joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0xbe905fa
mov dword [esp + 0xc], 0xf9709e1
mov dword [esp + 0x10], 0x33de0dda
mov dword [esp + 0x14], 0x37d631d6
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x3536
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x22], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1d
ja 0x41b19e
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0x487ac655]
and esi, edx
add ecx, edx
add ecx, 0x487ac655
add esi, esi
sub ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov edx, ecx
xor edx, 0xac
and ecx, 0x2c
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1e
jb 0x41b150
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b1d0
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b1e9
mov eax, 0xffffffff
jmp 0x41b1ec
add eax, 0x12
push eax
call fcn.00408cc0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b221
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b210
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41b251
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b240
mov word [eax], 0
push edi
push esi
call fcn.0043d820
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x445718]
mov ecx, 0x8faf111b
xor ecx, dword [0x445720]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x41e910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x43834179
mov dword [esp + 0x14], 0x5fac5db2
mov dword [esp + 0x18], 0x5bbb5982
mov dword [esp + 0x1c], 0x57b755d6
mov dword [esp + 0x20], 0x53b45169
mov dword [esp + 0x24], 0x6f946dbe
mov dword [esp + 0x28], 0x6b9e69e1
mov dword [esp + 0x2c], 0x679b6596
mov dword [esp + 0x30], 0x63826194
mov dword [esp + 0x34], 0x7f8e7d99
mov dword [esp + 0x38], 0x7b9c7982
mov dword [esp + 0x3c], 0x778675aa
mov dword [esp + 0x40], 0x738e7187
mov dword [esp + 0x44], 0xff80d89
mov dword [esp + 0x48], 0xb8509f1
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x50a
mov dword [esp + 0x52], 0
mov dword [esp + 0x4e], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x45
ja 0x41ea0e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0xb]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0xd01e470b
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0xb3
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x46
jb 0x41e9d0
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44c2e0]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41ea57
mov eax, 0xffffffff
jmp 0x41ea5a
lea eax, [edi + edi]
push eax
call fcn.00408cc0
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x44c2e0]
mov dword [esp + 0x10], 0x9b329924
mov dword [esp + 0x14], 0x87108519
mov dword [esp + 0x18], 0x832f812c
mov dword [esp + 0x1c], 0x8f2c8d1e
mov dword [esp + 0x20], 0x8b188921
mov dword [esp + 0x24], 0x777675d8
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1c
ja 0x41eb22
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xc57d136c
add eax, 0x6c
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
or ecx, 0xb
and eax, 0xb
add eax, ecx
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1d
jb 0x41ead0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00418f70
add esp, 0x14
mov ebx, eax
jmp dword [0x446280]
Function at 0x41eb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2208
call fcn.00408c90
mov dword [esp + 0x1200], 0xb340b15c
mov dword [esp + 0x1204], 0xb771b571
mov dword [esp + 0x1208], 0xab59a951
mov dword [esp + 0x120c], 0xaf5cad58
mov dword [esp + 0x1210], 0xa34ea149
mov dword [esp + 0x1214], 0xa755a551
mov dword [esp + 0x1218], 0x5ba8599d
mov word [esp + 0x121c], 0x5d5c
mov dword [esp + 0x1222], 0
mov dword [esp + 0x121e], 0
mov dword [esp + 0xa90], 0
mov eax, dword [esp + 0xa90]
cmp eax, 0x25
ja 0x41ec4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xa90]
mov ecx, dword [esp + 0xa90]
movzx ecx, byte [esp + ecx + 0x1200]
add eax, 0xcdd05068
xor eax, ecx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x90]
add al, 0x28
mov ecx, dword [esp + 0xa90]
mov byte [esp + ecx + 0x1200], al
inc dword [esp + 0xa90]
mov eax, dword [esp + 0xa90]
cmp eax, 0x26
jb 0x41ec00
lea eax, [esp + 0x34]
lea esi, [esp + 0x1200]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.0043de60
add esp, 0x14
shr eax, 0x1f
mov eax, dword [eax*4 + 0x446288]
mov ecx, 0x8a39bde6
xor ecx, dword [0x446290]
add eax, ecx
inc eax
jmp eax
xor byte [0xd0311831], cl
xor dh, ah
xor bh, bh
xor dl, byte [edx + 0x34]
insd dword es:[edi], dx
xor al, 0x78
xor al, 0x8d
xor al, 0x98
xor al, 0xb4
xor al, 0xbf
xor al, 0xea
xor al, 0xf5
xor al, 0x7f
xor eax, 0x35bd358e
fdiv dword [0x360135e3]
or al, 0x36
pop ecx
aaa
aaa
ja 0x456af3
xor byte [edi], 0x93
aaa
sahf
aaa
mov cl, 0x37
mov esp, 0x63385837
cmp byte [esi], cl
cmp dword [ecx], ebx
cmp dword [ecx + edi + 0x7f], esi
cmp dword [eax - 0x22c651c7], ebp
cmp ch, al
cmp cl, byte [0xda3b183b]
in eax, 0x3e
sbb al, 0x3f
daa
aas
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
pop eax
add byte [eax], al
add byte [ecx], bh
xor bh, byte [edx - 0x27cd3ace]
add byte [eax], al
add byte [ecx], 0
pop eax
add byte [eax], al
add byte [ecx], bh
xor bh, byte [edx - 0x27cd3ace]
xor al, ch
xor bl, al
xor ah, bl
xor cl, byte [esi - 0x2ccc6bcd]
xor ebx, ecx
xor esi, ecx
xor esi, edi
xor edx, dword [esp + esi]
pop ds
xor al, 0x3a
xor al, 0x45
xor al, 0x5c
xor al, 0x67
xor al, 0x48
xor eax, 0x35a9359e
leave
xor eax, 0x39f335d4
invalid
Function at 0x422ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 4]
call fcn.00422d00
add esp, 4
test al, al
je 0x422cf3
mov al, 1
ret
jmp fcn.00423460
Function at 0x430310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x4304f1
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x50], eax
jmp 0x43035f
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
jmp 0x430379
cmp eax, 0
setne al
jmp 0x430381
test al, 1
jne 0x43038a
jmp 0x4304e7
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00408df0
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
setne al
test al, 1
jne 0x4303bf
jmp 0x4304d5
call fcn.00409420
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x39
mov byte [esp + 0x22], 0x23
mov byte [esp + 0x23], 0x3b
mov byte [esp + 0x24], 0x26
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x37
mov byte [esp + 0x27], 0x29
mov byte [esp + 0x28], 0x38
mov byte [esp + 0x29], 0x67
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], 0x2b
mov byte [esp + 0x2c], 0x2c
mov byte [esp + 0x2d], 0x91
mov byte [esp + 0x36], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x17
jae 0x4304ac
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edx
jmp 0x43044d
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
movzx eax, byte [esp + edi + 0x20]
mov edi, esi
add edi, 0x85047fea
mov ebx, edi
and ebx, eax
xor edi, eax
mov edx, 0x7afb8015
sub edx, esi
or edx, eax
add esi, edx
add esi, ebx
sub edi, esi
lea eax, [edi + ebx*2 + 0x7afb8015]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0x9a
mov edx, dword [esp + 0x10]
mov byte [esp + edx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x17
jb 0x43044d
mov edx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
jmp 0x4304ac
jmp 0x4304ae
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], edx
call fcn.00409640
sub esp, 0xc
and al, 1
jmp 0x4304c9
mov byte [esp + 0xf], al
jmp 0x4304cf
jmp 0x4304d1
jmp 0x4304d3
jmp 0x4304d5
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x4304e7
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4304ef
jmp 0x4304f1
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401e40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push 0x2f
mov esi, ecx
xor ebx, ebx
push str..pipe86A12194_0576_496F_911E_CB6B64509AA9
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004056b0
mov eax, dword [esp + 0x18]
mov ebp, 0x10
cmp dword [esp + 0x2c], ebp
jae 0x401e88
lea eax, [esp + 0x18]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x401f30
cmp dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
jae 0x401eaa
lea eax, [esp + 0x18]
push edi
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401f2f
cmp dword [esi + 0x18], ebp
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], ebx
jb 0x401ed9
mov esi, dword [esi + 4]
jmp 0x401edc
add esi, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401f28
xor eax, eax
push ebx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
push 0x14
lea eax, [esp + 0x40]
push eax
push edi
mov byte [esp + 0x48], bl
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
cmp dword [esp + 0x2c], ebp
jb 0x401f43
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0043bef7
add esp, 4
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0043b82a
add esp, 0x3c
ret

Function at 0x4030d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x45fa06
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
push 0x10
call fcn.0043be8d
add esp, 4
xor edi, edi
cmp eax, edi
je 0x403117
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov esi, eax
jmp 0x403119
xor esi, esi
cmp esi, edi
mov dword [esp + 0x24], 0xffffffff
je 0x403149
push ebx
push esi
call fcn.00405a80
push edi
push edi
push esi
push 0x401f60
push edi
push edi
call fcn.0043bc73
add esp, 0x18
cmp eax, edi
je 0x403149
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
call fcn.0043be8d
add esp, 4
cmp eax, edi
je 0x403164
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov esi, eax
jmp 0x403166
xor esi, esi
cmp esi, edi
mov dword [esp + 0x24], 0xffffffff
je 0x403196
push ebx
push esi
call fcn.00405a80
push edi
push edi
push esi
push 0x402540
push edi
push edi
call fcn.0043bc73
add esp, 0x18
cmp eax, edi
je 0x403196
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x405d30
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x405d48
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x405d5d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x405d80
mov eax, dword [ecx]
push eax
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x405d95
cmp eax, 1
jne 0x405d98
mov ecx, dword [ecx]
push ecx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x405dc2
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
pop esi
ret 4
mov eax, 1
pop esi
ret 4
Function at 0x4089e0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408a1c
lea ecx, [esp + 8]
push ecx
push 0x464090
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x408a22
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x408a6f
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0x24
ret
mov al, 1
add esp, 0x24
ret
Function at 0x408a80
Capabilities:
Check if file exists
Enumerate processes
Get file attributes
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x45d572
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0x4b4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0x4cc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4dc]
mov dword [esp + 0x14], 0
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], 0
mov dword [esp + 0x1c], ebp
mov byte [ebp + 4], 0
push 0
mov dword [esp + 0x4d8], 0
push 2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x408cbe
lea eax, [esp + 0x20]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408cb7
jmp 0x408b30
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x464]
push 0x4640b4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x44]
push 0x4640b8
push eax
call fcn.00456b6f
add esp, 8
test eax, eax
je 0x408ba7
lea ecx, [esp + 0x44]
push str.pd.exe
push ecx
call fcn.00456b6f
add esp, 8
test eax, eax
je 0x408ba7
lea edx, [esp + 0x44]
push str.ltm.exe
push edx
call fcn.00456b6f
add esp, 8
test eax, eax
je 0x408ba7
lea eax, [esp + 0x44]
push str.nos.exe
push eax
call fcn.00456b6f
add esp, 8
test eax, eax
jne 0x408ca4
mov ecx, dword [esp + 0x28]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x408c83
push 0x104
lea edx, [esp + 0x35d]
push 0
push edx
mov byte [esp + 0x364], 0
call fcn.0043e300
add esp, 0xc
push 0x104
lea eax, [esp + 0x35c]
push eax
push ebx
call sub.PSAPI.DLL_GetProcessImageFileNameA
mov edi, 0x463cd3
lea esi, [esp + 0x358]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x408c78
push 0x104
push edx
lea eax, [esp + 0x259]
push eax
mov byte [esp + 0x25c], dl
call fcn.0043e300
lea ecx, [esp + 0x25c]
add esp, 0xc
push ecx
lea ecx, [esp + 0x35c]
call fcn.00408710
add esp, 4
lea edx, [esp + 0x250]
push 0x5c
push edx
call fcn.0043be60
add esp, 8
test eax, eax
je 0x408c78
lea ecx, [esp + 0x250]
sub eax, ecx
mov edx, ecx
push eax
push edx
mov ecx, ebp
call fcn.004056b0
push 7
push 0x4640f8
mov eax, ebp
call fcn.00407c90
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov eax, ebp
call fcn.004057b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408cb7
push 0
push 0x463cd3
mov ecx, ebp
call fcn.004056b0
lea eax, [esp + 0x20]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x408b30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x4cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.0043b82a
add esp, 0x4c4
ret
Function at 0x408cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45c8cd
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0x194]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1a4]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edx, 0xf
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x14], ebx
mov dword [esp + 0x28], ebp
mov byte [ebp + 4], bl
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], vtable.CLmMv_struct_ns_config::_tagInterProcessParamEx_.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
mov dword [esp + 0x1b8], eax
push 0x26
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x14], ebx
push str.897184E9_DF31_4542_A244_3CBBA1334575
mov byte [ecx + 4], bl
call fcn.004056b0
lea esi, [esp + 0x30]
call fcn.0041be90
cmp al, bl
je 0x408e30
push 0x5b
lea eax, [esp + 0x31]
push ebx
push eax
mov byte [esp + 0x38], bl
call fcn.0043e300
push 0x104
lea ecx, [esp + 0x98]
push ebx
push ecx
call fcn.0043e300
mov esi, dword [esp + 0x34]
add esp, 0x18
cmp esi, ebx
je 0x408dd3
mov ecx, 0x58
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x88]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408de0
sub eax, edx
push eax
lea edx, [esp + 0x8c]
push edx
mov ecx, ebp
call fcn.004056b0
push 6
push str.SERVER
mov eax, ebp
call fcn.00407c90
cmp dword [ebp + 0x18], 0x10
jb 0x408e14
mov eax, dword [ebp + 4]
jmp 0x408e17
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408e30
push ebx
push 0x463cd3
mov ecx, ebp
call fcn.004056b0
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x408e3f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x408e4e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x194]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.0043b82a
add esp, 0x18c
ret
Function at 0x408e80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x45d876
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
xor ebx, ebx
call fcn.004089e0
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x30]
push eax
call fcn.00408a80
add esp, 4
mov dword [esp + 0xc0], ebx
mov esi, dword [esp + 0x48]
cmp esi, 0x10
mov edi, dword [esp + 0x34]
mov eax, edi
jae 0x408eef
lea eax, [esp + 0x34]
push eax
xor eax, eax
mov ecx, 0x463cd3
call fcn.00401050
add esp, 4
cmp eax, ebx
jne 0x408f55
xor eax, eax
cmp dword [esp + 0x44], ebx
setne al
cmp eax, ebx
jne 0x408f55
lea ecx, [esp + 0x14]
push ecx
call fcn.00408cf0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcc], 1
call fcn.00405fd0
mov byte [esp + 0xc0], bl
cmp dword [esp + 0x2c], 0x10
jb 0x408f4d
mov edx, dword [esp + 0x18]
push edx
call fcn.0043bef7
add esp, 4
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x48]
cmp esi, 0x10
mov eax, edi
jae 0x408f60
lea eax, [esp + 0x34]
push eax
xor eax, eax
mov ecx, 0x463cd3
call fcn.00401050
add esp, 4
cmp eax, ebx
jne 0x408f90
xor eax, eax
cmp dword [esp + 0x44], ebx
setne al
cmp eax, ebx
jne 0x408f90
cmp esi, 0x10
jb 0x409020
push edi
jmp 0x409018
push 0x63
lea eax, [esp + 0x51]
push ebx
push eax
mov byte [esp + 0x58], bl
call fcn.0043e300
add esp, 0xc
cmp esi, 0x10
mov eax, edi
jae 0x408faf
lea eax, [esp + 0x34]
push eax
push 0x63
lea ecx, [esp + 0x54]
push ecx
push 0x463cd3
push 0x464130
push 0x464134
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x4c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408fd3
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
mov ecx, 0x4798fc
call fcn.004056b0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x38]
push eax
mov ecx, 0x47991c
mov dword [0x479918], 0x3ef
call fcn.00405fd0
cmp dword [esp + 0x48], 0x10
mov bl, 1
jb 0x409020
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0043bef7
add esp, 4
mov al, bl
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.0043b82a
add esp, 0xb4
ret