joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104e450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12b000]
push edi
jmp 0x104e46a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x104e471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104e460
mov eax, 1
add ebx, ebx
jne 0x104e483
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x104e494
jne 0x104e4b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104e4b3
dec eax
add ebx, ebx
jne 0x104e4a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x104e478
add ebx, ebx
jne 0x104e4af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x104e505
xor ecx, ecx
sub eax, 3
jb 0x104e4cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x104e53a
sar eax, 1
mov ebp, eax
jmp 0x104e4d6
add ebx, ebx
jne 0x104e4d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104e4a4
inc ecx
add ebx, ebx
jne 0x104e4e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104e4a4
add ebx, ebx
jne 0x104e4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x104e4e6
jne 0x104e502
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x104e4e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x104e524
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x104e516
jmp 0x104e466
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x104e524
add edi, ecx
jmp 0x104e466
pop esi
mov edi, esi
mov ecx, 0x6df4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x104e542
cmp byte [edi], 0x22
jne 0x104e542
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x104e547
lea edi, [esi + 0xc4b000]
mov eax, dword [edi]
or eax, eax
je 0x104e5bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc94b74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc94ca0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x104e574
mov ecx, edi
jns 0x104e5a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc94ca4]
or eax, eax
je 0x104e5b9
mov dword [ebx], eax
add ebx, 4
jmp 0x104e591
call dword [esi + 0xc94cb4]
mov ebp, dword [esi + 0xc94ca8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x104e5f3
sub esp, 0xffffff80
jmp 0x50af83
Function at 0x4013a9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a978d
call fcn.004a7a94
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
and dword [edi + 0xc], 0
and dword [ebp - 4], 0
lea ebx, [edi + 0x14]
mov esi, ebx
mov dword [edi], vtable.TiXmlAttribute.0
call fcn.00402830
lea esi, [edi + 0x30]
call fcn.00402830
push dword [ebp + 0xc]
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00402b1e
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00402b1e
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x4c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x405f58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405f6f
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405fa4
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x405fa0
cmp edi, eax
jae 0x405fa4
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x405f92
cmp edi, eax
jb 0x405fa8
xor eax, eax
jmp 0x405fb2
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4060fe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
je 0x4061a7
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 0xc]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x40613d
cmp dword [ebp - 8], 2
jne 0x4061a6
push esi
mov esi, dword [ebp + 0x10]
call fcn.00405e22
mov esi, dword [ebp - 4]
shr esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004771a9
push esi
push ebx
push eax
mov dword [ebp - 0xc], eax
call fcn.00479900
add esp, 0x10
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
push dword [eax]
call edi
test eax, eax
pop esi
jne 0x40619d
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.0040607d
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call fcn.0047a088
pop ecx
pop edi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret 0xc
Function at 0x406339
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4acafd
call fcn.004a7a94
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00405e62
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406384
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x406365
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x406365
lea ecx, [ebp - 0x10]
call fcn.004062e7
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4063bb
xor esi, esi
jmp 0x406368
push eax
call fcn.00406339
test eax, eax
pop ecx
je 0x4063b7
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x406365
call edi
cmp eax, ebx
jne 0x4063b7
jmp 0x406365

Function at 0x4087fd
Capabilities:
Create directory

Disassembly:
mov eax, 0x4a9e73
call fcn.004a7a94
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.004088fb
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.00408954
cmp eax, 0xffffffff
je 0x4088f4
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.00408927
cmp dword [eax + 0x18], 8
jb 0x408851
mov eax, dword [eax + 4]
jmp 0x408854
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.00406792
cmp edi, ebx
je 0x4088a9
cmp edi, 0x50
je 0x4088a9
cmp edi, 0xb7
je 0x4088a9
cmp edi, ebx
jle 0x40888b
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.00406792
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4088b5
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4088e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4088e5
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x40888b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x40888b
mov edi, 0x80070057
jmp 0x40888b
Function at 0x408bee
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x408c77
push ebx
call fcn.004771a9
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x408c68
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b948c
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x408c68
cmp dword [ebp - 0xc], ebx
je 0x408c68
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x408c77
push dword [ebp - 4]
call fcn.0047a088
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret

Function at 0x408d47
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a9e61
call fcn.004a7a94
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4daedc
mov dword [ebp - 0x10], edi
call fcn.00405ea5
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00479900
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0040607d
push esi
call fcn.00408cb3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x408ea2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x408efb
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x408fbe
mov eax, dword [ebp - 0x94]
dec eax
je 0x408faa
dec eax
jne 0x408fbe
mov eax, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x408f48
cmp esi, edx
jne 0x408f36
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x408fa6
cmp esi, edi
jne 0x408f80
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x408fa6
cmp eax, 5
jne 0x408f72
cmp dword [ebp - 0x9c], 2
jne 0x408f59
push eax
jmp 0x408f79
cmp dword [ebp - 0x9c], 1
jne 0x408f66
mov edi, ecx
jmp 0x408fbe
cmp dword [ebp - 0x9c], edi
jne 0x408fbe
push 3
jmp 0x408f79
cmp eax, 4
ja 0x408f7c
push 4
pop edi
jmp 0x408fbe
cmp eax, ecx
jb 0x408fbe
cmp esi, 2
jae 0x408f89
cmp eax, ecx
jbe 0x408f90
cmp byte [ebp + 0x76], dl
je 0x408fa1
cmp eax, ecx
jb 0x408f97
cmp esi, 2
jae 0x408f9b
cmp eax, ecx
jbe 0x408fbe
cmp byte [ebp + 0x76], 3
jne 0x408fbe
call fcn.00408dca
mov edi, eax
jmp 0x408fbe
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x409798
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00408405
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x409845
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x409844
lea eax, [edi + 1]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], edi
call fcn.00408444
mov esi, eax
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409844
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x409844
sub dword [ebp + 8], eax
add dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jne 0x4097f5
mov byte [esi + edi], bl
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
jne 0x40982f
xor eax, eax
jmp 0x409836
push eax
call fcn.00477930
pop ecx
mov edx, esi
call fcn.0040846a
mov dword [ebp - 0x10], 1
pop edi
cmp dword [ebp - 8], ebx
pop esi
pop ebx
je 0x409855
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x409fe3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a008
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a0c9
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 4], 0x490
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a078
lea eax, [ebp - 0x20c]
push 0x4b9678
push eax
call fcn.0047bba6
test eax, eax
pop ecx
pop ecx
je 0x40a06c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a042
jmp 0x40a081
mov edi, dword [ebp - 0x228]
and dword [ebp - 4], 0
jmp 0x40a081
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40a0a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a0c8
push dword [ebp + 8]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a0c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x40a1ae
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test esi, esi
jne 0x40a1c0
or eax, 0xffffffff
leave
ret
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a203
cmp dword [ebp - 0x110], 5
jne 0x40a203
cmp dword [ebp - 0x10c], 0
je 0x40a210
push esi
call fcn.0040a0cc
test eax, eax
pop ecx
jne 0x40a210
leave
ret
push esi
call fcn.00409fe3
pop ecx
leave
ret
Function at 0x40a219
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a2d9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40a27f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40a2d8
push edi
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 2
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a2cc
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40a2cc
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40a2c8
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [edi]
jb 0x40a2aa
jmp 0x40a2cc
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x40a2d7
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x40a2e8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 1]
leave
ret

Function at 0x40a2ed
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40a35b
push 0x110
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a355
cmp dword [ebp - 0x118], 6
jne 0x40a355
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a390
mov dword [esi], edi
xor eax, eax
jmp 0x40a390
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
push ebx
mov ebx, 0x490
jbe 0x40a387
lea edx, [ecx + 8]
cmp dword [edx], edi
je 0x40a37d
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x40a36e
jmp 0x40a387
imul eax, eax, 0xc
mov eax, dword [eax + ecx]
mov dword [esi], eax
xor ebx, ebx
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x40ad25
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0040ab4c
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040ac0f
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040acab
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
leave
ret

Function at 0x40aee3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x40af03
xor al, al
jmp 0x40af90
and word [esp + 0x28], 0
push 0x208
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.00479900
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40af28
mov esi, dword [esi + 4]
jmp 0x40af2b
add esi, 4
push esi
lea eax, [esp + 0x2c]
push 0x105
push eax
call fcn.0047c7f4
and dword [esp + 0x14], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x40aefc
test eax, eax
je 0x40af8d
cmp eax, 2
je 0x40af8d
cmp eax, 0x402
je 0x40af8d
xor eax, eax
jmp 0x40af90
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40db3f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x40dba3
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0040e08c
push dword [eax]
xor ebx, ebx
push ebx
push 0x4b9b90
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405bf2
cmp edi, ebx
je 0x40db92
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0040dc90
test eax, eax
je 0x40db92
cmp dword [ebp - 4], ebx
jne 0x40db9b
call fcn.0040e18f
test eax, eax
je 0x40db9e
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret
Function at 0x40dd33
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4aa8a1
call fcn.004a7a94
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x40dd5d
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x40de88
mov eax, dword [0x4daedc]
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0040e08c
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00405d23
push eax
push str.1.01.21.51.72.02.22.52.73.0
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bf2
cmp dword [ebp - 0x14], ebx
jne 0x40ddc0
xor eax, eax
jmp 0x40ddc9
push dword [ebp - 0x14]
call fcn.0047a638
pop ecx
lea edx, [ebp - 0x14]
call fcn.00405cea
mov esi, 0x4b9874
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e4a6
jmp 0x40de64
push eax
call fcn.0047d35c
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x40de00
xor ecx, ecx
jmp 0x40de08
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x40de28
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x40de28
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x40de45
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x40de34
call fcn.00477e4f
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.0042f761
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bf2
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e4a6
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x40ddeb
add eax, 0xfffffff0
call fcn.00405bf2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x40e051
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x40e087
push ebx
lea ebx, [ebp - 4]
call fcn.0040e08c
push dword [eax]
push 2
push 0x4b9ba0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405bf2
pop ebx
mov eax, dword [esi + 0x18]
leave
ret