joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4081d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c14a
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x484], 0
lea ecx, [ebp - 0x480]
call fcn.004021a0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40824a
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x480]
call fcn.00402300
jmp 0x4082a6
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.0055ceb0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 3
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x480]
call fcn.00402790
mov ecx, eax
call fcn.004129c0
push 0x5d95a4
lea ecx, [ebp - 0x480]
call fcn.00402330
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402400
mov ecx, dword [ebp - 0x484]
or ecx, 1
mov dword [ebp - 0x484], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x480]
call fcn.00402230
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 4
Function at 0x409510
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c3d9
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x16c], ecx
push 0xffffffffffffffff
push str..log.
mov ecx, dword [ebp + 8]
call fcn.00402790
mov ecx, eax
call fcn.00412b10
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x409770
lea ecx, [ebp - 0xe8]
call fcn.004021a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14c]
push eax
push 0
lea ecx, [ebp - 0x88]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402790
mov ecx, eax
call fcn.00412b40
mov dword [ebp - 0x158], eax
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x168], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x168]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004025e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.0042d070
lea ecx, [ebp - 0x70]
call fcn.004021a0
mov byte [ebp - 4], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, 0x61435c
call fcn.00404eb0
lea ecx, [ebp - 0x70]
call fcn.00402790
mov ecx, eax
call fcn.00412ab0
movzx eax, al
test eax, eax
jne 0x409752
push 0
push 0
push 0x5d9814
lea ecx, [ebp - 0x70]
call fcn.00402ee0
push 0
push 0
push 0x5d9818
lea ecx, [ebp - 0x70]
call fcn.00402ee0
push 0
push 0
push 0x5d981c
lea ecx, [ebp - 0x70]
call fcn.00402ee0
lea ecx, [ebp - 0x70]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
push 0x5d9820
lea ecx, [ebp - 0x148]
push ecx
push 0x614354
call fcn.00411a20
add esp, 0x10
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x154]
mov dword [ebp - 0x150], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004024d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x148]
call fcn.00402230
lea ecx, [ebp - 0xe8]
call fcn.00402620
push eax
mov ecx, dword [ebp + 8]
call fcn.00402620
push eax
call fcn.00559074
add esp, 8
test eax, eax
jne 0x4096d7
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004024a0
jmp 0x409752
push 0x5d9880
push 0
push 3
lea edx, [ebp - 0x178]
push edx
call fcn.00406240
mov ecx, dword [eax]
mov dword [ebp - 0x164], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x160], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x15c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
lea ecx, [ebp - 0xe8]
call fcn.004026d0
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.004026d0
push eax
push str._t_trename__s___s_failed_err_lu.
sub esp, 0xc
mov ecx, esp
mov edx, dword [ebp - 0x164]
mov dword [ecx], edx
mov eax, dword [ebp - 0x160]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x15c]
mov dword [ecx + 8], edx
call fcn.00405320
add esp, 0x1c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00402230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00402230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 8
Function at 0x40a190
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c4f3
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp + 8]
call fcn.004151f0
cmp eax, dword [ebp + 0xc]
jae 0x40a1d3
jmp 0x40a33d
lea ecx, [ebp - 0x88]
call fcn.004139f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.004151f0
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], 0
jmp 0x40a202
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
cmp ecx, dword [ebp - 0x80]
jge 0x40a29a
lea ecx, [ebp - 0x70]
call fcn.004021a0
mov byte [ebp - 4], 1
push 0
push 0
push 0
lea edx, [ebp - 0x70]
push edx
push 0
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [ebp + 8]
call fcn.00415210
push eax
mov ecx, 0x61435c
call fcn.00404eb0
lea ecx, [ebp - 0x70]
call fcn.00402620
push eax
mov ecx, 0x614354
call fcn.00410d90
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], edx
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0xb4]
push eax
call fcn.0041fd50
add esp, 0xc
push eax
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x88]
call fcn.0041fd80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00402230
jmp 0x40a1f9
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x78], 0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x88]
call fcn.004130a0
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x88]
call fcn.004130d0
push eax
lea ecx, [ebp - 0x7c]
call fcn.00413900
movzx edx, al
test edx, edx
je 0x40a32b
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x8c]
jge 0x40a30d
lea ecx, [ebp - 0x7c]
call fcn.00415110
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415210
mov ecx, eax
call fcn.00402620
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40a30f
jmp 0x40a32b
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
push 0
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00415340
jmp 0x40a2bc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00409250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 8
Function at 0x40a3b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
call fcn.0042e430
push eax
push str.CDebugLog::WriteConf_text_s
lea eax, [ebp - 0x1c]
push eax
push 0x614354
call fcn.00411ac0
add esp, 0x10
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.0042e430
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x1c]
call fcn.0042e450
push 0
mov ecx, dword [ebp + 8]
call fcn.0042e430
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x268
push ecx
mov ecx, 0x61435c
call fcn.004049f0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x41c
call fcn.0042e350
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 4
Function at 0x40a870
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c588
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
cmp dword [ebp + 8], 1
jl 0x40a8c2
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x414]
jge 0x40a8c2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x74]
mov dword [eax + edx*4 + 0x3ec], 1
jmp 0x40a901
mov ecx, dword [ebp + 8]
push ecx
push str.CDebugLog_SetFilterLevelArray
lea edx, [ebp - 0x70]
push edx
push 0x614354
call fcn.00411a20
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00402620
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00402230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 4
Function at 0x40b260
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0x400
call fcn.00443350
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b2f2
mov dword [ebp - 0x18], 0xedb88320
mov dword [ebp - 8], 0
jmp 0x40b29e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x100
jge 0x40b2f2
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 8
jmp 0x40b2bf
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x40b2e4
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x40b2da
mov edx, dword [ebp - 4]
shr edx, 1
xor edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
jmp 0x40b2e2
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
jmp 0x40b2b6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov dword [edx + ecx*4], eax
jmp 0x40b295
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40bd30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bdbd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40bdb1
push 0x5de370
push 2
push 3
lea ecx, [ebp - 0x30]
push ecx
call fcn.00406240
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tasp::library_TerminateProcess_err:_lu
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
call fcn.00405320
add esp, 0x14
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40be0a
push 0x5de420
push 2
push 3
lea eax, [ebp - 0x3c]
push eax
call fcn.00406240
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tasp::library_OpenProcess_err:_lu
sub esp, 0xc
mov ecx, esp
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 8], edx
call fcn.00405320
add esp, 0x14
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40be20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040bfc0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bfb2
push 0x44
push 0
lea edx, [ebp - 0x9c]
push edx
call fcn.0055ceb0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x9c], 0x44
mov dword [ebp - 0x94], str.WinSta0Default
mov ecx, 1
mov word [ebp - 0x6c], cx
mov dword [ebp - 0x40], 0
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x40beaf
mov dword [ebp - 0xc], 0x8000420
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x9c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bf51
push 0x5de608
push 2
push 1
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00406240
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x18], edx
push str._tasp::library_CreateProcessAsUser_sucess_n
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
call fcn.00405320
add esp, 0x10
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x40bf45
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x40bf4f
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40bf9e
push 0x5de660
push 2
push 3
lea eax, [ebp - 0x58]
push eax
call fcn.00406240
mov ecx, dword [eax]
mov dword [ebp - 0x3c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tasp::library_CreateProcessAsUser_error_d_n
sub esp, 0xc
mov ecx, esp
mov edx, dword [ebp - 0x3c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x38]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x34]
mov dword [ecx + 8], edx
call fcn.00405320
add esp, 0x14
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40c370
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c6bb
mov eax, dword fs:[0]
push eax
mov eax, 0x105c
call fcn.0055d030
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1058], ecx
mov dword [ebp - 0x1034], 0
lea ecx, [ebp - 0x1028]
call fcn.0042d270
mov dword [ebp - 4], 0
mov dword [ebp - 0x103c], 0
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x1038], 0
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x1030]
push ecx
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
mov dword [ebp - 0x102c], 0
jmp 0x40c41e
mov edx, dword [ebp - 0x102c]
add edx, 1
mov dword [ebp - 0x102c], edx
mov eax, dword [ebp - 0x102c]
cmp eax, dword [ebp - 0x1038]
jae 0x40c567
mov ecx, dword [ebp - 0x102c]
shl ecx, 4
mov edx, dword [ebp - 0x1030]
mov eax, dword [edx + ecx + 4]
cmp eax, dword [ebp + 0xc]
jne 0x40c562
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1054], 0x3ff
mov dword [ebp - 0x1050], 0x3ff
push 0x800
push 0
lea ecx, [ebp - 0x1010]
push ecx
call fcn.0055ceb0
add esp, 0xc
push 0x800
push 0
lea edx, [ebp - 0x810]
push edx
call fcn.0055ceb0
add esp, 0xc
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1054]
push ecx
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x102c]
shl edx, 4
mov eax, dword [ebp - 0x1030]
mov ecx, dword [eax + edx + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0x1028]
call fcn.00412960
lea ecx, [ebp - 0x1028]
call fcn.00412ab0
movzx eax, al
test eax, eax
jne 0x40c505
mov dword [ebp - 0x103c], 1
jmp 0x40c560
push 0x5de8f8
push 2
push 3
lea ecx, [ebp - 0x1068]
push ecx
call fcn.00406240
mov edx, dword [eax]
mov dword [ebp - 0x1048], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1044], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x1040], edx
push str._tasp::library_WTSEnumerateProcessesW_AccountNameNULL._n
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x1048]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1044]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1040]
mov dword [eax + 8], ecx
call fcn.00405320
add esp, 0x10
jmp 0x40c567
jmp 0x40c40f
cmp dword [ebp - 0x1030], 0
je 0x40c57d
mov edx, dword [ebp - 0x1030]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp + 8]
call fcn.0042c920
mov ecx, dword [ebp - 0x1034]
or ecx, 1
mov dword [ebp - 0x1034], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1028]
call fcn.0042d070
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 8
Function at 0x40d270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c83b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 4], 0
push 0x6c
call fcn.00443323
add esp, 4
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x7c], 0
je 0x40d2cf
mov ecx, dword [ebp - 0x7c]
call fcn.0040d3e0
mov dword [ebp - 0x84], eax
jmp 0x40d2d9
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp + 0x24]
mov dword [ecx + 4], edx
push 0
lea ecx, [ebp + 0xc]
call fcn.0042e430
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x614354
call fcn.00411450
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x94]
push edx
mov ecx, dword [ebp - 0x74]
add ecx, 8
call fcn.004024a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00402230
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 0x28]
mov dword [eax + 0x68], ecx
push 0
push 0
mov edx, dword [ebp - 0x74]
push edx
push 0x40d190
push 0
push 0
call fcn.0055b9cd
add esp, 0x18
mov dword [ebp - 0x78], eax
cmp dword [ebp + 0x2c], 0
je 0x40d385
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
jmp 0x40d38f
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], 0
je 0x40d39e
mov dword [ebp - 0x80], 1
jmp 0x40d3a5
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0042e450
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 0x28
Function at 0x411ed0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cff9
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x608190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x168], ecx
push str._:
lea ecx, [ebp - 0x88]
call fcn.00402270
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.00402790
mov ecx, eax
call fcn.00412790
mov dword [ebp - 0x158], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00402400
mov byte [ebp - 4], 1
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x150], 0
mov ecx, dword [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x88]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
lea ecx, [ebp - 0xe8]
call fcn.00402790
mov ecx, eax
call fcn.00412ae0
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x412042
mov edx, dword [ebp - 0x14c]
push edx
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00402790
mov ecx, eax
call fcn.00412b40
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x148]
call fcn.00402550
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0042d070
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x158]
mov dword [ebp - 0x150], eax
push 0
lea ecx, [ebp - 0x148]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41202e
mov dword [ebp - 0x154], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.00402230
jmp 0x411f61
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x160], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe8]
call fcn.00402230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00402230
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00558807
mov esp, ebp
pop ebp
ret 4
Function at 0x412090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58d056
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x608190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 3
cmp dword [ebp + 0x128], 0
jne 0x412110
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00402230
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x68]
call fcn.00402230
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc8]
call fcn.00402230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x12c]
call fcn.00402230
mov eax, dword [ebp - 0x1c]
jmp 0x41225c
push 0x5e0e64
mov ecx, dword [ebp + 0x128]
call fcn.00402300
mov dword [ebp - 0x10], 0x80
mov eax, 1
test eax, eax
je 0x41220b
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00443350
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0x12c]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp + 0xc8]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
lea ecx, [ebp + 0x68]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
lea ecx, [ebp + 8]
call fcn.00402790
mov ecx, eax
call fcn.0042e3d0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 1
cmp dword [ebp - 0x10], eax
jne 0x4121d7
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00443359
add esp, 4
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
jmp 0x412206
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x128]
call fcn.00402300
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.00443359
add esp, 4
jmp 0x41220b
jmp 0x412127
mov ecx, dword [ebp + 0x128]
call fcn.00402790
mov ecx, eax
call fcn.00412790
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00402230
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x68]
call fcn.00402230
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc8]
call fcn.00402230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x12c]
call fcn.00402230
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x184