joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401080
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4280fc]
push esi
mov edx, dword [ecx + eax*4 + 0x2c080]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4010af
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x401110
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 8
push esi
push str.Globalwlg_contact
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401288
call fcn.00407700
call fcn.004073e0
push 0
call fcn.0041c466
test eax, eax
je 0x401288
push str.CrashRpt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401170
push str.Install
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401170
push 2
call eax
add esp, 4
mov ecx, 0x4280f8
call fcn.00406820
test eax, eax
je 0x401288
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4280fc]
mov dword [ecx + 0x2c084], eax
mov edx, dword [0x4280fc]
lea ecx, [esp + 4]
mov eax, dword [edx + 2]
push eax
push ecx
call fcn.00406d40
call fcn.004022f0
call fcn.00406df0
push str.wlg_minispy
call fcn.004078a0
add esp, 0xc
cmp eax, 2
jne 0x4011d1
push str.wlg_minispy
call fcn.00407960
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x428130
call fcn.00415ab1
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.HIDEDIR
call fcn.00415daa
call fcn.00403110
add esp, 8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x4013d0
push 0
push 0
mov dword [0x428138], eax
mov dword [0x428134], edx
call esi
push 0
push 0
push 0
push 0x4012a0
push 0
push 0
mov dword [0x428150], eax
call esi
push 0
push 0
push 0
push 0x4022c0
push 0
push 0
mov dword [0x42814c], eax
call esi
push 0
push 0
push 0
push 0x4026c0
push 0
push 0
mov dword [0x428148], eax
call esi
mov eax, dword [0x428138]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 4]
call fcn.00415d3c
xor eax, eax
pop esi
add esp, 8
ret 0x10
Function at 0x401bb0
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x13c
mov eax, dword [0x4280fc]
push esi
push edi
push 1
mov dword [eax + 0x345], 0
call fcn.00407790
mov ecx, dword [0x4280fc]
push 2
mov dword [ecx + 0x349], eax
call fcn.00407790
mov edx, dword [0x4280fc]
push 3
mov dword [edx + 0x34d], eax
call fcn.00407790
mov ecx, dword [0x4280fc]
add esp, 0xc
lea edx, [esp + 0x18]
mov dword [ecx + 0x351], eax
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4280fc]
shr eax, 0x14
mov dword [ecx + 0x339], eax
mov edx, dword [esp + 0x24]
mov eax, dword [0x4280fc]
push 0x104
shr edx, 0x14
mov dword [eax + 0x33d], edx
mov ecx, dword [0x4280fc]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
mov dword [ecx + 0x359], edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
mov byte [esp + 0x53], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0x1e
call fcn.00409ad0
mov edx, dword [0x4280fc]
mov ecx, 0x1e
mov dword [edx + 0x331], eax
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00409ad0
mov ecx, dword [0x4280fc]
push 0
push 0x64
mov dword [ecx + 0x335], eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [esp + 0x1c]
mov eax, edi
sbb eax, ecx
push eax
push edx
call fcn.00409a90
push edi
push esi
push edx
push eax
call fcn.00409a20
mov ecx, dword [0x4280fc]
pop edi
pop esi
mov dword [ecx + 0x355], eax
add esp, 0x13c
ret
Function at 0x401d00
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x41c63b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push esi
mov esi, dword [esp + 0x428]
push edi
mov dword [esi], 0xaabbcc99
call fcn.004070d0
mov dword [esi + 8], eax
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00407140
mov ecx, dword [esp + 0x14]
push 0xc
lea edx, [esi + 0xc]
push ecx
push edx
mov dword [esp + 0x438], 0
call fcn.00409360
add esp, 0x14
push str.2.0.1.1
call sub.WSOCK32.dll_inet_addr
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00414c00
mov ecx, eax
call fcn.00414c42
mov eax, dword [eax]
push 0xa
lea edx, [esi + 0x62]
push eax
push edx
call fcn.00409360
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00415d3c
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x1c]
push 0x1d
lea eax, [esi + 0x19]
push edx
push eax
call fcn.00409360
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov dword [esi + 0x59], eax
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_ctrl.exe
call fcn.00415daa
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_pj.exe
mov byte [esi + 0x121], al
call fcn.00415daa
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_contact.exe
mov byte [esi + 0x122], al
call fcn.00415daa
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_netmon.exe
mov byte [esi + 0x123], al
call fcn.00415daa
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_filemon.exe
mov byte [esi + 0x124], al
call fcn.00415daa
call fcn.00401ea0
add esp, 4
mov byte [esi + 0x125], al
call fcn.00401bb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x424], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x41c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x420
ret
Function at 0x401ea0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x41c663
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor ebp, ebp
push ebx
push 2
mov dword [esp + 0x14c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x401f75
mov ecx, dword [0x424a3c]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x148], 1
call fcn.00415e79
lea ecx, [esp + 0x10]
call fcn.004160ef
lea ecx, [esp + 0x14c]
call fcn.004160ef
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0040945e
add esp, 8
test eax, eax
je 0x401f60
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x144], bl
call fcn.00415d3c
cmp edi, ebx
jne 0x401eef
jmp 0x401f75
lea ecx, [esp + 0x10]
mov ebp, 1
mov byte [esp + 0x144], bl
call fcn.00415d3c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x4027f0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x108
call fcn.00407870
cmp eax, 0x20
jne 0x402861
push str.wlgdrv_hook
call fcn.004079c0
mov ecx, esp
mov dword [esp + 4], esp
push str.wlgdrv_hook
call fcn.00415daa
call fcn.00407ae0
add esp, 4
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.SYSTEMCurrentControlSetServicesWlgdrv_hook
push reloc.WSOCK32.dll_bind
call fcn.00407ff0
add esp, 0xc
add esp, 0x108
ret

Function at 0x402870
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c6e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x424a3c]
mov dword [esp], eax
push str.wlg_minispy
mov dword [esp + 0x10], 0
call fcn.004079c0
add esp, 4
call fcn.00407870
cmp eax, 0x20
jne 0x4028b5
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_32wlg_minispy.inf
jmp 0x4028ba
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_64wlg_minispy.inf
lea ecx, [esp + 4]
call fcn.00415e79
mov ecx, dword [0x428130]
mov edx, dword [esp]
push 0
push ecx
push edx
push str.rundll32.exe
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403110
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c771
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x120], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00409b90
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
mov byte [eax + 1], 0
push edx
call fcn.00415daa
mov eax, dword [esp + 0x124]
push str.HIDEDIR
push eax
mov byte [esp + 0x124], 2
call fcn.0040945e
add esp, 8
test eax, eax
pop edi
jne 0x403213
push ebx
lea ecx, [esp + 4]
push 1
push ecx
lea ecx, [esp + 0x130]
call fcn.00414eaf
mov eax, dword [eax]
push 0x424200
push eax
call fcn.0040945e
add esp, 8
lea ecx, [esp + 4]
test eax, eax
sete bl
call fcn.00415d3c
test bl, bl
pop ebx
je 0x403213
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x124]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 4]
push eax
call fcn.00414f2b
push eax
lea ecx, [esp + 0x128]
mov byte [esp + 0x11c], 3
call fcn.00415e29
lea ecx, [esp]
mov byte [esp + 0x118], 2
call fcn.00415d3c
mov ecx, dword [0x424a3c]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
push eax
lea ecx, [esp + 0x10]
push str.__CMD_s__PARAM_s__
push ecx
mov byte [esp + 0x128], 4
call fcn.0041534b
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp]
push str.wlgdev.exe
push edx
push eax
call fcn.00415f1f
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [eax]
push 0
push ecx
push edx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.00415d3c
lea ecx, [esp + 8]
mov byte [esp + 0x118], 2
call fcn.00415d3c
lea ecx, [esp + 4]
mov byte [esp + 0x118], 1
call fcn.00415d3c
lea ecx, [esp + 0x120]
mov byte [esp + 0x118], 0
call fcn.00415d3c
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x4032f0
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41c78b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409b90
mov byte [eax + 1], 0
mov edi, str.driverWlgdrv_hook.sys
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.004083ef
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.004084b2
pop edi
pop esi
test eax, eax
pop ebp
jne 0x4033d6
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.0040842c
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x403400
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c7ab
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
call fcn.00407870
mov esi, eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409b90
add esp, 8
cmp esi, 0x20
mov byte [eax + 1], 0
lea edx, [esp + 0x28]
mov edi, str.filter_32wlg_minispy.sys
je 0x40346a
mov edi, str.filter_64wlg_minispy.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driverswlg_minispy.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.004083ef
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.004084b2
pop edi
pop esi
test eax, eax
pop ebp
jne 0x4034f7
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.0040842c
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x403600
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov edx, ecx
push esi
mov esi, dword [eax + 0x400]
dec ecx
push edi
mov edi, dword [eax + 0x404]
test edx, edx
je 0x403667
push ebx
mov ebx, dword [esp + 0x14]
push ebp
lea ebp, [ecx + 1]
inc esi
and esi, 0xff
mov edx, dword [eax + esi*4]
add edi, edx
and edi, 0xff
mov ecx, dword [eax + edi*4]
mov dword [eax + edi*4], edx
mov dword [eax + esi*4], ecx
add cl, dl
mov dl, byte [ebx]
and ecx, 0xff
mov cl, byte [eax + ecx*4]
xor dl, cl
mov byte [ebx], dl
inc ebx
dec ebp
jne 0x403626
pop ebp
mov dword [eax + 0x404], edi
pop ebx
mov dword [eax + 0x400], esi
pop edi
pop esi
ret
mov dword [eax + 0x404], edi
mov dword [eax + 0x400], esi
pop edi
pop esi
ret
Function at 0x404840
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41ca13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x878
push ebp
xor ebp, ebp
lea ecx, [esp + 4]
mov dword [esp + 0x884], ebp
call fcn.00416185
mov eax, dword [esp + 0x894]
mov ecx, dword [esp + 0x890]
neg eax
sbb eax, eax
push ebp
and al, 0xd0
mov byte [esp + 0x888], 1
add eax, 0x40
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.00416297
test eax, eax
jne 0x4048dc
lea ecx, [esp + 4]
mov byte [esp + 0x884], al
call fcn.004161da
lea ecx, [esp + 0x890]
mov dword [esp + 0x884], 0xffffffff
call fcn.00415d3c
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
add esp, 0x884
ret
push ebx
push esi
push edi
mov ecx, 0x1a
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
call fcn.00416591
mov ebx, dword [esp + 0x898]
lea edx, [esp + 0x20]
push 0x68
push edx
mov ecx, ebx
mov dword [esp + 0x8c], eax
call fcn.00406b20
cmp eax, 0x68
jne 0x404958
mov edi, dword [esp + 0x84]
lea eax, [esp + 0x88]
push 0x800
push eax
lea ecx, [esp + 0x18]
call fcn.004163b4
mov esi, eax
test esi, esi
je 0x404958
lea ecx, [esp + 0x88]
push esi
push ecx
mov ecx, ebx
call fcn.00406b20
cmp eax, esi
jne 0x404958
sub edi, esi
test edi, edi
jg 0x40491d
mov ebp, 1
lea ecx, [esp + 0x10]
call fcn.004164b2
test ebp, ebp
je 0x40498d
mov eax, dword [esp + 0x89c]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [esp + 0x89c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
lea ecx, [esp + 0x10]
test ebp, ebp
setne al
inc eax
mov byte [esp + 0x890], 0
mov esi, eax
call fcn.004161da
lea ecx, [esp + 0x89c]
mov dword [esp + 0x890], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x888]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0x884
ret
Function at 0x4050a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cac1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00414c00
mov ecx, eax
call fcn.00414c42
lea edx, [esp + 0x34]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x34]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x14c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x34]
push 0x5c
push eax
call fcn.00409b90
mov byte [eax + 1], 0
mov edi, str.CapLog__________.idx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.0041549a
lea eax, [esp + 0x1c]
lea edx, [esp + 0x34]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x14c], 1
call fcn.00415daa
call fcn.00405540
mov eax, dword [esp + 0x2c]
add esp, 8
xor esi, esi
test eax, eax
jle 0x405248
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.004052a0
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x148], 2
call fcn.00415ab1
call fcn.00405720
add esp, 4
test eax, eax
je 0x405237
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00415ab1
lea ecx, [esp + 0x14]
push ecx
call fcn.004058e0
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push edx
push eax
call fcn.0040945e
add esp, 0x10
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00415d3c
test bl, bl
je 0x405237
push 0
push 0x42466c
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406ef0
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d3c
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jl 0x405186
jmp 0x405248
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d3c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x24]
call fcn.0041552d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 0
call fcn.004154cd
lea ecx, [esp + 0x14]
mov dword [esp + 0x140], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x138]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret
Function at 0x405720
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cb73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d4
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1e8], ebx
call fcn.00416185
mov eax, dword [esp + 0x1f0]
push ebx
push 0x40
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1f4], 1
call fcn.00416297
test eax, eax
je 0x4057e6
push ebx
push 0x42466c
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406e50
mov esi, eax
add esp, 0x10
lea eax, [esi + esi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
lea edi, [esi + ecx*2]
lea ecx, [esp + 0xc]
call fcn.00416591
cmp eax, edi
lea ecx, [esp + 0xc]
jae 0x4057d4
call fcn.004164b2
mov edx, dword [esp + 0x1f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0x42466c
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406ef0
add esp, 0x10
jmp 0x4057e6
call fcn.00416591
cmp eax, edi
jne 0x405817
lea ecx, [esp + 0xc]
call fcn.004164b2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1e8], bl
call fcn.004161da
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x1e8], 0xffffffff
call fcn.00415d3c
mov eax, 1
jmp 0x4058c1
push ebp
cmp esi, ebx
mov ebp, 1
jle 0x40582c
push ebx
push edi
lea ecx, [esp + 0x18]
call fcn.00416439
lea eax, [esp + 0x20]
push 0x1c3
push eax
lea ecx, [esp + 0x18]
call fcn.004163b4
cmp eax, 0x1c3
jne 0x40588e
lea ecx, [esp + 0x20]
push ecx
call fcn.00404db0
add esp, 4
cmp eax, ebx
je 0x40588c
inc esi
push esi
push 0x42466c
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406ef0
add esp, 0x10
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
push 0x1c3
push edx
call fcn.004163b4
cmp eax, 0x1c3
je 0x405846
jmp 0x40588e
xor ebp, ebp
lea ecx, [esp + 0x10]
call fcn.004164b2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ec], bl
call fcn.004161da
lea ecx, [esp + 0x1f4]
mov dword [esp + 0x1ec], 0xffffffff
call fcn.00415d3c
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1e0
ret
Function at 0x405d50
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cc01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push str._Y__m__d
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00414c00
mov ecx, eax
call fcn.00414c42
lea edx, [esp + 0x30]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x148], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x30]
push 0x5c
push eax
call fcn.00409b90
mov byte [eax + 1], 0
mov edi, str.CapLog_fileop_
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x30]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.__________.txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.0041549a
lea eax, [esp + 0x14]
lea edx, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [esp + 0x148], 1
call fcn.00415daa
call fcn.00405540
mov eax, dword [esp + 0x24]
add esp, 8
xor esi, esi
test eax, eax
jle 0x405ed4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 2
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.004052a0
mov ecx, dword [esp + 0x1c]
xor edx, edx
dec ecx
lea eax, [esp + 0xc]
cmp esi, ecx
mov byte [esp + 0x13c], bl
sete dl
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00415ab1
call fcn.00405f20
add esp, 8
test eax, eax
je 0x405ec3
mov ecx, dword [esp + 0xc]
push ecx
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x13c], 1
call fcn.00415d3c
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x405e60
jmp 0x405ed4
lea ecx, [esp + 0xc]
mov byte [esp + 0x13c], 1
call fcn.00415d3c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call fcn.0041552d
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 0
call fcn.004154cd
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00415d3c
mov ecx, dword [esp + 0x134]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x134
ret