joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d646
mov eax, dword fs:[0]
push eax
sub esp, 0xa88
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa88], ecx
push 0
call fcn.0042fd20
add esp, 4
mov ecx, dword [ebp - 0xa88]
call fcn.00404790
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
cmp eax, 0x804
je 0x40457e
mov dword [0x4774e0], 0
mov dword [ebp - 0xa74], 0x94
lea ecx, [ebp - 0xa74]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40457e
cmp dword [ebp - 0xa64], 2
jne 0x404573
cmp dword [ebp - 0xa70], 6
jb 0x404573
cmp dword [ebp - 0xa6c], 0
jb 0x404573
push 0x404
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
jmp 0x40457e
push 0x404
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push str.xoxCtrl
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404653
push 0x47a5ac
push 0x47a5e8
lea edx, [ebp - 0xa7c]
push edx
call fcn.004047a0
add esp, 0xc
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xa90]
call fcn.004015f0
push eax
lea ecx, [ebp - 0xa80]
push ecx
call fcn.00420da0
add esp, 8
mov dword [ebp - 0xa94], eax
mov ecx, dword [ebp - 0xa94]
call fcn.004015f0
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa78], eax
lea ecx, [ebp - 0xa80]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.004013c0
cmp dword [ebp - 0xa78], 0
je 0x40463f
push 1
mov edx, dword [ebp - 0xa78]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xa78]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x404722
push 0x104
push 0x47a0f8
mov ecx, dword [ebp - 0xa88]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
je 0x4046a1
mov eax, dword [ebp - 0x9d8]
movsx ecx, byte [eax + 0x47a0f7]
cmp ecx, 0x5c
jne 0x404690
jmp 0x4046a1
mov edx, dword [ebp - 0x9d8]
sub edx, 1
mov dword [ebp - 0x9d8], edx
jmp 0x404673
cmp dword [ebp - 0x9d8], 0
jne 0x4046b3
mov byte [0x47a0f8], 0
jmp 0x4046c0
mov eax, dword [ebp - 0x9d8]
mov byte [eax + 0x47a0f8], 0
mov ecx, dword [ebp - 0xa88]
mov edx, dword [ecx + 0x44]
mov dword [0x47a200], edx
push 0
lea ecx, [ebp - 0x9d4]
call fcn.00404b20
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xa88]
lea ecx, [ebp - 0x9d4]
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x9d4]
call fcn.00425f3c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa84], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d4]
call fcn.004050e0
mov eax, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x405700
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x101
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x405745
jmp 0x405777
movzx eax, word [ebp - 0x198]
and eax, 0xff
movzx ecx, al
cmp ecx, 1
jne 0x405771
movzx edx, word [ebp - 0x198]
shr edx, 8
and edx, 0xff
movzx eax, dl
cmp eax, 1
je 0x405777
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x411ce0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e5c7
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
push 0x479
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.004026e0
test eax, eax
jne 0x411d39
push 1
push 0x479
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47b
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47c
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47d
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
lea ecx, [ebp - 0x38]
call fcn.00402a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
add ecx, 0x140
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x38]
call fcn.00401970
push eax
push 0
push 0x463fa8
push 0x463fb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x38]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b0b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x40], 0
jmp 0x411dfc
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 8
jge 0x411e44
push 2
mov edx, dword [ebp - 0x40]
shl edx, 1
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b280
mov byte [ebp - 4], 2
push 0x10
push 0
lea ecx, [ebp - 0x5c]
call fcn.0041b220
push eax
call fcn.004439a2
add esp, 0xc
mov ecx, dword [ebp - 0x40]
mov byte [ebp + ecx - 0x18], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.0041b130
jmp 0x411df3
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x60]
call fcn.00409e10
mov ecx, dword [ebp - 0x60]
call fcn.0040eed0
mov ecx, dword [ebp - 0x60]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x463fc0
push 0x463fc4
push 0x463fd4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0041b130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x411eb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e604
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
push 0x47b
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.004026e0
test eax, eax
jne 0x411f09
push 1
push 0x47b
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x479
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47c
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47d
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
lea ecx, [ebp - 0x38]
call fcn.00402a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
add ecx, 0x144
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x38]
call fcn.00401970
push eax
push 0
push 0x463fdc
push 0x463fec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x38]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b0b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x40], 0
jmp 0x411fcc
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 8
jge 0x412014
push 2
mov edx, dword [ebp - 0x40]
shl edx, 1
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b280
mov byte [ebp - 4], 2
push 0x10
push 0
lea ecx, [ebp - 0x5c]
call fcn.0041b220
push eax
call fcn.004439a2
add esp, 0xc
mov ecx, dword [ebp - 0x40]
mov byte [ebp + ecx - 0x18], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.0041b130
jmp 0x411fc3
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x60]
call fcn.00409e10
mov ecx, dword [ebp - 0x60]
call fcn.0040eed0
mov ecx, dword [ebp - 0x60]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x463ff4
push 0x463ff8
push 0x464008
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0041b130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x412080
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e641
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
push 0x47c
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.004026e0
test eax, eax
jne 0x4120d9
push 1
push 0x47c
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x479
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47b
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47d
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
lea ecx, [ebp - 0x3c]
call fcn.00402a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
add ecx, 0x148
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x3c]
call fcn.00401970
push eax
push 0
push 0x464010
push 0x464020
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x3c]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b0b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x38], 0xa
mov dword [ebp - 0x40], 0
jmp 0x41219c
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 8
jge 0x4121e4
push 2
mov edx, dword [ebp - 0x40]
shl edx, 1
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b280
mov byte [ebp - 4], 2
push 0x10
push 0
lea ecx, [ebp - 0x5c]
call fcn.0041b220
push eax
call fcn.004439a2
add esp, 0xc
mov ecx, dword [ebp - 0x40]
mov byte [ebp + ecx - 0x18], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.0041b130
jmp 0x412193
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x60]
call fcn.00409e10
mov ecx, dword [ebp - 0x60]
call fcn.0040eed0
mov ecx, dword [ebp - 0x60]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x464028
push 0x46402c
push 0x46403c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0041b130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x412250
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e67e
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
push 0x47d
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.004026e0
test eax, eax
jne 0x4122a9
push 1
push 0x47d
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x479
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47b
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
push 0
push 0x47c
mov ecx, dword [ebp - 0x60]
call fcn.0042bf4c
mov ecx, eax
call fcn.00419aa0
lea ecx, [ebp - 0x3c]
call fcn.00402a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
add ecx, 0x14c
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x3c]
call fcn.00401970
push eax
push 0
push 0x464044
push 0x464054
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x3c]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b0b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x38], 0xa
mov dword [ebp - 0x40], 0
jmp 0x41236c
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 8
jge 0x4123b4
push 2
mov edx, dword [ebp - 0x40]
shl edx, 1
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041b280
mov byte [ebp - 4], 2
push 0x10
push 0
lea ecx, [ebp - 0x5c]
call fcn.0041b220
push eax
call fcn.004439a2
add esp, 0xc
mov ecx, dword [ebp - 0x40]
mov byte [ebp + ecx - 0x18], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.0041b130
jmp 0x412363
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x60]
call fcn.00409e10
mov ecx, dword [ebp - 0x60]
call fcn.0040eed0
mov ecx, dword [ebp - 0x60]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x46405c
push 0x464060
push 0x464070
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0041b130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x413db0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e956
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x38]
call fcn.00402a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4c]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x38]
call fcn.00401970
push eax
push 0
push str.date
push 0x4641ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x38]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b0b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.004015f0
push eax
call fcn.0044338b
add esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cdq
push edx
push eax
lea ecx, [ebp - 0x44]
call fcn.00419fc0
lea eax, [ebp - 0x34]
push eax
call fcn.0041a000
lea ecx, [ebp - 0x34]
call fcn.0041a020
mov esi, eax
lea ecx, [ebp - 0x44]
call fcn.0041a020
cmp esi, eax
jne 0x413eb0
lea ecx, [ebp - 0x34]
call fcn.0041a0d0
mov esi, eax
lea ecx, [ebp - 0x44]
call fcn.0041a0d0
cmp esi, eax
jne 0x413eb0
lea ecx, [ebp - 0x34]
call fcn.0041a110
mov esi, eax
lea ecx, [ebp - 0x44]
call fcn.0041a110
cmp esi, eax
jne 0x413eb0
mov ecx, dword [ebp - 0x4c]
mov dword [ecx + 0x70c], 1
jmp 0x413ebd
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0x70c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x70c], 0
je 0x413f3b
lea ecx, [ebp - 0x48]
call fcn.00402a90
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
add ecx, 0x13c
call fcn.004015f0
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x48]
call fcn.00401970
push eax
push 0
push str.productID
push 0x464200
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x48]
call fcn.0041b030
lea ecx, [ebp - 0x48]
call fcn.0041b010
movzx ecx, al
test ecx, ecx
je 0x413f2f
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0x70c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041b130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret
Function at 0x416540
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], 2
cmp dword [ebp + 8], 0
je 0x416780
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x644
call fcn.004015f0
push eax
push 0x4643ac
push 0x4643b4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x658
call fcn.004015f0
push eax
push 0x4643b8
push 0x4643c0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x64c
call fcn.004015f0
push eax
push 0x4643c4
push 0x4643cc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x65c
call fcn.004015f0
push eax
push 0x4643d0
push 0x4643dc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x660
call fcn.004015f0
push eax
push 0x4643e0
push 0x4643e8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x664
call fcn.004015f0
push eax
push 0x4643ec
push 0x4643f4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x668
call fcn.004015f0
push eax
push 0x4643f8
push 0x464404
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x66c
call fcn.004015f0
push eax
push 0x464408
push 0x464410
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x670
call fcn.004015f0
push eax
push 0x464414
push 0x464418
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x674
call fcn.004015f0
push eax
push 0x46441c
push 0x464424
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x654
call fcn.004015f0
push eax
push 0x464428
push 0x464434
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 0x13c
call fcn.004015f0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x650
call fcn.004015f0
push eax
push 0x464438
push 0x464440
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esp, ebp
pop ebp
ret 4
Function at 0x4172c0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2120
call fcn.00444050
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x1008], eax
mov dword [ebp - 0x2120], ecx
lea eax, [ebp - 0x1118]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x417301
jmp 0x4173bb
mov dword [ebp - 0x211c], 0
jmp 0x41731c
mov edx, dword [ebp - 0x211c]
add edx, 1
mov dword [ebp - 0x211c], edx
mov eax, dword [ebp - 0x1118]
shr eax, 2
cmp dword [ebp - 0x211c], eax
jge 0x4173bb
mov ecx, dword [ebp - 0x211c]
mov edx, dword [ebp + ecx*4 - 0x1000]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1004], eax
lea eax, [ebp - 0x1114]
push eax
push 0x1000
lea ecx, [ebp - 0x2118]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_EnumProcessModules
push 0x104
lea eax, [ebp - 0x1110]
push eax
mov ecx, dword [ebp - 0x2118]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExA
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1110]
push ecx
call fcn.00419e90
add esp, 8
test eax, eax
je 0x4173b6
push 0
mov edx, dword [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41730d
mov ecx, dword [ebp - 0x1008]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret 4

Function at 0x4173d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2120
call fcn.00444050
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x1008], eax
mov dword [ebp - 0x2120], ecx
lea eax, [ebp - 0x1118]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x417413
xor eax, eax
jmp 0x4174d0
mov dword [ebp - 0x211c], 0
jmp 0x41742e
mov edx, dword [ebp - 0x211c]
add edx, 1
mov dword [ebp - 0x211c], edx
mov eax, dword [ebp - 0x1118]
shr eax, 2
cmp dword [ebp - 0x211c], eax
jge 0x4174cd
mov ecx, dword [ebp - 0x211c]
mov edx, dword [ebp + ecx*4 - 0x1000]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1004], eax
lea eax, [ebp - 0x1114]
push eax
push 0x1000
lea ecx, [ebp - 0x2118]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_EnumProcessModules
push 0x104
lea eax, [ebp - 0x1110]
push eax
mov ecx, dword [ebp - 0x2118]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExA
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1110]
push ecx
call fcn.00419e90
add esp, 8
test eax, eax
je 0x4174c8
mov edx, dword [ebp - 0x211c]
mov eax, dword [ebp + edx*4 - 0x1000]
jmp 0x4174d0
jmp 0x41741f
or eax, 0xffffffff
mov ecx, dword [ebp - 0x1008]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret 4
Function at 0x417570
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ee71
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x478a70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], ecx
push 0x464714
mov ecx, dword [ebp - 0x70]
call fcn.004173d0
cmp eax, 0xffffffff
je 0x417603
mov eax, dword [ebp - 0x70]
movzx ecx, byte [eax + 0x9b4]
test ecx, ecx
je 0x4175c9
mov edx, dword [ebp - 0x70]
mov byte [edx + 0x9b4], 0
jmp 0x417748
push 0x464724
push 0
call fcn.0041a660
mov ecx, dword [ebp - 0x70]
mov dword [ecx + 0x9b0], eax
push 9
mov edx, dword [ebp - 0x70]
mov ecx, dword [edx + 0x9b0]
call fcn.0042c15c
push 5
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0x9b0]
call fcn.0042c15c
jmp 0x417748
mov dword [ebp - 0x10], 0
push 0x4632c6
lea ecx, [ebp - 0x14]
call fcn.00401340
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x70]
add ecx, 0x138
push ecx
lea ecx, [ebp - 0x14]
call fcn.004013e0
push 0x5c
mov ecx, dword [ebp - 0x70]
add ecx, 0x138
call fcn.004014c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x138
call fcn.0041acc0
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x78]
push edx
lea ecx, [ebp - 0x14]
call fcn.004013e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.004013c0
push str.liveprofessorliveprofessor.exe
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0041ad40
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x80]
push eax
lea ecx, [ebp - 0x14]
call fcn.004013e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.004013c0
mov dword [ebp - 0x64], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.00442f90
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x64]
push edx
call fcn.00442f90
add esp, 0xc
mov eax, dword [ebp - 0x70]
add eax, 0x998
push eax
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afd0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x70]
cmp dword [edx + 0x998], 0
jne 0x417729
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004013c0
jmp 0x417748
cmp dword [ebp - 0x18], 0
je 0x417739
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x9b4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret