSCAN
push eax
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x40e722
mov byte [eax], 0
lea eax, [esp + 0x58]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e727
mov ecx, dword [str._td.exe]
mov edx, dword [0x45c908]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40e7e1
lea eax, [esp + 0x58]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e758
mov ecx, dword [str._crypt]
mov dx, word [0x45c900]
mov dword [eax], ecx
mov cl, byte [0x45c902]
mov word [eax + 4], dx
push 0x44
lea edx, [esp + 0x18]
push 0
push edx
mov byte [eax + 6], cl
call fcn.0042eb30
add esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e7e1
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.0042eb15
add esp, 0x160
ret
Function at 0x40e840
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x32c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x328], eax
push esi
push edi
push 0x220
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0x23d]
push 0
push ecx
mov byte [esp + 0x244], 0
call fcn.0042eb30
add esp, 0x18
call fcn.004077c0
mov edi, dword [esp + 0x338]
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x40e946
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e92a
push 0x104
lea edx, [esp + 0x230]
push edx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameA
push str.Path_Process
call fcn.004073f0
lea eax, [esp + 0x230]
push eax
call fcn.004073f0
lea ecx, [esp + 0x234]
push 0x470190
push ecx
call fcn.0040a580
push 0x470190
call fcn.004073f0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.End_Process
call fcn.004073f0
add esp, 4
jmp 0x40e9ac
pop edi
mov eax, 0x45b5a5
pop esi
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.0042eb15
add esp, 0x32c
ret
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x40e97d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.0042eb15
add esp, 0x32c
ret
lea eax, [esp + 0x128]
push eax
push 0x104
push 0x470190
call fcn.004308a5
push 0x470190
call fcn.004073f0
add esp, 0x10
test esi, esi
je 0x40e9ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x330]
pop edi
pop esi
xor ecx, esp
mov eax, 0x470190
call fcn.0042eb15
add esp, 0x32c
ret
Function at 0x40e9d0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x40eb2b
mov eax, dword [esp + 0x3c]
push esi
push 0x2c
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40ea21
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x24]
push edx
push 0
push esi
call edi
test eax, eax
je 0x40eb1d
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40eb1d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x40eabb
lea esp, [esp]
mov eax, 0xcccccccd
mul dword [esp + 0x34]
shr edx, 3
cmp edx, 0x3e8
jae 0x40ea7b
mov edx, 0x3e8
jmp 0x40ea88
cmp edx, 0x2710
jbe 0x40ea88
mov edx, 0x2710
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
call edi
test eax, eax
je 0x40eb19
cmp dword [esp + 0x20], 1
je 0x40eb19
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x7530
ja 0x40eb19
cmp dword [esp + 0x20], 3
je 0x40ea60
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.0040a9a0
add esp, 8
lea eax, [esp + 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40eb19
cmp dword [esp + 0x20], 1
je 0x40eb19
mov ecx, dword [esp + 0x34]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push 0x24
lea eax, [esp + 0x24]
push eax
push 0
push esi
call edi
test eax, eax
je 0x40eb19
cmp dword [esp + 0x20], 1
je 0x40eb19
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x7530
ja 0x40eb19
cmp dword [esp + 0x20], 1
jne 0x40eae2
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x40ec20
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Persist via run registry key

Disassembly:
sub esp, 0x508
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x504], eax
mov eax, dword [esp + 0x50c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [esp + 0x10], eax
xor esi, esi
jmp 0x40ec60
push 0x400
lea ecx, [esp + 0x118]
push 0
push ecx
call fcn.0042eb30
add esp, 0xc
cmp esi, 4
ja case.default.0x40ec80
jmp dword [esi*4 + 0x40ee14]
lea edx, [esp + 0x114]
push edx
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call fcn.0040b6d0
add esp, 0x10
jmp case.default.0x40ec80
lea eax, [esp + 0x114]
push eax
push str.Common_Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040b6d0
add esp, 0x10
jmp case.default.0x40ec80
lea ecx, [esp + 0x114]
push ecx
push str.AppData
jmp 0x40ec94
push 0x104
lea edx, [esp + 0x118]
push edx
call ebx
jmp case.default.0x40ec80
mov eax, dword [str.C:WindowsSysnative]
mov ecx, dword [0x45c970]
mov edx, dword [0x45c974]
mov dword [esp + 0x114], eax
mov eax, dword [0x45c978]
mov dword [esp + 0x118], ecx
mov ecx, dword [0x45c97c]
mov dword [esp + 0x11c], edx
mov dl, byte [0x45c980]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov byte [esp + 0x128], dl
lea eax, [esp + 0x114]
push eax
call ebp
test eax, eax
je 0x40edf0
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov eax, edx
push str._s_s
push eax
call fcn.0042ecc6
add esp, 0x10
lea ecx, [esp + 0x114]
push ecx
call ebp
test eax, eax
je 0x40edf0
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40edf0
push 0xff
push eax
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1d]
push eax
call fcn.0042eb30
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x24]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0x18
push 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x11c]
push ecx
call edi
test eax, eax
jne 0x40edf0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x118]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x40edf0
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
inc esi
cmp esi, 5
jl 0x40ec60
mov ecx, dword [esp + 0x514]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042eb15
add esp, 0x508
ret
Function at 0x40f1eb
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4MYSQLD.NPAV4.26042018
push str.NPAV4MYSQLD.NPAV4.26042018
push 0x45caa0
push str.MYSQLD.EXE
call fcn.00407310
push 0x103
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.0042eb30
push str.WORM.MYSQLD.NPAV4.26042018
push str.MYSQLD.EXE
call fcn.0040a000
mov ebx, dword [0x46f734]
add esp, 0x34
test ebx, ebx
je 0x40f25e
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x10]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x40f200
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.MYSQLD.NPAV4.26042018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebx
add esp, 0x1e0
cmp dword [0x470160], 0
jne 0x40f2fd
push 0x104
push 0
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.MYSQLD.NPAV4.26042018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
mov eax, dword [str.MYSQLD.EXE]
mov ecx, dword [0x45ca98]
mov dx, word [0x45ca9c]
mov dword [0x46f978], eax
mov al, byte [0x45ca9e]
add esp, 0x18
cmp dword [0x470144], 0
mov dword [0x46f97c], ecx
mov word [0x46f980], dx
mov byte [0x46f982], al
je 0x40f2fd
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042eb15
add esp, 0x10c
ret
Function at 0x40f320
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call ebx
push 0xf003f
push 0
push 0
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x46f5d0], eax
test eax, eax
je 0x40f461
push 0x2c
push 0x467270
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x469cc0], eax
test eax, eax
jne 0x40f374
mov eax, dword [0x46f5d0]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
pop ebx
add esp, 0x28
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0xc]
push ecx
push 0x24
lea edx, [esp + 0x18]
push edx
push 0
push eax
call esi
test eax, eax
je 0x40f449
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x40f460
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x40f3ea
lea ecx, [ecx]
mov eax, dword [esp + 0x2c]
push eax
call edi
mov eax, dword [0x469cc0]
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x1c]
push edx
push 0
push eax
call esi
test eax, eax
je 0x40f448
cmp dword [esp + 0x18], 1
je 0x40f448
call ebx
sub eax, ebp
cmp eax, 0x3e8
ja 0x40f448
cmp dword [esp + 0x18], 3
je 0x40f3b0
call fcn.0040cb20
mov edx, dword [0x469cc0]
lea ecx, [esp + 0x14]
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40f448
cmp dword [esp + 0x18], 1
je 0x40f448
mov edi, edi
push 0x64
call edi
mov edx, dword [0x469cc0]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
call esi
test eax, eax
je 0x40f448
cmp dword [esp + 0x18], 1
je 0x40f448
call ebx
sub eax, ebp
cmp eax, 0x3e8
ja 0x40f448
cmp dword [esp + 0x18], 1
jne 0x40f410
pop edi
mov eax, dword [0x469cc0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x46f5d0]
push ecx
call esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x41e5b0
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x28
xor eax, eax
push esi
push eax
push 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41e647
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x41e63c
push edi
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
call fcn.004108f0
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x41e601
pop edi
test esi, esi
je 0x41e647
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x41f480
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x45a098
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x468004]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], eax
call fcn.00404080
lea eax, [esp + 0x38]
push eax
mov ecx, 0x470380
mov dword [esp + 0x60], ebp
call fcn.00406370
test eax, eax
je 0x41f651
mov ecx, dword [esp + 0x4c]
mov esi, dword [ecx]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x4c]
cmp edi, ebp
je 0x41f4f3
cmp edi, dword [esp + 0x38]
je 0x41f4f8
call fcn.0042e62f
cmp esi, ebx
je 0x41f642
xor eax, eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
cmp edi, ebp
jne 0x41f5ec
call fcn.0042e62f
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f527
call fcn.0042e62f
mov edx, dword [esi + 8]
mov dword [esp + 0x2c], edx
cmp edi, ebp
jne 0x41f5f3
call fcn.0042e62f
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f547
call fcn.0042e62f
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push 0x41e650
push ebp
push ebp
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, ebp
je 0x41f587
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebp
jne 0x41f5fa
call fcn.0042e62f
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f59c
call fcn.0042e62f
inc dword [esi + 0x14]
cmp edi, ebp
jne 0x41f5fe
call fcn.0042e62f
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f5b4
call fcn.0042e62f
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esi + 0x10]
cmp ecx, 0xea60
jbe 0x41f5cb
mov dword [esp + 0x14], 1
cmp ebx, ebp
je 0x41f602
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 0x103
je 0x41f602
mov dword [esp + 0x14], 1
jmp 0x41f608
mov eax, dword [edi]
jmp 0x41f51d
mov eax, dword [edi]
jmp 0x41f53d
mov eax, dword [edi]
jmp 0x41f592
mov eax, dword [edi]
jmp 0x41f5aa
cmp dword [esp + 0x14], ebp
je 0x41f622
push esi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
call fcn.004033a0
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x41f4e5
cmp edi, ebp
jne 0x41f63e
call fcn.0042e62f
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f637
call fcn.0042e62f
mov esi, dword [esi]
jmp 0x41f4e5
mov eax, dword [edi]
jmp 0x41f62d
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0x470380
call fcn.004063e0
lea ecx, [esp + 0x38]
call fcn.004029d0
mov edx, dword [esp + 0x38]
push edx
call fcn.0042e1b9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x428f50
Capabilities:
Delete file

Disassembly:
sub esp, 0x2c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push str.c:zvinfo_v.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
push 0x45c434
push ecx
call fcn.0042ecc6
mov edx, dword [esp + 0x44]
xor eax, eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
push 0x45c434
push eax
call fcn.0042ecc6
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x18
push str.c:zvinfo_v.ini
lea ecx, [esp + 8]
push ecx
push 0x45ed98
push str.info
call esi
push str.c:zvinfo_v.ini
lea edx, [esp + 0x1c]
push edx
push 0x45ed8c
push str.info
call esi
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.0042eb15
add esp, 0x2c
ret

Function at 0x42eb15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x468004]
jne 0x42eb1f
repz ret
jmp fcn.004382dc

Function at 0x442011
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x442042
call fcn.00431503
mov dword [eax], esi
call fcn.004314f0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0042e609
add esp, 0x14
push 0x16
pop eax
jmp 0x442097
test dword [ebp + 0xc], 0xfffffff9
jne 0x44201e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44206f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00431516
pop ecx
call fcn.004314f0
mov eax, dword [eax]
jmp 0x442097
test al, 0x10
jne 0x442095
test al, 1
je 0x442095
test byte [ebp + 0xc], 2
je 0x442095
call fcn.00431503
mov dword [eax], 5
call fcn.004314f0
mov dword [eax], 0xd
jmp 0x442066
xor eax, eax
pop esi
pop ebp
ret
Function at 0x451ffc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00437c18
and dword [ebp - 4], 0
cmp dword [0x4711a0], 0
mov ebx, eax
jne 0x4520ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45215e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45215e
push eax
call fcn.00437ba6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4711a0], eax
call esi
push eax
call fcn.00437ba6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4711a4], eax
call esi
push eax
call fcn.00437ba6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4711a8], eax
call esi
push eax
call fcn.00437ba6
pop ecx
mov dword [0x4711b0], eax
test eax, eax
je 0x4520ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00437ba6
pop ecx
mov dword [0x4711ac], eax
mov eax, dword [0x4711ac]
cmp eax, ebx
je 0x452105
cmp dword [0x4711b0], ebx
je 0x452105
push eax
call fcn.00437c21
push dword [0x4711b0]
mov esi, eax
call fcn.00437c21
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x452105
test edi, edi
je 0x452105
call esi
test eax, eax
je 0x4520fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4520fc
test byte [ebp - 0xc], 1
jne 0x452105
or dword [ebp + 0x10], 0x200000
jmp 0x45213e
mov eax, dword [0x4711a4]
cmp eax, ebx
je 0x45213e
push eax
call fcn.00437c21
pop ecx
test eax, eax
je 0x45213e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45213e
mov eax, dword [0x4711a8]
cmp eax, ebx
je 0x45213e
push eax
call fcn.00437c21
pop ecx
test eax, eax
je 0x45213e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4711a0]
call fcn.00437c21
pop ecx
test eax, eax
je 0x45215e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x452160
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret