joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bd0
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x13c
mov eax, dword [0x42812c]
push esi
push edi
push 3
mov dword [eax + 0x345], 0
call fcn.004077e0
mov ecx, dword [0x42812c]
add esp, 4
lea edx, [esp + 0x18]
mov dword [ecx + 0x351], eax
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x42812c]
shr eax, 0x14
mov dword [ecx + 0x339], eax
mov edx, dword [esp + 0x24]
mov eax, dword [0x42812c]
push 0x104
shr edx, 0x14
mov dword [eax + 0x33d], edx
mov ecx, dword [0x42812c]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
mov dword [ecx + 0x359], edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
mov byte [esp + 0x53], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0x1e
call fcn.00409b20
mov edx, dword [0x42812c]
mov ecx, 0x1e
mov dword [edx + 0x331], eax
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00409b20
mov ecx, dword [0x42812c]
push 0
push 0x64
mov dword [ecx + 0x335], eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, esi
sub edx, edi
mov edi, dword [esp + 0x1c]
mov eax, edi
sbb eax, ecx
push eax
push edx
call fcn.00409ae0
push edi
push esi
push edx
push eax
call fcn.00409a70
mov ecx, dword [0x42812c]
pop edi
pop esi
mov dword [ecx + 0x355], eax
add esp, 0x13c
ret
Function at 0x401d00
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x41c5fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push esi
mov esi, dword [esp + 0x428]
push edi
mov dword [esi], 0xaabbcc99
call fcn.004070f0
mov dword [esi + 8], eax
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00407160
mov ecx, dword [esp + 0x14]
push 0xc
lea edx, [esi + 0xc]
push ecx
push edx
mov dword [esp + 0x438], 0
call fcn.004093b0
add esp, 0x14
push str.2.0.2.2
call sub.WSOCK32.dll_inet_addr
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00414bd0
mov ecx, eax
call fcn.00414c12
mov eax, dword [eax]
push 0xa
lea edx, [esi + 0x62]
push eax
push edx
call fcn.004093b0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00415d0c
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x1c]
push 0x1d
lea eax, [esi + 0x19]
push edx
push eax
call fcn.004093b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov dword [esi + 0x59], eax
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_ctrl.exe
call fcn.00415d7a
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_pj.exe
mov byte [esi + 0x121], al
call fcn.00415d7a
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_contact.exe
mov byte [esi + 0x122], al
call fcn.00415d7a
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_netmon.exe
mov byte [esi + 0x123], al
call fcn.00415d7a
call fcn.00401ea0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.wlg_filemon.exe
mov byte [esi + 0x124], al
call fcn.00415d7a
call fcn.00401ea0
add esp, 4
mov byte [esi + 0x125], al
call fcn.00401bd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x424], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x41c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x420
ret
Function at 0x401ea0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x41c623
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor ebp, ebp
push ebx
push 2
mov dword [esp + 0x14c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x401f75
mov ecx, dword [0x424a70]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x148], 1
call fcn.00415e49
lea ecx, [esp + 0x10]
call fcn.004160ad
lea ecx, [esp + 0x14c]
call fcn.004160ad
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004094ae
add esp, 8
test eax, eax
je 0x401f60
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x144], bl
call fcn.00415d0c
cmp edi, ebx
jne 0x401eef
jmp 0x401f75
lea ecx, [esp + 0x10]
mov ebp, 1
mov byte [esp + 0x144], bl
call fcn.00415d0c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x402810
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x108
call fcn.004078c0
cmp eax, 0x20
jne 0x402881
push str.wlgdrv_hook
call fcn.00407a10
mov ecx, esp
mov dword [esp + 4], esp
push str.wlgdrv_hook
call fcn.00415d7a
call fcn.00407b30
add esp, 4
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.SYSTEMCurrentControlSetServicesWlgdrv_hook
push reloc.WSOCK32.dll_bind
call fcn.00408040
add esp, 0xc
add esp, 0x108
ret

Function at 0x402890
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c6a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x424a70]
mov dword [esp], eax
push str.wlg_minispy
mov dword [esp + 0x10], 0
call fcn.00407a10
add esp, 4
call fcn.004078c0
cmp eax, 0x20
jne 0x4028d5
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_32wlg_minispy.inf
jmp 0x4028da
push str.setupapi_InstallHinfSection_DefaultUninstall_132_._filter_64wlg_minispy.inf
lea ecx, [esp + 4]
call fcn.00415e49
mov ecx, dword [0x428160]
mov edx, dword [esp]
push 0
push ecx
push edx
push str.rundll32.exe
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403130
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c731
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x120], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00409be0
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
mov byte [eax + 1], 0
push edx
call fcn.00415d7a
mov eax, dword [esp + 0x124]
push str.HIDEDIR
push eax
mov byte [esp + 0x124], 2
call fcn.004094ae
add esp, 8
test eax, eax
pop edi
jne 0x403233
push ebx
lea ecx, [esp + 4]
push 1
push ecx
lea ecx, [esp + 0x130]
call fcn.00414e7f
mov eax, dword [eax]
push 0x424218
push eax
call fcn.004094ae
add esp, 8
lea ecx, [esp + 4]
test eax, eax
sete bl
call fcn.00415d0c
test bl, bl
pop ebx
je 0x403233
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x124]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 4]
push eax
call fcn.00414efb
push eax
lea ecx, [esp + 0x128]
mov byte [esp + 0x11c], 3
call fcn.00415df9
lea ecx, [esp]
mov byte [esp + 0x118], 2
call fcn.00415d0c
mov ecx, dword [0x424a70]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
push eax
lea ecx, [esp + 0x10]
push str.__CMD_s__PARAM_s__
push ecx
mov byte [esp + 0x128], 4
call fcn.0041531b
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp]
push str.wlgdev.exe
push edx
push eax
call fcn.00415eef
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [eax]
push 0
push ecx
push edx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp]
call fcn.00415d0c
lea ecx, [esp + 8]
mov byte [esp + 0x118], 2
call fcn.00415d0c
lea ecx, [esp + 4]
mov byte [esp + 0x118], 1
call fcn.00415d0c
lea ecx, [esp + 0x120]
mov byte [esp + 0x118], 0
call fcn.00415d0c
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x403310
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41c74b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409be0
mov byte [eax + 1], 0
mov edi, str.driverWlgdrv_hook.sys
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driversWlgdrv_hook.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.00408440
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.00408503
pop edi
pop esi
test eax, eax
pop ebp
jne 0x4033f6
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.0040847d
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x403420
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c76b
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
call fcn.004078c0
mov esi, eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.00409be0
add esp, 8
cmp esi, 0x20
mov byte [eax + 1], 0
lea edx, [esp + 0x28]
mov edi, str.filter_32wlg_minispy.sys
je 0x40348a
mov edi, str.filter_64wlg_minispy.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x12c]
push str.driverswlg_minispy.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
call fcn.00408440
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call fcn.00408503
pop edi
pop esi
test eax, eax
pop ebp
jne 0x403517
push eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp]
mov dword [esp + 0x22c], 0xffffffff
call fcn.0040847d
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x404860
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41c9d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x878
push ebp
xor ebp, ebp
lea ecx, [esp + 4]
mov dword [esp + 0x884], ebp
call fcn.00416143
mov eax, dword [esp + 0x894]
mov ecx, dword [esp + 0x890]
neg eax
sbb eax, eax
push ebp
and al, 0xd0
mov byte [esp + 0x888], 1
add eax, 0x40
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.00416255
test eax, eax
jne 0x4048fc
lea ecx, [esp + 4]
mov byte [esp + 0x884], al
call fcn.00416198
lea ecx, [esp + 0x890]
mov dword [esp + 0x884], 0xffffffff
call fcn.00415d0c
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
add esp, 0x884
ret
push ebx
push esi
push edi
mov ecx, 0x1a
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
call fcn.0041654f
mov ebx, dword [esp + 0x898]
lea edx, [esp + 0x20]
push 0x68
push edx
mov ecx, ebx
mov dword [esp + 0x8c], eax
call fcn.00406b40
cmp eax, 0x68
jne 0x404978
mov edi, dword [esp + 0x84]
lea eax, [esp + 0x88]
push 0x800
push eax
lea ecx, [esp + 0x18]
call fcn.00416372
mov esi, eax
test esi, esi
je 0x404978
lea ecx, [esp + 0x88]
push esi
push ecx
mov ecx, ebx
call fcn.00406b40
cmp eax, esi
jne 0x404978
sub edi, esi
test edi, edi
jg 0x40493d
mov ebp, 1
lea ecx, [esp + 0x10]
call fcn.00416470
test ebp, ebp
je 0x4049ad
mov eax, dword [esp + 0x89c]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [esp + 0x89c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
lea ecx, [esp + 0x10]
test ebp, ebp
setne al
inc eax
mov byte [esp + 0x890], 0
mov esi, eax
call fcn.00416198
lea ecx, [esp + 0x89c]
mov dword [esp + 0x890], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x888]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0x884
ret
Function at 0x4050c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41ca81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push str._Y__m__d
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00414bd0
mov ecx, eax
call fcn.00414c12
lea edx, [esp + 0x34]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x34]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x14c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x34]
push 0x5c
push eax
call fcn.00409be0
mov byte [eax + 1], 0
mov edi, str.CapLog__________.idx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.0041546a
lea eax, [esp + 0x1c]
lea edx, [esp + 0x34]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x14c], 1
call fcn.00415d7a
call fcn.00405560
mov eax, dword [esp + 0x2c]
add esp, 8
xor esi, esi
test eax, eax
jle 0x405268
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.004052c0
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x148], 2
call fcn.00415a81
call fcn.00405740
add esp, 4
test eax, eax
je 0x405257
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00415a81
lea ecx, [esp + 0x14]
push ecx
call fcn.00405900
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push edx
push eax
call fcn.004094ae
add esp, 0x10
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00415d0c
test bl, bl
je 0x405257
push 0
push 0x424694
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406f10
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d0c
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jl 0x4051a6
jmp 0x405268
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], 1
call fcn.00415d0c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x24]
call fcn.004154fd
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 0
call fcn.0041549d
lea ecx, [esp + 0x14]
mov dword [esp + 0x140], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x138]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret
Function at 0x405740
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cb33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d4
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1e8], ebx
call fcn.00416143
mov eax, dword [esp + 0x1f0]
push ebx
push 0x40
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1f4], 1
call fcn.00416255
test eax, eax
je 0x405806
push ebx
push 0x424694
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406e70
mov esi, eax
add esp, 0x10
lea eax, [esi + esi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
lea edi, [esi + ecx*2]
lea ecx, [esp + 0xc]
call fcn.0041654f
cmp eax, edi
lea ecx, [esp + 0xc]
jae 0x4057f4
call fcn.00416470
mov edx, dword [esp + 0x1f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0x424694
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406f10
add esp, 0x10
jmp 0x405806
call fcn.0041654f
cmp eax, edi
jne 0x405837
lea ecx, [esp + 0xc]
call fcn.00416470
lea ecx, [esp + 0xc]
mov byte [esp + 0x1e8], bl
call fcn.00416198
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x1e8], 0xffffffff
call fcn.00415d0c
mov eax, 1
jmp 0x4058e1
push ebp
cmp esi, ebx
mov ebp, 1
jle 0x40584c
push ebx
push edi
lea ecx, [esp + 0x18]
call fcn.004163f7
lea eax, [esp + 0x20]
push 0x1c3
push eax
lea ecx, [esp + 0x18]
call fcn.00416372
cmp eax, 0x1c3
jne 0x4058ae
lea ecx, [esp + 0x20]
push ecx
call fcn.00404dd0
add esp, 4
cmp eax, ebx
je 0x4058ac
inc esi
push esi
push 0x424694
push str.NETIDX
push str.CapLoghistory.ini
call fcn.00406f10
add esp, 0x10
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
push 0x1c3
push edx
call fcn.00416372
cmp eax, 0x1c3
je 0x405866
jmp 0x4058ae
xor ebp, ebp
lea ecx, [esp + 0x10]
call fcn.00416470
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ec], bl
call fcn.00416198
lea ecx, [esp + 0x1f4]
mov dword [esp + 0x1ec], 0xffffffff
call fcn.00415d0c
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1e0
ret
Function at 0x405d70
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41cbc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push str._Y__m__d
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00414bd0
mov ecx, eax
call fcn.00414c12
lea edx, [esp + 0x30]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x148], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x30]
push 0x5c
push eax
call fcn.00409be0
mov byte [eax + 1], 0
mov edi, str.CapLog_fileop_
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x30]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.__________.txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.0041546a
lea eax, [esp + 0x14]
lea edx, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [esp + 0x148], 1
call fcn.00415d7a
call fcn.00405560
mov eax, dword [esp + 0x24]
add esp, 8
xor esi, esi
test eax, eax
jle 0x405ef4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 2
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.004052c0
mov ecx, dword [esp + 0x1c]
xor edx, edx
dec ecx
lea eax, [esp + 0xc]
cmp esi, ecx
mov byte [esp + 0x13c], bl
sete dl
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00415a81
call fcn.00405f40
add esp, 8
test eax, eax
je 0x405ee3
mov ecx, dword [esp + 0xc]
push ecx
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x13c], 1
call fcn.00415d0c
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x405e80
jmp 0x405ef4
lea ecx, [esp + 0xc]
mov byte [esp + 0x13c], 1
call fcn.00415d0c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call fcn.004154fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 0
call fcn.0041549d
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00415d0c
mov ecx, dword [esp + 0x134]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x134
ret
Function at 0x406510
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41cc5b
push eax
mov eax, 0x2d5e4
mov dword fs:[0], esp
call fcn.00409a40
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.00409be0
mov byte [eax + 1], 0
mov edi, str.spy9.map
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406649
mov ecx, ebp
call fcn.00406880
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
lea edx, [esp + 0x1c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
call fcn.00416143
push 0
lea ecx, [esp + 0x20]
push 0x1001
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2d604], 0
call fcn.00416255
test eax, eax
je 0x40662e
mov ecx, 0xb534
xor eax, eax
lea edi, [esp + 0x120]
lea edx, [esp + 0x120]
rep stosd dword es:[edi], eax
push 0x2d4d0
push edx
lea ecx, [esp + 0x14]
call fcn.004163ac
lea ecx, [esp + 0xc]
call fcn.00416470
mov ecx, ebp
call fcn.004068a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2d5f8], 0xffffffff
call fcn.00416198
mov ecx, dword [esp + 0x2d5f0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2d5f0
ret