joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403610
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x804
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push 0x3ff
xor esi, esi
lea eax, [esp + 0x40d]
push esi
push eax
mov byte [esp + 0x414], 0
call fcn.00409500
add esp, 0xc
lea ebx, [esp + 0x408]
call fcn.00403250
test eax, eax
je 0x4036f4
push 0x3ff
lea ecx, [esp + 0xd]
push esi
push ecx
mov byte [esp + 0x14], 0
call fcn.00409500
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x408]
mov byte [esp + eax + 8], cl
inc eax
test cl, cl
jne 0x403674
lea eax, [esp + 8]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403690
mov edx, dword [str.MultiProductC.ini]
mov ecx, dword [0x41805c]
mov dword [eax], edx
mov edx, dword [0x418060]
mov dword [eax + 4], ecx
mov ecx, dword [0x418064]
mov dword [eax + 8], edx
mov dx, word [0x418068]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
lea eax, [esp + 8]
push eax
push 1
push str.CopyMode
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop esi
pop ebx
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004075fb
add esp, 0x804
ret
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x804
ret

Function at 0x403710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x804
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push 0x3ff
xor esi, esi
lea eax, [esp + 0x40d]
push esi
push eax
mov byte [esp + 0x414], 0
call fcn.00409500
add esp, 0xc
lea ebx, [esp + 0x408]
call fcn.00403250
test eax, eax
je 0x4037fd
push 0x3ff
lea ecx, [esp + 0xd]
push esi
push ecx
mov byte [esp + 0x14], 0
call fcn.00409500
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x408]
mov byte [esp + eax + 8], cl
inc eax
test cl, cl
jne 0x403774
lea eax, [esp + 8]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403790
mov edx, dword [str.MultiProductVS.ini]
mov ecx, dword [0x418090]
mov dword [eax], edx
mov edx, dword [0x418094]
mov dword [eax + 4], ecx
mov ecx, dword [0x418098]
mov dword [eax + 8], edx
mov dx, word [0x41809c]
mov dword [eax + 0xc], ecx
mov cl, byte [0x41809e]
mov word [eax + 0x10], dx
lea edx, [esp + 8]
push edx
push 0
push str.state
push str.state
mov byte [eax + 0x12], cl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop esi
pop ebx
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004075fb
add esp, 0x804
ret
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x804
ret
Function at 0x403950
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov ebx, eax
mov esi, ecx
call fcn.00403510
call fcn.00403610
call fcn.00403710
mov edi, eax
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x4039b7
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4039a0
cmp dword [esp + 0x14], 0x103
je 0x403a36
mov edx, dword [esi + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xb0], 0
mov ecx, dword [esi + 0xb4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push esi
push 0x406580
push 0
push 0
mov dword [esi + 0xac], ebx
call fcn.004085cc
add esp, 0x18
mov dword [esi + 0xb0], eax
test ebx, ebx
je 0x403a6e
test eax, eax
je 0x4039fb
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00403710
mov edx, dword [ebp + 4]
mov esi, eax
xor eax, eax
mov dword [esp + 0x1c], eax
push edx
lea ebx, [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], esi
call fcn.004020a0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
test ebx, ebx
je 0x403a64
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 4]
push eax
lea ebx, [esp + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edi
call fcn.004020a0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x404180
Capabilities:
Access the windows event log
Send data
Send data on socket

Disassembly:
sub esp, 0x134
push ebx
push ebp
mov ebp, dword [esp + 0x140]
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
cmp esi, ebx
je 0x4041df
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov dword [esp + 0x3c], esi
call ebx
test eax, eax
jne 0x404231
mov eax, dword [esp + 0x154]
mov dword [eax], 1
push str.Elsevier.DaTong
push 0
mov dword [esp + 0x20], str.FtpSend_fail.
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0
push 1
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test esi, esi
je 0x404222
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
mov ecx, dword [esp + 0x14c]
mov edx, dword [esp + 0x150]
push 0
lea eax, [esp + 0x28]
push eax
mov eax, dword [edi]
push 0
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x48], edx
push 1
lea edx, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x404283
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x4041df
push 0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
push ecx
push 2
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], esi
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov edx, dword [esp + 0x40]
push 0
push edx
call ebx
test eax, eax
jne 0x4042cc
mov eax, dword [esp + 0x154]
mov dword [eax], 1
mov ecx, dword [edi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
jmp 0x4041df
lea edx, [esp + 0x1c]
push edx
mov edx, dword [edi]
push 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x4042f5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4041df
mov dword [esp + 0x14], 1
jmp 0x404217
Function at 0x404310
Capabilities:
Access the windows event log
Connect socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor eax, eax
push edi
push 0xa
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
push 0x14
lea eax, [esp + 0x20]
push eax
push ecx
mov edi, edx
mov byte [esp + 0x28], 0
call fcn.00407bcf
mov eax, dword [esi]
add esp, 0x10
xor ebp, ebp
cmp eax, 0xffffffff
je 0x404370
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
lea edx, [esp + 0x18]
push edx
mov eax, edi
call fcn.00407130
mov edi, eax
add esp, 4
test edi, edi
jne 0x4043bf
push str.Elsevier.DaTong
push eax
mov dword [esp + 0x1c], str.Resolve_remote_address_failed_to_return_any_addresses_
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push edi
push 1
push edi
push edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ebx, dword [esp + 0x14]
jmp 0x4044a7
call fcn.004071d0
mov ebx, eax
test ebx, ebx
jne 0x404400
push str.Elsevier.DaTong
push eax
mov dword [esp + 0x1c], str.Resolve_local_address_failed_to_return_any_addresses_
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push 1
push ebx
push ebx
push ebx
mov esi, eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40448f
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x404430
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.create_socket_failed
mov ecx, eax
call fcn.00401e00
add esp, 4
jmp 0x40448f
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x18]
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40445b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.bind_failed
mov ecx, eax
call fcn.00401e00
add esp, 4
jmp 0x40448f
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40448a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.FtpConn_fail.
mov ecx, eax
call fcn.00401e00
add esp, 4
xor ebp, ebp
jmp 0x40448f
mov ebp, 1
mov eax, dword [0x41bc54]
test eax, eax
jne 0x4044a4
push 2
call fcn.00401a10
mov dword [0x41bc54], eax
push edi
call eax
test ebx, ebx
je 0x4044c3
mov eax, dword [0x41bc54]
test eax, eax
jne 0x4044c0
push 2
call fcn.00401a10
mov dword [0x41bc54], eax
push ebx
call eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x20
ret
Function at 0x4044e0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x454
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push ebp
mov ebp, dword [esp + 0x460]
push edi
xor edi, edi
push 0x400
lea eax, [esp + 0x55]
push edi
push eax
mov ebx, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov byte [esp + 0x5c], 0
call fcn.00409500
add esp, 0xc
push 0x31
lea ecx, [esp + 0x21]
push edi
push ecx
mov byte [esp + 0x28], 0
call fcn.00409500
mov eax, dword [esi]
add esp, 0xc
mov dword [esp + 0xc], edi
cmp eax, 0xffffffff
je 0x404553
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
push str.PASV__r_n
mov ecx, 0x400
lea edi, [esp + 0x54]
call fcn.00401bb0
mov eax, edi
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404570
sub eax, edx
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x58]
push eax
push ebp
mov eax, ebx
call fcn.00404180
add esp, 0x10
test eax, eax
je 0x4046cf
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x60]
push eax
push ebx
push ebp
call fcn.00403ee0
mov ebp, eax
add esp, 0x1c
test ebp, ebp
je 0x4046cd
mov ecx, dword [esp + 0x10]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jne 0x4046cd
lea edx, [esp + 0x1c]
push edx
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x54]
call fcn.00403dc0
mov ecx, dword [esp + 0x10]
add esp, 4
push 0xa
push 0x401
lea eax, [esp + 0x58]
push eax
push ecx
call fcn.00407bcf
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x30]
call fcn.00407130
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4046cd
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x404695
call fcn.004071d0
mov ebx, eax
test ebx, ebx
je 0x404699
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x18]
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x404699
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x18]
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40468e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.FtpConn_fail.
mov ecx, eax
call fcn.00401e00
add esp, 4
xor ebp, ebp
jmp 0x404699
mov ebp, 1
jmp 0x404699
mov ebx, dword [esp + 0x18]
mov eax, dword [0x41bc54]
test eax, eax
jne 0x4046ae
push 2
call fcn.00401a10
mov dword [0x41bc54], eax
push edi
call eax
test ebx, ebx
je 0x4046cd
mov eax, dword [0x41bc54]
test eax, eax
jne 0x4046ca
push 2
call fcn.00401a10
mov dword [0x41bc54], eax
push ebx
call eax
mov eax, ebp
mov ecx, dword [esp + 0x45c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x454
ret
Function at 0x405170
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x804
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push 0x3ff
lea eax, [esp + 0x409]
push 0
push eax
mov byte [esp + 0x410], 0
call fcn.00409500
add esp, 0xc
lea ebx, [esp + 0x404]
call fcn.00403250
pop ebx
test eax, eax
je 0x40525c
push 0x3ff
lea ecx, [esp + 5]
push 0
push ecx
mov byte [esp + 0xc], 0
call fcn.00409500
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x400]
mov byte [esp + eax], cl
inc eax
test cl, cl
jne 0x4051d4
lea eax, [esp]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4051e7
mov edx, dword [str.MultiProductVS.ini]
mov ecx, dword [0x418090]
mov dword [eax], edx
mov edx, dword [0x418094]
mov dword [eax + 4], ecx
mov ecx, dword [0x418098]
mov dword [eax + 8], edx
mov dx, word [0x41809c]
mov dword [eax + 0xc], ecx
mov cl, byte [0x41809e]
mov word [eax + 0x10], dx
lea edx, [esp]
push edx
push 0x32
push esi
push str.1.0.0.000
push str.version
push str.version
mov byte [eax + 0x12], cl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004075fb
add esp, 0x804
ret
mov ecx, dword [esp + 0x800]
xor ecx, esp
xor eax, eax
call fcn.004075fb
add esp, 0x804
ret
Function at 0x405e00
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x298
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2a4]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x95]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov byte [esp + 0x9c], bl
call fcn.00409500
push edi
push ebp
push str._s_s
mov ecx, 0x104
lea edi, [esp + 0xa8]
call fcn.00401bb0
push 0x40
xor eax, eax
lea ecx, [esp + 0x68]
push ebx
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x6c], ebx
call fcn.00409500
push 0x104
lea edx, [esp + 0x1c1]
push ebx
push edx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x1c8], bl
call fcn.00409500
push 0x4184a0
push 0x4184a4
push esi
push str._s_s_s
mov ecx, 0x105
lea edi, [esp + 0x1d8]
call fcn.00401bb0
xor eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
add esp, 0x40
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x44], ax
lea edx, [esp + 0x28]
mov eax, 0x614
mov ecx, edi
push edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 3
mov word [esp + 0x3c], ax
mov dword [esp + 0x34], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x4c]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405f56
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov ecx, 4
cmp dword [esp + 0x14], ebx
je 0x405f66
mov ecx, 3
call fcn.00403820
mov ecx, dword [esp + 0x2a4]
pop edi
xor eax, eax
cmp dword [esp + 0x10], ebx
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x298
ret
Function at 0x405f90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x314
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x310], eax
mov eax, dword [esp + 0x318]
push ebx
push ebp
push esi
push 0x103
mov esi, ecx
xor ebp, ebp
lea ecx, [esp + 0x119]
push ebp
push ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x120], 0
call fcn.00409500
add esp, 0xc
lea ebx, [esp + 0x114]
call fcn.00403250
test eax, eax
je 0x40608f
push edi
xor ebx, ebx
push 0x103
lea edx, [esp + 0x221]
push ebx
push edx
mov byte [esp + 0x228], bl
call fcn.00409500
push 0x103
lea eax, [esp + 0x25]
push ebx
push eax
mov byte [esp + 0x2c], bl
call fcn.00409500
push str.WzExtract.INI
lea ecx, [esp + 0x134]
push ecx
push str._s_s
mov ecx, 0x104
lea edi, [esp + 0x240]
call fcn.00401bb0
add esp, 0x24
mov edx, edi
push edx
push 0x104
lea eax, [esp + 0x1c]
push eax
push str.ERROR_DIR
push esi
push str.Copy
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
push str.ERROR_DIR
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringA]
pop edi
cmp eax, 2
je 0x4060ac
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.00403410
test eax, eax
je 0x4060ac
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.004075fb
add esp, 0x314
ret
mov ecx, dword [esp + 0x31c]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004075fb
add esp, 0x314
ret
Function at 0x406170
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x415b9a
mov eax, dword fs:[0]
push eax
mov eax, 0x1210
call fcn.00413d90
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x120c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41a2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1224]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1234]
push 0x103
lea eax, [esp + 0x1d]
mov esi, ecx
push 0
push eax
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], 0
call fcn.00409500
add esp, 0xc
lea ebx, [esp + 0x18]
call fcn.00403250
test eax, eax
je 0x406327
push 0x103
lea ecx, [esp + 0x121]
push 0
push ecx
mov byte [esp + 0x128], 0
call fcn.00409500
push str.WzExtract.INI
mov edx, ebx
push edx
push str._s_s
mov ecx, 0x104
lea edi, [esp + 0x134]
call fcn.00401bb0
push 0xfff
lea eax, [esp + 0x23d]
push 0
push eax
mov byte [esp + 0x244], 0
call fcn.00409500
add esp, 0x24
mov ecx, edi
push ecx
push 0x1000
lea edx, [esp + 0x228]
push edx
push 0x417d20
push 0
push str.Copy
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x220], 0
lea ebx, [esp + 0x220]
je 0x406327
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jb 0x406292
lea eax, [edi + 1]
call fcn.00406ff0
test al, al
je 0x40634f
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea eax, [eax + edi*4]
mov dword [esp + 0x122c], 0
test eax, eax
je 0x4062ae
push eax
mov ecx, ebx
call fcn.004069e0
mov dword [esp + 0x122c], 0xffffffff
inc dword [esi + 4]
mov edi, dword [ebp + 4]
cmp edi, dword [ebp + 8]
jb 0x4062d6
lea eax, [edi + 1]
mov esi, ebp
call fcn.00406ff0
test al, al
je 0x40634f
mov esi, dword [esp + 0x14]
mov ecx, dword [ebp]
lea eax, [ecx + edi*4]
mov dword [esp + 0x122c], 1
test eax, eax
je 0x4062f6
push eax
mov ecx, 0x417d20
call fcn.004069e0
mov eax, ebx
mov dword [esp + 0x122c], 0xffffffff
inc dword [ebp + 4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406310
sub eax, edx
cmp byte [ebx + eax + 1], cl
lea ebx, [ebx + eax + 1]
jne 0x406276
mov ecx, dword [esp + 0x1224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004075fb
add esp, 0x121c
ret
push 0x8007000e
call fcn.00401c10
int3
Function at 0x406360
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x415bea
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41a2f0]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
mov eax, dword [esp + 0x184]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x180], 1
call fcn.00406170
xor edi, edi
add esp, 4
mov dword [esp + 0x14], edi
cmp dword [esp + 0x20], ebx
jbe 0x40650f
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
sub esi, ebp
mov dword [esp + 0x40], esi
jmp 0x406414
mov esi, dword [esp + 0x40]
cmp edi, dword [esp + 0x34]
jae 0x40651e
cmp edi, dword [esp + 0x20]
jae 0x40651e
add esi, ebp
push ebp
call fcn.004060d0
add esp, 4
test eax, eax
je 0x4064fd
push 0x104
lea edx, [esp + 0x69]
push ebx
push edx
mov byte [esp + 0x70], bl
call fcn.00409500
mov eax, dword [ebp]
mov ecx, dword [esp + 0x24]
push 0x4184a0
push eax
push ecx
push str._s_s_s
mov ecx, 0x105
lea edi, [esp + 0x80]
call fcn.00401bb0
mov edx, edi
push ebx
push edx
call fcn.0040874f
add esp, 0x24
test eax, eax
jne 0x4064f9
mov eax, dword [ebp]
mov ecx, dword [esp + 0x18]
push str..
push eax
push ecx
push str._s_s_s
mov ecx, 0x105
call fcn.00401bb0
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov word [esp + 0x70], ax
mov edx, 0x614
mov word [esp + 0x64], dx
mov eax, edi
add esp, 0x10
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], eax
mov ecx, dword [esi]
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x54], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x406528
cmp dword [esp + 0x56], ebx
jne 0x406528
mov edi, dword [esp + 0x14]
inc edi
add ebp, 4
mov dword [esp + 0x14], edi
cmp edi, dword [esp + 0x20]
jb 0x406410
mov esi, 1
lea ecx, [esi + 5]
call fcn.00403820
jmp 0x406536
push 0x80070057
call fcn.00401c10
mov ecx, 5
call fcn.00403820
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
call fcn.00406e60
lea ecx, [esp + 0x1c]
push ecx
call fcn.00406e60
mov eax, esi
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.004075fb
add esp, 0x16c
ret
Function at 0x4071d0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x114
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x110], eax
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00409500
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
push 0x41853c
lea eax, [esp + 8]
call fcn.00407130
mov ecx, dword [esp + 0x114]
add esp, 4
xor ecx, esp
call fcn.004075fb
add esp, 0x114
ret

Function at 0x4075fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a2f0]
jne 0x407605
repz ret
jmp fcn.004097e7

Function at 0x40874f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x408780
call fcn.00409e07
mov dword [eax], esi
call fcn.00409df4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00409d8c
add esp, 0x14
push 0x16
pop eax
jmp 0x4087d5
test dword [ebp + 0xc], 0xfffffff9
jne 0x40875c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4087ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409e1a
pop ecx
call fcn.00409df4
mov eax, dword [eax]
jmp 0x4087d5
test al, 0x10
jne 0x4087d3
test al, 1
je 0x4087d3
test byte [ebp + 0xc], 2
je 0x4087d3
call fcn.00409e07
mov dword [eax], 5
call fcn.00409df4
mov dword [eax], 0xd
jmp 0x4087a4
xor eax, eax
pop esi
pop ebp
ret