joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3100
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416aa0]
call fcn.00405290
xor eax, eax
push ebp
push 0x4a3244
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b7c5c], 0
jne 0x4a3153
mov ecx, dword [0x4b7fd0]
mov dl, 1
mov eax, dword [0x407d40]
call fcn.0040ca44
call fcn.004042a0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403320
mov eax, ebx
call fcn.00405160
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a3254
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406248
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405170
test eax, eax
jle 0x4a31eb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a31e4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404b80
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404b68
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408bec
test eax, eax
jne 0x4a31e4
mov ebx, 0x15
jmp 0x4a31f0
mov ebx, 0x10
jmp 0x4a31f0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b7c5c]
call fcn.004a3058
mov eax, dword [ebp - 8]
call fcn.004a3058
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406260
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a324b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040490c
lea eax, [ebp - 0x10]
mov edx, dword [0x416aa0]
call fcn.00405360
ret

Function at 0x4b07c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0936
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x434e40]
call fcn.00434fac
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b08a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00435088
xor ecx, ecx
mov edx, 0x4b094c
mov eax, dword [ebp - 0x10]
call fcn.004351cc
test al, al
je 0x4b088a
push 0x104
lea eax, [ebp - 0x119]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x119]
call fcn.00409ae0
mov eax, dword [ebp - 0xc]
call fcn.00404bb8
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4b0864
lea eax, [ebp - 0xc]
mov edx, 0x4b0984
call fcn.00404bc0
lea eax, [ebp - 0x120]
mov ecx, 0x4b0990
mov edx, dword [ebp - 0xc]
call fcn.00404c04
mov eax, dword [ebp - 0x120]
call fcn.00409500
test al, al
je 0x4b088a
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b08a7
mov eax, dword [ebp - 0x10]
call fcn.00403ad4
ret
Function at 0x4b1e00
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403320
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4b2e98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b2f66
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x14]
mov eax, dword [0x4b8314]
mov eax, dword [eax]
call fcn.00460ab0
mov eax, dword [ebp - 0x14]
call fcn.00404db8
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4b2f50
push 2
push 0
push 0xfffffffffffffff6
push esi
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xf]
xor ecx, ecx
mov edx, 0xb
call fcn.00403320
push 0
lea eax, [ebp - 4]
push eax
push 0xa
lea eax, [ebp - 0xf]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
mov edx, 0x4b2f78
lea eax, [ebp - 0xf]
call fcn.004099d0
test eax, eax
jne 0x4b2f4a
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4ba938
push esi
call sub.kernel32.dll_ReadFile_1
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2f6d
lea eax, [ebp - 0x14]
call fcn.004048e8
ret
Function at 0x4010b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x412e66
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x644], eax
push esi
mov eax, dword [0x418310]
xor eax, esp
push eax
lea eax, [esp + 0x650]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x128]
push 0
push eax
call fcn.00408200
add esp, 0xc
push 0x104
lea ecx, [esp + 0x440]
push 0
push ecx
call fcn.00408200
add esp, 0xc
push 0x104
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00408200
add esp, 0xc
push 0x104
lea eax, [esp + 0x548]
push 0
push eax
call fcn.00408200
add esp, 0xc
push 0x104
lea ecx, [esp + 0x338]
push 0
push ecx
call fcn.00408200
add esp, 0xc
push 0x104
lea edx, [esp + 0x128]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push str.AcSpi64.dll
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x54c]
push edx
call esi
push str.AcSpi32.dll
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x33c]
push ecx
call esi
push 0x104
lea edx, [esp + 0x230]
push 0
push edx
call fcn.00408200
add esp, 0xc
push 0x104
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.AcSpi64.dll
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x444]
push edx
call esi
push str.AcSpi32.dll
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x24]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401c90
mov esi, eax
mov dword [esp + 0x658], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x338]
call fcn.00401c90
push eax
mov ecx, esi
mov byte [esp + 0x65c], 1
call fcn.00405ae0
mov byte [esp + 0x65c], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40126b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x658], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401296
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4012b9
push str.Copy_To_system32_failed.
call fcn.00406b4c
add esp, 4
mov eax, 3
jmp 0x401316
push str.AdClean_LSP_Filter
call fcn.00401000
add esp, 4
test eax, eax
jbe 0x4012db
push str.Has_Installed.
call fcn.00406b4c
add esp, 4
xor eax, eax
jmp 0x401316
push str.MSAFD_Tcpip__TCP_IP_
call fcn.00401000
add esp, 4
push str.MSAFD_Tcpip__UDP_IP_
mov dword [esp + 0x18], eax
call fcn.00401000
add esp, 4
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x444]
call fcn.00402810
add esp, 8
mov ecx, dword [esp + 0x650]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x644]
xor ecx, esp
call fcn.00406b3d
add esp, 0x654
ret
Function at 0x402770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402787
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4027b8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4027b4
cmp esi, eax
jae 0x4027b8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4027a4
cmp esi, eax
jb 0x4027be
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x402810
Capabilities:
Check os version

Disassembly:
sub esp, 0x564
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x55c], eax
mov eax, dword [esp + 0x56c]
push ebx
push ebp
mov ebp, dword [esp + 0x570]
push esi
push edi
push 0x118
mov esi, ecx
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], str.AdClean_LSP_Filter
mov dword [esp + 0x34], 0
call fcn.00408200
xor edx, edx
add esp, 0xc
cmp edx, str.AdClean_LSP_Filter
jne 0x402872
mov dword [esp + 0x10], str.AdClean_LSP
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402877
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
sub eax, edx
lea ecx, [esp + 0x35c]
push ecx
inc eax
push eax
push esi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4028c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.InstallLsp:_MultiByteToWidechar_failed_to_convert__s:_Error___d_n
call fcn.004073bb
add eax, 0x40
push eax
call fcn.0040729f
add esp, 0x10
mov eax, edi
jmp 0x4029ca
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4028d0
push 0x104
sub eax, edx
lea edx, [esp + 0x14c]
push edx
inc eax
push eax
push ebp
push 0
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x402918
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.InstallLsp:_MultiByteToWidechar_failed_to_convert__s:_Error___d_n
call fcn.004073bb
add eax, 0x40
push eax
call fcn.0040729f
add esp, 0x10
jmp 0x4029c8
mov ebx, dword [esp + 0x10]
push ebx
push str.LSP_name_is__S_n
call fcn.00406b4c
mov ecx, dword [0x419030]
mov eax, dword [0x41902c]
mov edx, dword [0x419034]
mov dword [esp + 0x24], ecx
add esp, 8
mov dword [esp + 0x18], eax
mov eax, dword [0x419038]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x2c], 6
jb 0x402987
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x150]
push ecx
push ebx
call fcn.00403830
add esp, 0x10
jmp 0x4029ca
mov ebp, dword [esp + 0x14]
mov edx, dword [ebp]
push ebx
push edx
call fcn.00402b00
mov edi, eax
add esp, 8
test edi, edi
jne 0x4029e3
push str.InstallLsp:_CreateDummyEntry_failed__n
call fcn.004073bb
add eax, 0x40
push eax
call fcn.0040729f
add esp, 8
test edi, edi
je 0x4029c8
mov ecx, dword [0x419c74]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov ecx, dword [esp + 0x56c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406b3d
add esp, 0x564
ret
lea eax, [esp + 0x148]
push eax
mov ecx, 1
mov edx, edi
lea eax, [esp + 0x1c]
call fcn.00402a40
mov esi, eax
add esp, 4
test esi, esi
je 0x402a0b
push str.InstallLsp:_Unable_to_install_the_dummy_LSP_entry__n
jmp 0x4029a3
mov eax, edi
call fcn.004057d0
push ebp
push ebx
lea ecx, [esp + 0x150]
lea edx, [esp + 0x20]
call fcn.00402c10
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x4029c8
lea ecx, [esp + 0x18]
call fcn.00403a40
jmp 0x4029c8
Function at 0x4053e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x214
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x105
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x405472
lea ecx, [esp + 0x10c]
call fcn.004056b0
test eax, eax
jge 0x405448
push eax
push str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
call fcn.004073bb
add eax, 0x40
push eax
call fcn.0040729f
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00406b3d
add esp, 0x214
ret
push 0x105
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x405472
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
jmp 0x40541f
lea eax, [esp + 4]
call fcn.00405600
test eax, eax
jge 0x405487
push eax
push str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
jmp 0x40541f
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4054d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 8]
push ecx
push str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
call fcn.004073bb
add eax, 0x40
push eax
call fcn.0040729f
add esp, 0x10
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00406b3d
add esp, 0x214
ret
push str.WSCUpdateProvider
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x214]
mov dword [0x419c6c], eax
mov eax, esi
pop esi
xor ecx, esp
call fcn.00406b3d
add esp, 0x214
ret
Function at 0x4057f0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x120c
call fcn.00412780
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x1208], eax
push esi
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...AcReport.exe
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [esp + 0x1250]
mov esi, 8
cmp dword [esp + 0x1264], esi
jae 0x405847
lea ecx, [esp + 0x1250]
mov eax, dword [esp + 0x1218]
cmp dword [esp + 0x122c], esi
jae 0x40585e
lea eax, [esp + 0x1218]
push ebx
push ecx
push eax
push str.http:__bd.miqidu.com
push str._s_html_main_lsp.html_a_sr_s
mov ecx, 0x800
lea ebx, [esp + 0x220]
call fcn.004039e0
add esp, 0x10
push 5
push 0
mov edx, ebx
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
cmp dword [esp + 0x122c], esi
jb 0x4058af
mov ecx, dword [esp + 0x1218]
push ecx
call fcn.00406b32
add esp, 4
xor edx, edx
mov dword [esp + 0x122c], 7
mov dword [esp + 0x1228], 0
mov word [esp + 0x1218], dx
cmp dword [esp + 0x1248], esi
jb 0x4058e8
mov eax, dword [esp + 0x1234]
push eax
call fcn.00406b32
add esp, 4
xor ecx, ecx
mov dword [esp + 0x1248], 7
mov dword [esp + 0x1244], 0
mov word [esp + 0x1234], cx
cmp dword [esp + 0x1264], esi
jb 0x405921
mov edx, dword [esp + 0x1250]
push edx
call fcn.00406b32
add esp, 4
xor eax, eax
cmp dword [esp + 0x1280], esi
mov dword [esp + 0x1264], 7
mov dword [esp + 0x1260], 0
mov word [esp + 0x1250], ax
pop esi
jb 0x40595b
mov ecx, dword [esp + 0x1268]
push ecx
call fcn.00406b32
add esp, 4
mov ecx, dword [esp + 0x1208]
xor ecx, esp
call fcn.00406b3d
add esp, 0x120c
ret

Function at 0x405a70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...conf_setting.ini
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
push 0
push str.UninstallLsp
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov dword [esi], eax
call fcn.00406b3d
add esp, 0x20c
ret
Function at 0x405ae0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x412db8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x418310]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x41904c]
mov edx, dword [eax + 0xc]
mov ecx, 0x41904c
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test ebx, ebx
je 0x405b8e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esi]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi]
push eax
push str._s.bak
lea edi, [esp + 0x1c]
call fcn.00405cb0
mov edi, dword [esp + 0x1c]
mov eax, dword [esi]
add esp, 8
push 1
push edi
push eax
call ebp
test eax, eax
jne 0x405b8e
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x405bf1
mov eax, dword [esi]
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x405bb1
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405bbd
test ebx, ebx
je 0x405bbd
mov esi, dword [esi]
push 1
push esi
push edi
call ebp
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405bd9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405bd9
push 4
push eax
push edi
call ebp
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405bfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x405c20
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405c90
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.00408200
mov edx, dword [esi]
push edx
push str._s_bak
lea eax, [esp + 0x18]
push 0x103
push eax
call fcn.004076ab
mov edx, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x1c
push 1
lea ecx, [esp + 8]
push ecx
push edx
call esi
push 4
push 0
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.00406b3d
add esp, 0x20c
ret

Function at 0x406b3d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418310]
jne 0x406b47
repz ret
jmp fcn.0040846c
Function at 0x411b5c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409ee2
and dword [ebp - 4], 0
cmp dword [0x419b84], 0
mov ebx, eax
jne 0x411c0d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411cbe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x411cbe
push eax
call fcn.00409e70
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419b84], eax
call esi
push eax
call fcn.00409e70
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419b88], eax
call esi
push eax
call fcn.00409e70
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419b8c], eax
call esi
push eax
call fcn.00409e70
pop ecx
mov dword [0x419b94], eax
test eax, eax
je 0x411c0d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409e70
pop ecx
mov dword [0x419b90], eax
mov eax, dword [0x419b90]
cmp eax, ebx
je 0x411c65
cmp dword [0x419b94], ebx
je 0x411c65
push eax
call fcn.00409eeb
push dword [0x419b94]
mov esi, eax
call fcn.00409eeb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411c65
test edi, edi
je 0x411c65
call esi
test eax, eax
je 0x411c5c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411c5c
test byte [ebp - 0xc], 1
jne 0x411c65
or dword [ebp + 0x10], 0x200000
jmp 0x411c9e
mov eax, dword [0x419b88]
cmp eax, ebx
je 0x411c9e
push eax
call fcn.00409eeb
pop ecx
test eax, eax
je 0x411c9e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411c9e
mov eax, dword [0x419b8c]
cmp eax, ebx
je 0x411c9e
push eax
call fcn.00409eeb
pop ecx
test eax, eax
je 0x411c9e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419b84]
call fcn.00409eeb
pop ecx
test eax, eax
je 0x411cbe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411cc0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e9610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4ef4cc]
cmp dword [eax + 0x28], 0
jne 0x4e9628
xor eax, eax
jmp 0x4e9757
mov ecx, dword [0x4ef43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x4ef430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x4ef42c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x4ef430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x4ef42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x4ef4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x4ed680
push 0x4ed6d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x4ef428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004e9550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4e95e0
mov edx, dword [0x4ef4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4ef434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4e9757
cmp dword [ebp - 0x38], 0x12
jne 0x4e974b
mov dword [0x4ef444], 0
call fcn.004e9760
xor eax, eax
jmp 0x4e9757
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4e971c
mov esp, ebp
pop ebp
ret 4

Function at 0x4eab30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]