joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407050
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41e256
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push edi
push str.SOFTWARESinforNG
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
push str.path
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], ebx
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
mov byte [esp + 0x128], 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push ecx
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x407106
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40712e
lea ecx, [esp + 8]
mov byte [esp + 0x128], bl
call fcn.0041d0e6
lea ecx, [esp + 0xc]
mov dword [esp + 0x128], 0xffffffff
call fcn.0041d0e6
xor eax, eax
jmp 0x407183
push esi
mov esi, dword [esp + 0x134]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0041d0fe
push str.config_
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], bl
call fcn.0041d0e6
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 0xffffffff
call fcn.0041d0e6
mov eax, 1
pop esi
mov ecx, dword [esp + 0x120]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4

Function at 0x4079b0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x8488]
lea edi, [esi + 0x8488]
cmp eax, 0xffffffff
je 0x4079ce
push edi
call fcn.00406de0
mov eax, dword [esi + 0x8484]
push 0
push 0
push eax
call dword [sym.imp.WSOCK32.dll_accept]
mov ecx, dword [esi + 0x847c]
mov dword [edi], eax
cmp eax, ecx
jbe 0x4079f1
mov dword [esi + 0x847c], eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x20], 1
call ebx
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov edx, dword [edi]
lea ecx, [esp + 0x14]
push 4
push ecx
push 1
push 6
push edx
mov dword [esp + 0x28], 1
call ebx
mov ecx, dword [esi + 0xc]
xor eax, eax
cmp ecx, eax
mov dword [esi + 0x848c], eax
jbe 0x407a64
mov ebx, dword [edi]
lea edx, [esi + 0x10]
cmp dword [edx], ebx
je 0x407a64
inc eax
add edx, 4
cmp eax, ecx
jb 0x407a58
cmp eax, ecx
pop ebx
jne 0x407a7b
cmp ecx, 0x40
jae 0x407a7b
mov ecx, dword [edi]
mov dword [esi + eax*4 + 0x10], ecx
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x407b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x41e328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 0x849c]
mov ecx, ebx
call fcn.004108b0
test eax, eax
jle 0x407ce3
cmp eax, 0x4000
jbe 0x407b73
mov eax, 0x4000
push 0
lea edi, [esi + 0x4438]
push eax
mov eax, dword [esi + 0x8488]
push edi
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov ebp, eax
test ebp, ebp
jge 0x407c26
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x407c74
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x407c74
mov eax, dword [esi + 0x8524]
test eax, eax
je 0x407bc4
push 2
jmp 0x407bc6
push 1
mov ecx, esi
call fcn.00407850
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call dword [sym.imp.MSVCRT.dll_strerror]
push eax
lea ecx, [esp + 0x1c]
push 0x12f
push ecx
call fcn.00415d70
mov eax, dword [eax]
mov dword [esp + 0x30], 0
push eax
push 3
call fcn.00415ce0
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d0e6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
jne 0x407c74
mov eax, dword [esi + 0x8524]
test eax, eax
je 0x407c53
push 2
mov ecx, esi
call fcn.00407850
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push 1
mov ecx, esi
call fcn.00407850
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push ebp
push edi
mov ecx, ebx
call fcn.00410620
mov ecx, ebx
call fcn.004108d0
mov ebp, eax
cmp ebp, 0x14
jb 0x407ce3
jmp 0x407c91
mov esi, dword [esp + 0x10]
push 0x14
push edi
mov ecx, ebx
call fcn.00410790
push edi
mov ecx, esi
call fcn.0040ad90
test eax, eax
je 0x407cf8
mov esi, dword [edi + 0x10]
add esi, 0x14
cmp ebp, esi
jl 0x407ce3
cmp esi, 0x4000
ja 0x407d17
push esi
push edi
mov ecx, ebx
call fcn.00410790
push esi
mov ecx, ebx
call fcn.00410840
mov ecx, dword [esp + 0x10]
push esi
push edi
call fcn.00408930
mov ecx, ebx
call fcn.004108d0
mov ebp, eax
cmp ebp, 0x14
jae 0x407c8d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push 1
mov ecx, esi
call fcn.00407850
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.sizeof_m_pTmpRcvBuffer___nFullCmdLen
push 3
call fcn.00415ce0
mov ecx, dword [esp + 0x18]
add esp, 8
push 1
call fcn.00407850
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x408e80
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x41e4e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x429bf8
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
push esi
push ebp
push esi
push ebx
lea eax, [esp + 0x28]
xor edi, edi
push str.copy__s_s__s_s
push eax
mov dword [esp + 0x3c], edi
call sub.MFC42.DLL_CString::Format
add esp, 0x18
lea ecx, [esp + 0x14]
push 0x429bf8
call sub.MFC42.DLL_CString::CString_2
push 0x429bf8
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_2
push esi
push ebx
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
push esi
push ebp
lea edx, [esp + 0x28]
push str._s_s
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x20
lea ecx, [esp + 0x10]
push edi
push edi
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x408f7b
push eax
lea ecx, [esp + 0x1c]
or edi, 0xffffffff
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [esp + 0x38]
push 0x132
push eax
call fcn.00415d70
mov eax, dword [eax]
mov byte [esp + 0x30], 3
push eax
push 2
call fcn.00415ce0
add esp, 0x14
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 2
call fcn.0041d0e6
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.0041d0e6
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.0041d0e6
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041d0e6
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x408fc0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x41e510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov ebp, ecx
push edi
push 0x429bf8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
push 0x429bf8
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
xor edi, edi
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
push esi
mov ecx, ebp
mov byte [esp + 0x28], 1
call fcn.00408d10
test eax, eax
jne 0x409063
push esi
push str.Cant_Find_file_named__s
push 3
call fcn.00415ce0
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0041d0e6
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d0e6
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
mov ecx, dword [esp + 0xc]
mov ebp, dword [esp + 0x28]
push ecx
push esi
push ebp
lea edx, [esp + 0x1c]
push str.copy__s_s__s
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x14]
push 0x429bf8
call sub.MFC42.DLL_CString::CString_2
push esi
push ebp
lea eax, [esp + 0x1c]
push str._s_s
push eax
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0xc]
push 0
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409108
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x30]
push 0x132
push ecx
call fcn.00415d70
mov eax, dword [eax]
mov byte [esp + 0x2c], 3
push eax
push 2
call fcn.00415ce0
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call fcn.0041d0e6
or edi, 0xffffffff
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.0041d0e6
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0041d0e6
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d0e6
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x40a0f0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x41e6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14c]
push edi
xor ebx, ebx
lea eax, [esi + 0xc]
lea ecx, [esp + 0x10]
push eax
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 8]
mov dword [esp + 0x148], ebx
cmp eax, ebx
mov dword [esp + 0x20], ebx
jle 0x40a1bf
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
add esi, 0x10c
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x427098
push 0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40a19c
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
cdq
add ebp, eax
push esi
adc ebx, edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
add edx, 0x104
inc eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], eax
cmp eax, dword [edx + 8]
jl 0x40a151
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x44]
push eax
push ecx
mov byte [esp + 0x4f], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40a219
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x154]
push ebx
cdq
push ebp
push edx
push eax
call fcn.0041d3d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
cmp ecx, edx
pop ebx
ja 0x40a26b
jb 0x40a23e
cmp dword [esp + 8], eax
jae 0x40a26b
lea ecx, [esp]
mov dword [esp + 0x138], 0xffffffff
call fcn.0041d0e6
xor eax, eax
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
add esp, 0x13c
ret 8
lea ecx, [esp]
mov dword [esp + 0x138], 0xffffffff
call fcn.0041d0e6
mov ecx, dword [esp + 0x130]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x13c
ret 8
Function at 0x40b840
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41e920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x429bf8
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 4]
mov dword [esp + 0x10], 0
push eax
call fcn.00416220
add esp, 4
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 4]
mov byte [esp + 0x10], 0
call fcn.0041d0e6
push str._config_etc_sinfor_sc_gplat_CfgFile.sfr
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp]
and al, 0xfe
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call fcn.0041d0e6
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d6c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41ecdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
mov edx, ecx
push ebp
push esi
lea esi, [edx + 4]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov dword [esi], 0x42166c
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov ecx, 0x40
xor eax, eax
lea edi, [edx + 0x18]
mov dword [edx], 0x421668
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x24], 0x421654
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
push 0x429bf8
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 2
call fcn.0041d0fe
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x2c]
call fcn.0040f9b0
push str._note_
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.0041d0fe
mov edi, dword [esi + 8]
push 0xffffffffffffffff
mov ecx, esi
lea eax, [edi + 1]
push eax
call fcn.0040fd80
mov edx, dword [esi + 4]
lea ecx, [edi*8]
sub ecx, edi
lea eax, [esp + 0x20]
push eax
lea esi, [edx + ecx*4]
lea ecx, [esi + 4]
call sub.MFC42.DLL_CString::operator
lea ecx, [esi + 8]
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x18], ecx
call fcn.0040f9b0
mov eax, dword [esp + 0x2c]
xor ebp, ebp
cmp eax, ebx
jle 0x40d7f6
push ebp
lea ecx, [esp + 0x28]
call fcn.0040f3c0
sub esp, 0xc
mov esi, eax
mov edi, esp
mov dword [esp + 0x24], esp
push esi
mov ecx, edi
mov dword [esp + 0x28], edi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 4]
mov byte [esp + 0x4c], 4
push ecx
lea ecx, [edi + 4]
call sub.MFC42.DLL_CString::CString_1
mov dl, byte [esi + 8]
mov ecx, dword [esp + 0x1c]
mov byte [edi + 8], dl
mov byte [esp + 0x4c], 3
call fcn.0040f320
mov eax, dword [esp + 0x2c]
inc ebp
cmp ebp, eax
jl 0x40d7a7
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x421654
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0x28]
mov byte [esp + 0x40], 6
cmp esi, ebx
je 0x40d833
cmp eax, ebx
je 0x40d82a
lea edi, [eax]
mov ecx, esi
call fcn.004104b0
add esi, 0xc
dec edi
jne 0x40d819
mov esi, dword [esp + 0x28]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], 0x4214b8
mov byte [esp + 0x40], bl
call fcn.0041d0e6
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x40ee40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41effb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push edi
push str.SOFTWARESinforNGLOGS
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x120], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
je 0x40eeeb
lea ecx, [esp]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0041d0e6
xor eax, eax
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
add esp, 0x120
ret
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ef3b
lea ecx, [esp]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0041d0e6
xor eax, eax
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
add esp, 0x120
ret
push esi
mov esi, dword [esp + 0x128]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0041d0fe
push str.LogServer.ini
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov dword [esp + 0x120], 0xffffffff
call fcn.0041d0e6
mov ecx, dword [esp + 0x118]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret

Function at 0x411380
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x80
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.MFC42.DLL_AfxWinInit
test eax, eax
push 0
jne 0x4113c2
push str.Error
push str.Failed_to_init_MFC_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x80
ret 0x10
call sub.MFC42.DLL_AfxSocketInit
test eax, eax
jne 0x4113e8
push eax
push str.Error
push str.Windows_init_sock_err.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x80
ret 0x10
push esi
push edi
call dword [sym.imp.MSVCRT.dll___p___argc]
mov esi, dword [eax]
call dword [sym.imp.MSVCRT.dll___p___argv]
mov edi, dword [eax]
lea ecx, [esp + 8]
call fcn.004108f0
push edi
push esi
lea ecx, [esp + 0x10]
call fcn.00411650
lea ecx, [esp + 8]
mov esi, eax
call fcn.00410940
mov eax, esi
pop edi
pop esi
add esp, 0x80
ret 0x10
Function at 0x411440
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41f3ab
push eax
mov eax, 0x12a8
mov dword fs:[0], esp
call fcn.0041d440
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
call fcn.00401850
mov ecx, dword [esp + 0x12c8]
mov eax, dword [esp + 0x12c4]
xor ebx, ebx
mov dword [esi + 0x18], eax
cmp ecx, ebx
mov dword [esp + 0x12bc], ebx
je 0x41148d
mov eax, ecx
mov dword [esi + 0x1c], eax
lea eax, [esp + 0x20]
mov edi, 1
push eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], 0xf01ff
mov dword [esi + 0x60], 0x110
mov dword [esi + 0x64], 2
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi], 0x42188c
mov dword [esi + 0x14], ebx
mov dword [esp + 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x30]
xor ecx, ecx
cmp edx, 2
sete cl
mov dword [esi + 0x54], ecx
mov dword [0x429cd4], edi
mov dword [section..inidata], esi
mov eax, dword [esi + 0x54]
cmp eax, ebx
mov dword [esi + 0x2c], 0x10
mov dword [esi + 0x3c], ebx
je 0x4115e1
mov eax, 0xff
mov ecx, 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor eax, eax
lea edi, [esp + 0xb4]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x1b4]
rep stosd dword es:[edi], eax
mov ecx, 0x400
lea edi, [esp + 0x2b4]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0xb4]
push edx
push eax
mov dword [esp + 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x1b8]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x2c0]
push ecx
lea eax, [esp + 0xc4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x4115e1
lea ecx, [esp + 0x2b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4115e1
lea edx, [esp + 0x2b4]
push edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x2b4]
mov dword [esi + 0x50], eax
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov ecx, dword [esp + 0x12b4]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x12b4
ret 8
Function at 0x412be0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
mov esi, ecx
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x42c], eax
jne 0x412bfe
xor eax, eax
pop esi
ret
cmp eax, dword [esi + 0x847c]
jbe 0x412c0c
mov dword [esi + 0x847c], eax
mov edx, dword [esi + 0x110]
xor ecx, ecx
push edi
test edx, edx
jbe 0x412c2b
lea edi, [esi + 0x114]
cmp dword [edi], eax
je 0x412c2b
inc ecx
add edi, 4
cmp ecx, edx
jb 0x412c1f
cmp ecx, edx
jne 0x412c48
cmp edx, 0x40
jae 0x412c48
mov dword [esi + ecx*4 + 0x114], eax
mov eax, dword [esi + 0x110]
inc eax
mov dword [esi + 0x110], eax
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
jbe 0x412c66
mov edi, dword [esi + 0x42c]
lea edx, [esi + 0x10]
cmp dword [edx], edi
je 0x412c66
inc eax
add edx, 4
cmp eax, ecx
jb 0x412c5a
pop edi
cmp eax, ecx
jne 0x412c81
cmp ecx, 0x40
jae 0x412c81
mov ecx, dword [esi + 0x42c]
mov dword [esi + eax*4 + 0x10], ecx
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
ret
Function at 0x412c90
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41f430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
push str.SOFTWARESinforSC
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
mov ebx, 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x144], ebx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412d51
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str.Open_the_reg_key:_s_failed
push 3
call fcn.00415ce0
mov esi, dword [esp + 0x144]
add esp, 0xc
mov ecx, esi
push 0x429bf8
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], ebx
jmp 0x412dfd
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push str.path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x412daa
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str.Read_the_reg_key:_s_s_path_value_failed
push 3
call fcn.00415ce0
mov esi, dword [esp + 0x144]
add esp, 0xc
mov ecx, esi
push 0x429bf8
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], ebx
jmp 0x412dfd
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call sub.MFC42.DLL_AfxGetEmptyString
mov ecx, dword [eax]
lea edx, [esp + 0x24]
mov dword [esp + 0x14], ecx
push edx
lea ecx, [esp + 0x18]
call fcn.0041d0fe
mov esi, dword [esp + 0x138]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x134], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x130], bl
call fcn.0041d0e6
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 0
call fcn.0041d0e6
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret 4