joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c160
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 4]
push edi
push eax
call fcn.005824f0
test edi, edi
je 0x40c1bd
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40c1a6
push str.::IsWindow_m_hWnd_
push eax
push 0x4f3
push 0x6745b8
push 2
call fcn.005f3d20
add esp, 0x14
cmp eax, 1
jne 0x40c1a6
int3
mov edx, dword [esi + 0x10]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40c1eb
push str.::IsWindow_m_hWnd_
push eax
push 0x4f3
push 0x6745b8
push 2
call fcn.005f3d20
add esp, 0x14
cmp eax, 1
jne 0x40c1eb
int3
mov ecx, dword [esi + 0x10]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x410c40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641986
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x138], ebx
push 8
mov dword [ebp - 4], ebx
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x410e5e
mov dword [ebp - 0x138], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x138]
mov dword [ecx], eax
mov dword [ebp - 0x120], 0xf
mov dword [ebp - 0x124], ebx
mov byte [ebp - 0x134], bl
mov esi, eax
mov dword [ebp - 4], 1
call fcn.004c4b60
push 0x103
lea edx, [ebp - 0x117]
push ebx
push edx
mov byte [ebp - 0x118], bl
call fcn.005ff630
mov eax, dword [ebp - 0x134]
add esp, 0xc
cmp dword [ebp - 0x120], 0x10
jae 0x410cfc
lea eax, [ebp - 0x134]
push str.wifidayweb.exe
push eax
lea eax, [ebp - 0x118]
push 0x675f00
push eax
call fcn.005f1060
add esp, 0x10
push ebx
push str.TASKKILL__F__IM_wifidayweb.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x44
lea ecx, [ebp - 0x1a0]
push ebx
push ecx
call fcn.005ff630
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x148]
push edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push str.TASKKILL__F__IM_wifidayweb.exe
push ebx
mov dword [ebp - 0x1a0], 0x44
call edi
test eax, eax
je 0x410e30
mov ecx, dword [ebp - 0x148]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x148]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x144]
push eax
call esi
push 0x44
lea ecx, [ebp - 0x1a0]
push ebx
push ecx
call fcn.005ff630
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x120], 0x10
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1a0], 0x44
jae 0x410df8
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x148]
push edx
lea ecx, [ebp - 0x1a0]
push ecx
push eax
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea edx, [ebp - 0x118]
push edx
push ebx
call edi
test eax, eax
je 0x410e30
mov eax, dword [ebp - 0x148]
push eax
call esi
mov ecx, dword [ebp - 0x144]
push ecx
call esi
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], 0xffffffff
call fcn.00412410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x14c], ebx
call fcn.005f41f0
push 0x6a361c
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.006009e0
int3
Function at 0x4155b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643928
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
push str.CADStatementPage::_WriteCheckNum_dwCheckNum:__d_r_n
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], str.ADStatementPage.cpp
mov dword [ebp - 0x34], 0xb5
call fcn.0040ec50
xor ebx, ebx
mov dword [ebp - 0x30], ebx
push 8
mov dword [ebp - 4], ebx
call fcn.005f0fe0
add esp, 0xc
cmp eax, ebx
je 0x415707
mov dword [ebp - 0x30], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
mov dword [edx], ecx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov esi, ecx
mov dword [ebp - 4], 1
call fcn.004c4b60
push 0xd
push str.configAD.Dat
mov ecx, esi
call fcn.00412ae0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41565c
lea eax, [ebp - 0x2c]
push 0x67649c
push eax
call fcn.005f5530
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x41569e
push 2
push ebx
push esi
call fcn.005f6250
push esi
push 4
lea eax, [ebp + 8]
push 1
push eax
call fcn.005f5d70
push esi
push 4
lea ecx, [ebp + 0xc]
push 1
push ecx
call fcn.005f5d70
push esi
call fcn.005f64a0
add esp, 0x30
cmp dword [ebp - 0x18], 0x10
jb 0x4156b0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005f0cb0
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.0040ed70
mov eax, dword [ebp - 0x30]
push eax
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0040ed70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
call fcn.005f41f0
push 0x6a361c
lea edx, [ebp - 0x44]
push edx
mov dword [ebp - 0x44], vtable.std::bad_alloc.0
call fcn.006009e0
int3
Function at 0x415730
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6438e0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x48], ebx
push 8
mov dword [esp + 0x7c], ebx
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x415952
mov dword [esp + 0x48], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
mov dword [ecx], eax
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov esi, eax
mov dword [esp + 0x78], 1
call fcn.004c4b60
push 0xd
push str.configAD.Dat
mov ecx, esi
call fcn.00412ae0
cmp dword [esp + 0x60], 0x10
mov eax, dword [esp + 0x4c]
jae 0x4157d8
lea eax, [esp + 0x4c]
push 0x6764a0
push eax
call fcn.005f5530
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4158dd
push ebx
push ebx
push esi
call fcn.005f6250
push esi
call fcn.005f5030
add esp, 0x10
test eax, eax
jne 0x4158d4
add edi, 0x100
mov dword [esp + 0x1c], edi
push esi
push 4
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.005f5d00
push esi
push 4
lea eax, [esp + 0x38]
push 1
push eax
call fcn.005f5d00
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add esp, 0x20
lea edi, [esp + 0x24]
lea ebx, [esp + 0x2c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call fcn.004177e0
push 3
lea ecx, [esp + 0x1c]
call fcn.00564140
mov byte [esp + 0x78], 2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4158b3
cmp dword [eax + 4], 0
lea edi, [eax + 4]
je 0x41588e
mov eax, dword [edi]
lea ecx, [esp + 0x2c]
cmp eax, ecx
je 0x415889
cmp dword [eax + 4], 0
lea edi, [eax + 4]
jne 0x415876
cmp dword [edi], 0
jne 0x4158a5
push 0xb5
push 0x676220
push str.ITERATOR_LIST_CORRUPTED_
call fcn.00563e60
add esp, 0xc
mov edx, dword [esp + 0x30]
mov dword [edi], edx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call fcn.00564180
push esi
call fcn.005f5030
add esp, 4
test eax, eax
je 0x415813
xor ebx, ebx
push esi
call fcn.005f64a0
add esp, 4
cmp dword [esp + 0x60], 0x10
jb 0x4158f1
mov eax, dword [esp + 0x4c]
push eax
call fcn.005f0cb0
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
lea ecx, [esp + 0x48]
mov dword [esp + 0x78], 3
call fcn.0040ed70
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005f0cb0
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x78], 0xffffffff
call fcn.0040ed70
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], ebx
call fcn.005f41f0
push 0x6a361c
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], vtable.std::bad_alloc.0
call fcn.006009e0
int3
Function at 0x429cd0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [esi], 0xffffffff
mov eax, dword [ebp + 8]
je 0x429d3f
test eax, eax
je 0x429d3f
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x429d3f
mov ecx, 2
mov word [ebp - 0x18], cx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
xor eax, eax
push 0x50
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x18]
mov word [ebp - 0x16], ax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor ecx, ebp
or eax, 0xffffffff
call fcn.005f0da0
mov esp, ebp
pop ebp
ret

Function at 0x429d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi], 0xffffffff
jne 0x429d65
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [sym.imp.WS2_32.dll_recv]
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [ebp + 8]
push 0
mov eax, 0x401
sub eax, esi
push eax
mov eax, dword [edi]
lea edx, [esi + ecx]
push edx
push eax
call ebx
test eax, eax
js 0x429da5
je 0x429dc1
add esi, eax
cmp esi, 0x401
jb 0x429d70
lea eax, [esi - 0x401]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
call fcn.005f6940
push eax
push edi
push str.recv_error__code__d_msg__s
push 0x133
jmp 0x429ddb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
call fcn.005f6940
push eax
push edi
push str.recv_error__code__d_msg__s
push 0x13c
push str.BaseSock.cpp
push 0x6c5bd8
mov edx, str.OS_SockRecv
mov ecx, 0x12c
call fcn.004ccb50
add esp, 0x1c
lea eax, [esi - 0x401]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
pop ebp
ret
Function at 0x429e10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi], 0xffffffff
jne 0x429e25
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [sym.imp.WS2_32.dll_recv]
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [ebp + 8]
push 0
mov eax, 0x401
sub eax, esi
push eax
mov eax, dword [edi]
lea edx, [esi + ecx]
push edx
push eax
call ebx
test eax, eax
js 0x429e6a
je 0x429e8b
add esi, eax
cmp esi, 0x401
jb 0x429e30
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
lea eax, [esi - 0x401]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
call fcn.005f6940
push eax
push edi
push str.recv_error__code__d_msg__s
push 0x164
jmp 0x429eae
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
call fcn.005f6940
push eax
push edi
push str.recv_error__code__d_msg__s
push 0x16e
push str.BaseSock.cpp
push 0x6c5bd8
mov edx, str.OS_SockRecv
mov ecx, 0x12c
call fcn.004ccb50
mov eax, dword [ebp + 0xc]
add esp, 0x1c
mov dword [eax], esi
lea eax, [esi - 0x401]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
pop ebp
ret

Function at 0x429ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebx], 0xffffffff
jne 0x429eed
or eax, 0xffffffff
pop ebp
ret
cmp dword [ebp + 8], 0
je 0x429ee8
test edi, edi
jne 0x429efb
xor eax, eax
pop ebp
ret
push esi
xor esi, esi
mov edi, edi
mov ecx, dword [ebp + 8]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebx]
lea edx, [esi + ecx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x429f21
add esi, eax
cmp esi, edi
jb 0x429f00
sub esi, edi
neg esi
sbb eax, eax
pop esi
pop ebp
ret

Function at 0x429f30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebx], 0xffffffff
je 0x429f80
cmp dword [ebp + 8], 0
je 0x429f80
test edi, edi
jne 0x429f46
xor eax, eax
pop ebp
ret
push esi
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0x10
push eax
push 0
mov ecx, edi
sub ecx, esi
push ecx
mov ecx, dword [ebx]
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x429f77
add esi, eax
cmp esi, edi
jl 0x429f50
sub esi, edi
neg esi
sbb eax, eax
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x433350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x638bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 0xb0]
lea ecx, [esp + 0x44]
push ecx
mov ecx, edi
call edx
mov eax, dword [ebx]
mov dword [edi + 0x28], eax
mov ecx, dword [ebx + 4]
mov dword [edi + 0x2c], ecx
mov edx, dword [ebx + 8]
lea eax, [ebx + 0xc]
lea ecx, [edi + 0x34]
mov dword [edi + 0x30], edx
call fcn.00434710
mov eax, dword [edi]
mov edx, dword [eax + 0x4c]
mov ecx, edi
call edx
push eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [esp + 0x10]
push ecx
xor esi, esi
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x268], esi
fld dword [0x69c6d0]
push 3
push ecx
mov ecx, 0x675df0
fstp dword [esp]
lea esi, [esp + 0x2c]
call fcn.00431de0
mov byte [esp + 0x268], 1
fldz
fst dword [esp + 0x20]
xor eax, eax
fst dword [esp + 0x1c]
push 0x1fe
fst dword [esp + 0x1c]
push eax
fst dword [esp + 0x1c]
lea ecx, [esp + 0x5e]
fst dword [esp + 0x34]
push ecx
fstp dword [esp + 0x3c]
mov word [esp + 0x60], ax
fld dword [0x69c700]
fstp dword [esp + 0x40]
fld dword [0x69c718]
fstp dword [esp + 0x44]
call fcn.005ff630
fld dword [ebx + 4]
mov edx, dword [edi]
mov edx, dword [edx + 0x11c]
add esp, 0xc
push 0
lea eax, [esp + 0x58]
push eax
push ecx
mov ecx, edi
fstp dword [esp]
call edx
mov edx, dword [esp + 0x24]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x3c]
push ecx
push edx
mov esi, dword [esp + 0x28]
push 0xffffffffffffffff
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.gdiplus.dll_GdipMeasureString]
fild dword [edi + 0x7c]
mov ecx, dword [esp + 0x24]
push ecx
fadd dword [esp + 0x20]
mov dword [edi + 0x8c], 1
mov dword [edi + 0x70], 0
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fst dword [edi + 0x50]
fstp dword [edi + 0x60]
fild dword [edi + 0x78]
fstp dword [edi + 0x64]
call dword [sym.imp.gdiplus.dll_GdipDeleteFont]
push esi
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 4
Function at 0x4434c0
Capabilities:
Access peb ldr_data
Check if file exists
Create directory
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x118], esi
mov dword [esi + 8], vtable.CXCImage.0
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
push 0x680910
lea ecx, [esi + 0x3c]
mov dword [esi], vtable.CDiscountPanel.0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.00412330
push ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x104
lea edi, [esi + 0x6c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xff
lea ecx, [ebp - 0x10f]
xor eax, eax
push ebx
push ecx
mov byte [ebp - 0x114], bl
mov word [ebp - 0x113], ax
mov byte [ebp - 0x110], bl
call fcn.005ff630
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.005f9b90
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0x675f00
push edi
call fcn.005f1060
push edi
push str._sExport
push edi
call fcn.005f1060
add esp, 0x1c
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4435d7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [0x6c4b78]
cmp ecx, ebx
jne 0x443601
push 0x50
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x4435f7
push eax
call fcn.00468950
jmp 0x4435f9
xor eax, eax
mov ecx, eax
mov dword [0x6c4b78], ecx
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, dword [0x6c4b78]
mov dword [esi + 0x68], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
Function at 0x4487a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643928
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x30], ebx
push 8
mov dword [ebp - 4], ebx
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x4488cf
mov dword [ebp - 0x30], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov esi, eax
mov dword [ebp - 4], 1
call fcn.004c4b60
push 0xd
push str.config_ad.ini
mov ecx, esi
call fcn.00412ae0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x448831
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
push str.login_type
push str.gateway
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx]
cmp eax, 2
mov eax, dword [edx + 0x88]
jne 0x448857
push ebx
jmp 0x448859
push 1
call eax
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x80]
push ebx
call eax
cmp dword [ebp - 0x18], esi
jb 0x44887a
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.005f0cb0
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.0040ed70
mov edx, dword [ebp - 0x30]
push edx
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0040ed70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x34], ebx
call fcn.005f41f0
push 0x6a361c
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x40], vtable.std::bad_alloc.0
call fcn.006009e0
int3
Function at 0x458e50
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.005ff630
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10d
lea edx, [ebp - 0x217]
push 0
push edx
mov byte [ebp - 0x218], 0
call fcn.005ff630
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x218]
push str.__s__AutoStart
push ecx
call fcn.005f1060
add esp, 0x18
lea edx, [ebp - 0x21c]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x458f36
cmp dword [ebp + 8], eax
je 0x458f17
mov ecx, dword [ebp - 0x21c]
push 0x104
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x683378
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x458f29
mov edx, dword [ebp - 0x21c]
push 0x683378
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 4

Function at 0x458f50
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.005ff630
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10d
lea edx, [ebp - 0x217]
push ebx
push edx
mov byte [ebp - 0x218], bl
call fcn.005ff630
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x218]
push str._s_AutoStart
push ecx
call fcn.005f1060
add esp, 0x18
lea edx, [ebp - 0x320]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x320], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x103
lea eax, [ebp - 0x31b]
push ebx
push eax
mov byte [ebp - 0x31c], bl
call fcn.005ff630
add esp, 0xc
lea ecx, [ebp - 0x328]
push ecx
mov ecx, dword [ebp - 0x320]
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x324]
push eax
push ebx
push 0x683378
push ecx
mov dword [ebp - 0x328], 0x104
mov dword [ebp - 0x324], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x320]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, ebx
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.005f0da0
mov esp, ebp
pop ebp
ret