joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003255f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
lea ecx, [eax + 0x2a]
push esi
push edi
mov dword [ebp + 0x14], eax
mov dword [ebp - 0xc], ecx
cmp eax, ecx
ja 0x100326ea
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
mov esi, 0xff
mov ebx, dword [ebp + 0x14]
sub ebx, 0x144
je 0x100326b1
sub ebx, 7
je 0x100325ee
sub ebx, 7
je 0x100326ed
sub ebx, 0x3b9e
jne 0x100326da
mov eax, dword [ecx]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edx
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
push eax
xor eax, eax
push eax
lea ecx, [ebp - 0xc]
push ecx
push eax
lea ecx, [ebp - 8]
push ecx
push 0x3203
push eax
mov dword [ebp - 8], 0xf
call fcn.100322b6
add esp, 0x20
jmp 0x100326ed
mov edx, dword [ecx]
cmp edx, 0x20
jb 0x1003268b
mov dword [ebp - 4], edx
mov dword [ebp - 8], 8
xor eax, dword [edi]
add edi, 4
mov edx, eax
shr edx, 0x10
and edx, esi
mov edx, dword [edx*4 + 0x1005aac0]
mov ebx, eax
shr ebx, 8
and ebx, esi
xor edx, dword [ebx*4 + 0x1005aec0]
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1005a6c0]
and eax, esi
xor edx, dword [eax*4 + 0x1005b2c0]
dec dword [ebp - 8]
mov eax, edx
jne 0x10032603
sub dword [ebp - 4], 0x20
mov edx, dword [ebp - 4]
mov dword [ecx], edx
cmp edx, 0x20
jae 0x100325fc
jmp 0x1003268b
xor eax, dword [edi]
add edi, 4
mov edx, eax
shr edx, 0x10
and edx, esi
mov edx, dword [edx*4 + 0x1005aac0]
mov ebx, eax
shr ebx, 8
and ebx, esi
xor edx, dword [ebx*4 + 0x1005aec0]
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1005a6c0]
and eax, esi
xor edx, dword [eax*4 + 0x1005b2c0]
add dword [ecx], 0xfffffffc
mov eax, edx
cmp dword [ecx], 4
jae 0x10032650
cmp dword [ecx], 0
mov edx, edi
je 0x100326ad
movzx ebx, byte [edx]
xor ebx, eax
and ebx, esi
shr eax, 8
xor eax, dword [ebx*4 + 0x1005a6c0]
inc edx
dec dword [ecx]
jne 0x10032697
not eax
jmp 0x100326da
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
not eax
jmp 0x100326d3
test dl, 3
je 0x100326d8
movzx edi, byte [edx]
xor edi, eax
and edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x1005a6c0]
inc edx
dec dword [ecx]
cmp dword [ecx], 0
jne 0x100326ba
mov edi, edx
mov ebx, dword [ebp - 0xc]
add dword [ebp + 0x14], 7
cmp dword [ebp + 0x14], ebx
jbe 0x1003258d
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003270f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
lea ecx, [eax + 0x49]
push esi
push edi
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
cmp eax, ecx
ja 0x1003287c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov ebx, 0x4c53
mov eax, dword [ebp + 0x10]
sub eax, 0x4a12
je 0x10032884
dec eax
je 0x10032840
dec eax
je 0x1003287c
sub eax, 0xc8c
je 0x100327f2
dec eax
je 0x100327c1
dec eax
je 0x1003279b
dec eax
jne 0x1003286d
and dword [esi + 0x10], eax
cmp dword [edi + 0x10], eax
je 0x1003286d
push dword [edi + 0x14]
call fcn.1000361d
mov dword [esi + 0x10], eax
push dword [edi + 0x14]
push dword [edi + 0x10]
push eax
call fcn.1004cab0
mov eax, dword [edi + 0x14]
add esp, 0x10
mov dword [esi + 0x14], eax
jmp 0x1003286d
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 0xa]
push ebx
push dword [esi + 0x10]
mov word [esi + 0xa], ax
call fcn.10034f88
pop ecx
pop ecx
jmp 0x1003286d
mov eax, dword [edi + 4]
test eax, eax
je 0x1003286d
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100327cf
sub eax, ecx
inc eax
push eax
call fcn.1000361d
pop ecx
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0x100327e6
jmp 0x1003286d
cmp esi, edi
je 0x1003287c
push ebx
push dword [esi]
call fcn.10034f88
and dword [esi], 0
mov eax, dword [edi]
pop ecx
pop ecx
test eax, eax
je 0x1003282f
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10032810
sub eax, ecx
inc eax
push eax
call fcn.1000361d
pop ecx
mov dword [esi], eax
mov ecx, dword [edi]
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0x10032825
push ebx
push dword [esi + 4]
call fcn.10034f88
and dword [esi + 4], 0
pop ecx
pop ecx
jmp 0x1003286d
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x10032866
movzx edx, byte [edi]
mov eax, dword [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x1005a6c0]
inc edi
mov dword [esi], eax
dec dword [ecx]
jne 0x10032848
mov eax, dword [esi]
not eax
mov dword [ebp - 4], eax
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x10032736
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
test edi, edi
jne 0x1003288c
xor eax, eax
jmp 0x1003287f
mov eax, dword [section..data]
test eax, eax
je 0x100328a0
push 0x177f
call fcn.10009b2b
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
mov eax, dword [esi]
mov dword [ebp - 8], eax
push 0x144
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.1003255f
add esp, 0x10
jmp 0x1003287f
Function at 0x10035952
Capabilities:
Get common file path
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
lea edi, [eax + 0x66]
mov dword [ebp - 4], eax
cmp eax, edi
ja 0x100359d1
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp - 4]
sub eax, 0x125d
je 0x100359f7
dec eax
je 0x100359d9
dec eax
je 0x100359d1
sub eax, 0x2fec
je 0x100359bb
dec eax
je 0x10035a3f
sub eax, 0x1c18
jne 0x10035a0f
lea eax, [ebp + 0x10]
push 0x748c
push eax
mov dword [ebp + 0x10], 4
call fcn.10037122
pop ecx
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x10035a1d
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
mov edi, ecx
jmp 0x10035a1f
push ebx
push esi
push 0x2497
call fcn.10024407
add esp, 0xc
cmp al, bl
jne 0x10035a0f
mov byte [ebp + 0x10], bl
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
setne al
mov byte [ebp + 0x10], al
jmp 0x10035a0f
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x401], bl
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jbe 0x10035970
jmp 0x100359d1
xor edi, edi
mov dword [edi], ebx
mov eax, dword [esi]
push 0x5799
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.10035877
add esp, 0x10
mov eax, edi
jmp 0x100359d4
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push dword [eax]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb al, al
inc al
mov byte [ebp + 0x10], al
jmp 0x100359d1
Function at 0x100391ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi]
cmp word [eax + 0x32], si
je 0x10039487
mov edx, dword [edi + 0x7c]
mov ecx, dword [edi + 0x78]
mov esi, dword [ebx + 0xcb3c]
call 0xfdf70cd
cmp esi, eax
jge 0x10039487
push 5
push esi
push dword [0x9b4bf4]
mov esi, dword [0x401348]
call esi
mov edx, dword [edi + 0x78]
mov ecx, eax
call 0xfe3e0da
push dword [0x9b4bf4]
call esi
push dword [0x9b4bf4]
mov esi, eax
call dword [0x401348]
mov ecx, dword [eax + 0x4ae4]
lea edx, [esi + 0x18]
call 0xfe3f39e
neg eax
sbb al, al
inc al
je 0x10039487
mov ecx, dword [ebx + 0xcb38]
test ecx, ecx
jle 0x100392fc
mov esi, dword [0x401348]
push 5
lea eax, [ecx - 1]
push eax
push dword [0x9b4bf4]
call esi
mov edx, dword [edi + 0x78]
mov ecx, eax
call 0xfe3e0da
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x20]
cmp ecx, dword [eax + 0x38]
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x24]
cmp ecx, dword [eax + 0x3c]
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov al, byte [eax + 0x44]
xor al, byte [ecx + 0x2c]
test al, 0xc0
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov al, byte [eax + 0x44]
xor al, byte [ecx + 0x2c]
test al, 0x30
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [eax + 0x40]
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov ax, word [eax + 0x48]
xor ax, word [ecx + 0x30]
mov ecx, 0x7fff
test cx, ax
jne 0x100392fa
push dword [0x9b4bf4]
call esi
mov ecx, dword [edi]
mov cl, byte [ecx + 0x2e]

Function at 0x1003f2da
Capabilities:
Delete file

Disassembly:
add byte [edi + ecx], dl
test dword [ecx], ecx
add dword [eax], eax
add byte [edi], cl
mov bh, 0x44
and al, 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x1002331f

Function at 0x1003f5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push esi
push edi
xor esi, esi
push esi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1003ddb0
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x1003f646
push esi
push 0x80
push 1
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003f5e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x50
je 0x1003f63f
cmp esi, 0xb7
je 0x1003f63f
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003f5e7
test eax, 0xffffffef
je 0x1003f677
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [str.Could_not_open_file]
push dword [esp + 0x10]
call fcn.1003f3e0
push edi
call fcn.10048e20
pop ecx
xor al, al
jmp 0x1003f657
pop edi
pop esi
ret 0xc
Function at 0x10048b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0x10864
call fcn.1003dbd0
mov eax, dword [0x100597f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x10048b5b
push 0x8000
lea eax, [ebp - 0x10808]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call ebx
test eax, eax
jle 0x10048b6c
test edi, edi
je 0x10048b5b
push 0x400
lea ecx, [ebp - 0x808]
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call ebx
test eax, eax
jle 0x10048b6c
push 0x40
lea edx, [ebp - 0x1085c]
push 0
push edx
mov dword [ebp - 0x10860], 0x44
call fcn.1003d730
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10818], eax
mov dword [ebp - 0x10814], eax
mov dword [ebp - 0x10810], eax
mov dword [ebp - 0x1080c], eax
lea eax, [ebp - 0x10818]
push eax
lea ecx, [ebp - 0x10860]
push ecx
push 0
push 0
push 0
neg esi
sbb esi, esi
push 0
lea edx, [ebp - 0x10808]
push 0
and esi, edx
neg edi
push 0
sbb edi, edi
lea eax, [ebp - 0x808]
push esi
and edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10048bac
mov ecx, dword [ebp - 0x10818]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10814]
push edx
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049ef0
mov esp, ebp
pop ebp
ret

Function at 0x10050a1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005a4e0]
jne 0x10050a25
repz ret
jmp fcn.10052122
Function at 0x1005181c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1005a4e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1004e87e
and dword [ebp - 0x14], 0
cmp dword [0x1005e998], 0
mov dword [ebp - 0x18], eax
jne 0x100518cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10051977
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10051977
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1005e998], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1005e99c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1005e9a0], eax
call edi
push eax
call esi
mov dword [0x1005e9a8], eax
test eax, eax
je 0x100518cf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1005e9a4], eax
mov eax, dword [0x1005e9a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10051928
cmp dword [0x1005e9a8], ecx
je 0x10051928
push eax
call esi
push dword [0x1005e9a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10051928
test ebx, ebx
je 0x10051928
call edi
test eax, eax
je 0x1005191f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1005191f
test byte [ebp - 8], 1
jne 0x10051928
or dword [ebp + 0x10], 0x200000
jmp 0x1005195b
mov eax, dword [0x1005e99c]
cmp eax, dword [ebp - 0x18]
je 0x1005195b
push eax
call esi
test eax, eax
je 0x1005195b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1005195b
mov eax, dword [0x1005e9a0]
cmp eax, dword [ebp - 0x18]
je 0x1005195b
push eax
call esi
test eax, eax
je 0x1005195b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1005e998]
call esi
test eax, eax
je 0x10051977
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10051979
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050a1b
leave
ret
Function at 0x4012ad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419feb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push 0x40
call fcn.0040f55b
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x4012fb
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.00401000
mov dword [ebp - 0x28], eax
jmp 0x401302
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov ecx, dword [ebp - 0x14]
call fcn.00401174
test eax, eax
jne 0x40135f
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
je 0x401354
push 1
mov ecx, dword [ebp - 0x20]
call fcn.00401720
mov dword [ebp - 0x2c], eax
jmp 0x40135b
mov dword [ebp - 0x2c], 0
xor eax, eax
jmp 0x401393
mov ecx, dword [ebp + 8]
call fcn.004016d0
cmp dword [eax + 0xac], 0
je 0x401378
mov ecx, dword [ebp + 8]
call fcn.00403276
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4013a1
push 0
push 0
call fcn.00405d2e
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402897
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push str.Searching_daemons...
call fcn.00404876
add esp, 4
xor eax, eax
mov ax, word [0x425344]
cmp eax, 1
jge 0x402a50
cmp dword [ebp - 4], 0
jne 0x40292a
call fcn.00402a59
push eax
push 0x42522c
call fcn.00406500
add esp, 8
push 0x421664
push 0x42522c
call fcn.00406510
add esp, 8
push str.NMD.DLL
push 0x42522c
call fcn.00406510
add esp, 8
push 0x424fd0
push 0x42522c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402928
push str.0_NETMAN_daemons_found
call fcn.00404876
add esp, 4
jmp 0x402a50
jmp 0x40294c
push 0x424fd0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40294c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402a50
push 0x42566c
push 0x42522c
call fcn.00406500
add esp, 8
push 0x424ffc
push 0x42522c
call fcn.00406500
add esp, 8
push 0x42522c
push str.Loading__s...
push 0x42544c
call fcn.004064a8
add esp, 0xc
push 0x42544c
call fcn.00404876
add esp, 4
push 0x42522c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
mov cx, word [0x425344]
imul ecx, ecx, 0x104
mov dword [ecx + 0x425348], eax
xor edx, edx
mov dx, word [0x425344]
imul edx, edx, 0x104
cmp dword [edx + 0x425348], 0
jne 0x4029f4
push 0x42522c
push str.Daemon__s:_Load_error_
push 0x42544c
call fcn.004064a8
add esp, 0xc
push 0x42544c
call fcn.00404843
add esp, 4
xor eax, eax
jmp 0x402a55
push 0x42522c
push str._s:_Started.
push 0x42544c
call fcn.004064a8
add esp, 0xc
push 0x42544c
call fcn.00404876
add esp, 4
push 0x42522c
xor eax, eax
mov ax, word [0x425344]
imul eax, eax, 0x104
add eax, 0x42534c
push eax
call fcn.00406500
add esp, 8
mov cx, word [0x425344]
add cx, 1
mov word [0x425344], cx
jmp 0x4028af
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402b59
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push str.Searching_services...
call fcn.00404876
add esp, 4
xor eax, eax
mov ax, word [0x425330]
cmp eax, 4
jge 0x402cae
cmp dword [ebp - 4], 0
jne 0x402bf0
call fcn.00402a59
push eax
push 0x42522c
call fcn.00406500
add esp, 8
push 0x421704
push 0x42522c
call fcn.00406510
add esp, 8
push str.NMS.DLL
push 0x42522c
call fcn.00406510
add esp, 8
push 0x424e90
push 0x42522c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402bee
push str.0_NETMAN_services_found
call fcn.00404843
add esp, 4
xor eax, eax
jmp 0x402cb3
jmp 0x402c12
push 0x424e90
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402c12
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402cae
push 0x425670
push 0x42522c
call fcn.00406500
add esp, 8
push 0x424ebc
push 0x42522c
call fcn.00406500
add esp, 8
push 0x42522c
push str.Loading_service__s...
push 0x42544c
call fcn.004064a8
add esp, 0xc
push 0x42544c
call fcn.00404876
add esp, 4
mov eax, dword [0x421354]
push eax
push 0x42522c
call fcn.00402ebe
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402c84
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x402cb3
xor edx, edx
mov dx, word [0x425330]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x425334], eax
mov cx, word [0x425330]
add cx, 1
mov word [0x425330], cx
jmp 0x402b73
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403276
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x2ec]
test eax, eax
jle 0x4032f1
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x2ec]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jbe 0x4032ef
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx*4 + 0x2d4]
mov dword [ebp - 8], eax
push 0x3e8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4032e3
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00403305
jmp 0x40328f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esp, ebp
pop ebp
ret
Function at 0x403d15
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [0x421954], 0x64
mov dword [0x421958], 0xa
mov ecx, dword [ebp - 8]
call fcn.00403e12
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403d79
mov eax, dword [ebp - 4]
push eax
push 0x64
push str.ServiceRefreshTime
push 0x42199c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x421954], eax
mov ecx, dword [ebp - 4]
push ecx
push 0xa
push str.ClientRefreshTime
push str.IfhServer
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x421958], eax
mov edx, dword [0x421958]
push edx
mov eax, dword [0x421954]
push eax
mov ecx, dword [ebp - 8]
call fcn.00403cd4
mov esp, ebp
pop ebp
ret

Function at 0x403e12
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push str.EDIABAS_CONFIG_DIR
call fcn.0040675c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403eb1
mov eax, dword [ebp - 4]
push eax
push 0x4258cc
call fcn.00406500
add esp, 8
push 0x4258cc
call fcn.00406620
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x403e78
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4258cb]
cmp edx, 0x5c
jne 0x403e78
mov eax, dword [ebp - 8]
mov byte [eax + 0x4258cb], 0
push 0x4219dc
push 0x4258cc
call fcn.00406510
add esp, 8
push 0x4219e0
push 0x4258cc
call fcn.00406510
add esp, 8
push 0x4219ec
push 0x4258cc
call fcn.00406749
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403f04
push 0x104
push 0x4258cc
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x403f04
push 0x4219f0
push 0x4258cc
call fcn.00406510
add esp, 8
push 0x4219f4
push 0x4258cc
call fcn.00406510
add esp, 8
push 0x421a00
push 0x4258cc
call fcn.00406749
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403f59
mov ecx, dword [ebp - 0x10]
call fcn.00403d92
push eax
push 0x4258cc
call fcn.00406500
add esp, 8
push 0x421a04
push 0x4258cc
call fcn.00406510
add esp, 8
push str.ediabas.ini
push 0x4258cc
call fcn.00406510
add esp, 8
push 0x421a14
push 0x4258cc
call fcn.00406749
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403f75
push 0x4259e0
push 0x4258cc
call fcn.00406500
add esp, 8
xor eax, eax
jmp 0x403f86
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040669b
add esp, 4
mov eax, 0x4258cc
mov esp, ebp
pop ebp
ret

Function at 0x41347b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4134bd
call fcn.00418f96
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4134bd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4134b4
xor eax, eax
jmp 0x4134c5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004134cb
pop edi
pop esi
pop ebx
ret 4
Function at 0x4196dc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41970a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x419728
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419642
jmp 0x419728
mov eax, dword [esi + 0x14]
test eax, eax
je 0x419728
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00419642
test edi, edi
mov eax, edi
jne 0x419712
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8