joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457990
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x5c05d4], 0
jne 0x457a7b
cmp dword [esp + 8], 0
je 0x457a7b
push ebx
mov ebx, dword [0x5710e8]
push esi
push edi
mov edi, dword [0x5710ec]
mov esi, 0x5d22d8
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x4579da
push 0
push eax
call edi
test eax, eax
jne 0x4579da
mov eax, dword [esi]
push eax
call ebx
mov dword [esi], 0
add esi, 0x94
cmp esi, 0x5d3558
jl 0x4579c0
xor esi, esi
mov eax, 0x5d22d8
nop
cmp dword [eax], 0
je 0x457a0a
add eax, 0x94
inc esi
cmp eax, 0x5d3558
jl 0x4579f0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, esi
imul eax, eax, 0x94
mov dword [ecx], esi
neg edx
mov dword [eax + 0x5d22e8], ecx
lea ecx, [esp + 0xc]
push ecx
sbb edx, edx
and edx, 4
push edx
lea edi, [eax + 0x5d22d8]
push edi
push 0x457840
push 0
push 0
mov dword [eax + 0x5d2368], 0
mov dword [eax + 0x5d22dc], 1
mov dword [eax + 0x5d22e0], 0
call fcn.0051b444
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x457a02
push 0xffffffffffffffff
push eax
call dword [0x571174]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret
Function at 0x515035
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x7730a0], eax
push eax
mov dword [0x59f674], 1
call fcn.00514b10
add esp, 4
test eax, eax
je 0x515058
push 0x7730a0
push 0
push 0x514ef0
call fcn.0051c8a9
xor ecx, ecx
add esp, 0xc
cmp eax, 0xffffffff
setne cl
mov dword [0x772fc0], ecx
mov eax, dword [0x772fc0]
ret
xor eax, eax
ret
Function at 0x401ce0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401d2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401d24
test esi, esi
je 0x401d24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d00
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402038
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f9e
cmp eax, 4
jne 0x401fc0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401fae
cmp edx, 4
je 0x401fae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f10
Function at 0x401080
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x42819c]
push esi
mov edx, dword [ecx + eax*4 + 0x2c080]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4010af
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x401110
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 8
push esi
push str.Globalwlg_contact
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401288
call fcn.004077d0
call fcn.00407470
push 0
call fcn.0041c4a4
test eax, eax
je 0x401288
push str.CrashRpt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401170
push str.Install
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401170
push 2
call eax
add esp, 4
mov ecx, 0x428198
call fcn.00406890
test eax, eax
je 0x401288
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x42819c]
mov dword [ecx + 0x2c084], eax
mov edx, dword [0x42819c]
lea ecx, [esp + 4]
mov eax, dword [edx + 2]
push eax
push ecx
call fcn.00406dd0
call fcn.00402310
call fcn.00406e80
push str.wlg_minispy
call fcn.00407970
add esp, 0xc
cmp eax, 2
jne 0x4011d1
push str.wlg_minispy
call fcn.00407a30
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x4281d0
call fcn.00415b01
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.HIDEDIR
call fcn.00415dfa
call fcn.00403150
add esp, 8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x4013d0
push 0
push 0
mov dword [0x4281d8], eax
mov dword [0x4281d4], edx
call esi
push 0
push 0
push 0
push 0x4012a0
push 0
push 0
mov dword [0x4281f0], eax
call esi
push 0
push 0
push 0
push 0x4022e0
push 0
push 0
mov dword [0x4281ec], eax
call esi
push 0
push 0
push 0
push 0x402700
push 0
push 0
mov dword [0x4281e8], eax
call esi
mov eax, dword [0x4281d8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 4]
call fcn.00415d8c
xor eax, eax
pop esi
add esp, 8
ret 0x10
Function at 0x401bf0
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x13c
mov eax, dword [0x42819c]
push esi
push edi
push 3
mov dword [eax + 0x345], 0
call fcn.00407860
mov ecx, dword [0x42819c]
add esp, 4
lea edx, [esp + 0x18]
mov dword [ecx + 0x351], eax
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x42819c]
shr eax, 0x14
mov dword [ecx + 0x339], eax
mov edx, dword [esp + 0x24]
mov eax, dword [0x42819c]
push 0x104
shr edx, 0x14
mov dword [eax + 0x33d], edx
mov ecx, dword [0x42819c]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
mov dword [ecx + 0x359], edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
mov byte [esp + 0x53], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0x1e
call fcn.00409ba0
mov edx, dword [0x42819c]
mov ecx, 0x1e
mov dword [edx + 0x331], eax
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00409ba0
mov ecx, dword [0x42819c]
push 0
push 0x64
mov dword [ecx + 0x335], eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [esp + 0x1c]
mov eax, edi
sbb eax, ecx
push eax
push edx
call fcn.00409b60
push edi
push esi
push edx
push eax
call fcn.00409af0
mov ecx, dword [0x42819c]
pop edi
pop esi
mov dword [ecx + 0x355], eax
add esp, 0x13c
ret
Function at 0x401d20
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x41c67b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push esi
mov esi, dword [esp + 0x428]
push edi
mov dword [esi], 0xaabbcc99
call fcn.00407160
mov dword [esi + 8], eax
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004071d0
mov ecx, dword [esp + 0x14]
push 0xc
lea edx, [esi + 0xc]
push ecx
push edx
mov dword [esp + 0x438], 0
call fcn.00409430
add esp, 0x14
push str.2.0.3.0
call sub.WSOCK32.dll_inet_addr
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00414c50
mov ecx, eax
call fcn.00414c92
mov eax, dword [eax]
push 0xa
lea edx, [esi + 0x62]
push eax
push edx
call fcn.00409430
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00415d8c
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x1c]
push 0x1d
lea eax, [esi + 0x19]
push edx
push eax
call fcn.00409430
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov dword [esi + 0x59], eax
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_ctrl.exe
call fcn.00415dfa
call fcn.00401ec0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_pj.exe
mov byte [esi + 0x121], al
call fcn.00415dfa
call fcn.00401ec0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_contact.exe
mov byte [esi + 0x122], al
call fcn.00415dfa
call fcn.00401ec0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_netmon.exe
mov byte [esi + 0x123], al
call fcn.00415dfa
call fcn.00401ec0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_filemon.exe
mov byte [esi + 0x124], al
call fcn.00415dfa
call fcn.00401ec0
add esp, 4
mov byte [esi + 0x125], al
call fcn.00401bf0
lea ecx, [esp + 0xc]
mov dword [esp + 0x424], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 0x41c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x420
ret
Function at 0x401ec0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x41c6a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor ebp, ebp
push ebx
push 2
mov dword [esp + 0x14c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x401f95
mov ecx, dword [0x424ad8]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x148], 1
call fcn.00415ec9
lea ecx, [esp + 0x10]
call fcn.0041612d
lea ecx, [esp + 0x14c]
call fcn.0041612d
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0040952e
add esp, 8
test eax, eax
je 0x401f80
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x144], bl
call fcn.00415d8c
cmp edi, ebx
jne 0x401f0f
jmp 0x401f95
lea ecx, [esp + 0x10]
mov ebp, 1
mov byte [esp + 0x144], bl
call fcn.00415d8c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x402830
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x108
call fcn.00407940
cmp eax, 0x20
jne 0x4028a1
push str.wlgdrv_hook
call fcn.00407a90
mov ecx, esp
mov dword [esp + 4], esp
push str.wlgdrv_hook
call fcn.00415dfa
call fcn.00407bb0
add esp, 4
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.SYSTEMCurrentControlSetServicesWlgdrv_hook
push 0x80000002
call fcn.004080c0
add esp, 0xc
add esp, 0x108
ret

Function at 0x4028b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x424ad8]
mov dword [esp], eax
push str.wlg_minispy
mov dword [esp + 0x10], 0
call fcn.00407a90
add esp, 4
call fcn.00407940
cmp eax, 0x20
jne 0x4028f5
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_32wlg_minispy.inf
jmp 0x4028fa
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_64wlg_minispy.inf
lea ecx, [esp + 4]
call fcn.00415ec9
mov ecx, dword [0x4281d0]
mov edx, dword [esp]
push 0
push ecx
push edx
push str.rundll32.exe
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403150
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c7b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x120], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00409c60
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
mov byte [eax + 1], 0
push edx
call fcn.00415dfa
mov eax, dword [esp + 0x124]
push str.HIDEDIR
push eax
mov byte [esp + 0x124], 2
call fcn.0040952e
add esp, 8
test eax, eax
pop edi
jne 0x403253
push ebx
lea ecx, [esp + 4]
push 1
push ecx
lea ecx, [esp + 0x130]
call fcn.00414eff
mov eax, dword [eax]
push 0x424228
push eax
call fcn.0040952e
add esp, 8
lea ecx, [esp + 4]
test eax, eax
sete bl
call fcn.00415d8c
test bl, bl
pop ebx
je 0x403253
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x124]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 4]
push eax
call fcn.00414f7b
push eax
lea ecx, [esp + 0x128]
mov byte [esp + 0x11c], 3
call fcn.00415e79
lea ecx, [esp]
mov byte [esp + 0x118], 2
call fcn.00415d8c
mov ecx, dword [0x424ad8]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
push eax
lea ecx, [esp + 0x10]
push str.__CMD_s__PARAM_s__
push ecx
mov byte [esp + 0x128], 4
call fcn.0041539b
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp]
push str.wlgdev.exe
push edx
push eax
call fcn.00415f6f
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [eax]
push 0
push ecx
push edx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.00415d8c
lea ecx, [esp + 8]
mov byte [esp + 0x118], 2
call fcn.00415d8c
lea ecx, [esp + 4]
mov byte [esp + 0x118], 1
call fcn.00415d8c
lea ecx, [esp + 0x120]
mov byte [esp + 0x118], 0
call fcn.00415d8c
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x403330
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41c7cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409c60
mov byte [eax + 1], 0
mov edi, str.driverWlgdrv_hook.sys
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.004084c0
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.00408583
pop edi
pop esi
test eax, eax
pop ebp
jne 0x403416
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.004084fd
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x403440
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c7eb
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
call fcn.00407940
mov esi, eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409c60
add esp, 8
cmp esi, 0x20
mov byte [eax + 1], 0
lea edx, [esp + 0x28]
mov edi, str.filter_32wlg_minispy.sys
je 0x4034aa
mov edi, str.filter_64wlg_minispy.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driverswlg_minispy.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.004084c0
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.00408583
pop edi
pop esi
test eax, eax
pop ebp
jne 0x403537
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.004084fd
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x403640
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov edx, ecx
push esi
mov esi, dword [eax + 0x400]
dec ecx
push edi
mov edi, dword [eax + 0x404]
test edx, edx
je 0x4036a7
push ebx
mov ebx, dword [esp + 0x14]
push ebp
lea ebp, [ecx + 1]
inc esi
and esi, 0xff
mov edx, dword [eax + esi*4]
add edi, edx
and edi, 0xff
mov ecx, dword [eax + edi*4]
mov dword [eax + edi*4], edx
mov dword [eax + esi*4], ecx
add cl, dl
mov dl, byte [ebx]
and ecx, 0xff
mov cl, byte [eax + ecx*4]
xor dl, cl
mov byte [ebx], dl
inc ebx
dec ebp
jne 0x403666
pop ebp
mov dword [eax + 0x404], edi
pop ebx
mov dword [eax + 0x400], esi
pop edi
pop esi
ret
mov dword [eax + 0x404], edi
mov dword [eax + 0x400], esi
pop edi
pop esi
ret
Function at 0x404880
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41ca53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x878
push ebp
xor ebp, ebp
lea ecx, [esp + 4]
mov dword [esp + 0x884], ebp
call fcn.004161c3
mov eax, dword [esp + 0x894]
mov ecx, dword [esp + 0x890]
neg eax
sbb eax, eax
push ebp
and al, 0xd0
mov byte [esp + 0x888], 1
add eax, 0x40
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.004162d5
test eax, eax
jne 0x40491c
lea ecx, [esp + 4]
mov byte [esp + 0x884], al
call fcn.00416218
lea ecx, [esp + 0x890]
mov dword [esp + 0x884], 0xffffffff
call fcn.00415d8c
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
add esp, 0x884
ret
push ebx
push esi
push edi
mov ecx, 0x1a
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
call fcn.004165cf
mov ebx, dword [esp + 0x898]
lea edx, [esp + 0x20]
push 0x68
push edx
mov ecx, ebx
mov dword [esp + 0x8c], eax
call fcn.00406bb0
cmp eax, 0x68
jne 0x404998
mov edi, dword [esp + 0x84]
lea eax, [esp + 0x88]
push 0x800
push eax
lea ecx, [esp + 0x18]
call fcn.004163f2
mov esi, eax
test esi, esi
je 0x404998
lea ecx, [esp + 0x88]
push esi
push ecx
mov ecx, ebx
call fcn.00406bb0
cmp eax, esi
jne 0x404998
sub edi, esi
test edi, edi
jg 0x40495d
mov ebp, 1
lea ecx, [esp + 0x10]
call fcn.004164f0
test ebp, ebp
je 0x4049cd
mov eax, dword [esp + 0x89c]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [esp + 0x89c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
lea ecx, [esp + 0x10]
test ebp, ebp
setne al
inc eax
mov byte [esp + 0x890], 0
mov esi, eax
call fcn.00416218
lea ecx, [esp + 0x89c]
mov dword [esp + 0x890], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 0x888]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0x884
ret
Function at 0x405150
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cb01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00414c50
mov ecx, eax
call fcn.00414c92
lea edx, [esp + 0x34]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x34]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x14c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x34]
push 0x5c
push eax
call fcn.00409c60
mov byte [eax + 1], 0
mov edi, str.CapLog__________.idx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.004154ea
lea eax, [esp + 0x1c]
lea edx, [esp + 0x34]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x14c], 1
call fcn.00415dfa
call fcn.004055f0
mov eax, dword [esp + 0x2c]
add esp, 8
xor esi, esi
test eax, eax
jle 0x4052f8
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.00405350
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x148], 2
call fcn.00415b01
call fcn.004057d0
add esp, 4
test eax, eax
je 0x4052e7
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00415b01
lea ecx, [esp + 0x14]
push ecx
call fcn.00405950
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push edx
push eax
call fcn.0040952e
add esp, 0x10
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00415d8c
test bl, bl
je 0x4052e7
push 0
push 0x4246cc
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406f80
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d8c
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jl 0x405236
jmp 0x4052f8
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d8c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x24]
call fcn.0041557d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 0
call fcn.0041551d
lea ecx, [esp + 0x14]
mov dword [esp + 0x140], 0xffffffff
call fcn.00415d8c
mov ecx, dword [esp + 0x138]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret