joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402533
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor esi, esi
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.00411980
add esp, 0xc
push 0x200
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00411980
lea eax, [ebp - 0x410]
add esp, 0xc
push eax
call fcn.00401c12
pop ecx
test eax, eax
je 0x402641
xor eax, eax
movzx ecx, word [eax + 0x428aa4]
mov word [eax + 0x434328], cx
inc eax
inc eax
cmp cx, si
jne 0x402593
xor eax, eax
movzx ecx, word [ebp + eax - 0x38a]
mov word [eax + 0x434220], cx
inc eax
inc eax
cmp cx, si
jne 0x4025aa
xor eax, eax
movzx ecx, word [ebp + eax - 0x40c]
mov word [eax + 0x4342a0], cx
inc eax
inc eax
cmp cx, si
jne 0x4025c2
cmp dword [0x430f90], 3
mov ax, word [ebp - 0x38c]
mov word [0x434320], ax
mov ax, word [ebp - 0x2ea]
mov word [0x4343a8], ax
lea eax, [ebp - 0x210]
mov dword [0x4343ac], 5
push eax
je 0x402610
push 1
jmp 0x402611
push esi
call fcn.00402fd0
pop ecx
pop ecx
push 0x428b00
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040f97c
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040f8fe
leave
ret

Function at 0x4026b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov word [ebp - 0x134], cx
push 0x11c
push 0
lea edx, [ebp - 0x130]
push edx
call fcn.00411980
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402772
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 4], edx
mov ax, word [ebp - 0x1c]
mov word [ebp - 0x134], ax
cmp dword [ebp - 8], 5
jne 0x40274c
cmp dword [ebp - 4], 2
jae 0x402743
cmp dword [ebp - 4], 1
jne 0x40274c
mov ecx, dword [ebp + 8]
mov dword [ecx], 3
cmp dword [ebp - 8], 6
jne 0x402772
cmp dword [ebp - 4], 0
jne 0x402763
mov edx, dword [ebp + 8]
mov dword [edx], 4
jmp 0x402772
cmp dword [ebp - 4], 1
jne 0x402772
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret
Function at 0x402780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00411980
add esp, 0xc
cmp dword [0x430f90], 3
jne 0x4027e8
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42aa44
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040f97c
add esp, 0xc
jmp 0x4027fa
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x42ad1c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret

Function at 0x402ac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0xffffffff
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00411980
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [ebp - 0x210]
sub eax, 0x41
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call fcn.00402d20
add esp, 8
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00402e40
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x402b6a
xor eax, eax
jmp 0x402b7d
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call fcn.00402900
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret

Function at 0x402c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x402cc3
jmp 0x402d14
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
push 0
push 0x200
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00413750
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402fd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x402fea
mov eax, dword [ebp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x40300f
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42ada0
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040f97c
add esp, 0xc
pop ebp
ret

Function at 0x403020
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x42ada4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040fc5f
add esp, 0xc
test eax, eax
je 0x403054
xor eax, eax
jmp 0x403135
mov dword [ebp - 0x14], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00410832
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00410a54
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00410832
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, dword [ebp + 0x10]
push edx
call fcn.0041061c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040ff52
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.0040ffe6
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
push edx
call fcn.00403140
add esp, 8
push 0x42adac
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040fc5f
add esp, 0xc
test eax, eax
je 0x4030ee
xor eax, eax
jmp 0x403135
mov edx, dword [ebp - 0x14]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004101c4
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.0040ffe6
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0
je 0x403132
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004106e6
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403b00
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x24], 2
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0x3a98
mov eax, dword [ebp - 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403b87
mov dword [ebp - 0x10], 0xffffffff
jmp 0x403c7e
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x6f
jne 0x403bc1
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x2c], 0x6f
jne 0x403bd6
cmp dword [ebp - 0x1c], 3
jb 0x403b5a
cmp dword [ebp - 0x2c], 0
jne 0x403c6c
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x403c6a
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x34], 6
jne 0x403c5c
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x1c], 0
je 0x403c5c
mov ecx, dword [ebp - 0x20]
add ecx, 0x2c
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov cx, word [ecx + 4]
mov word [edx + 4], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp + 0xc]
mov al, byte [ecx + 4]
mov byte [edx + 3], al
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax + 5]
mov byte [ecx + 2], dl
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov cl, byte [edx + 6]
mov byte [eax + 1], cl
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp + 0xc]
mov al, byte [ecx + 7]
mov byte [edx], al
jmp 0x403c6a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x20], edx
jmp 0x403be6
jmp 0x403c77
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x403c7e
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x403c97
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x404120
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004042f0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x404168
mov eax, dword [ebp - 0x41c]
jmp 0x4042d8
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00411980
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00411980
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x4041d3
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 5
jge 0x404238
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
movzx eax, word [edx + 0x433ca0]
test eax, eax
jne 0x4041f5
jmp 0x4041c4
lea ecx, [ebp - 0x418]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040f90d
add esp, 0xc
mov eax, dword [ebp - 0x420]
imul eax, eax, 0x118
add eax, 0x433ca0
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040f97c
add esp, 0xc
jmp 0x4041c4
mov dword [ebp - 0x424], 0
jmp 0x404253
mov edx, dword [ebp - 0x424]
add edx, 1
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x424], 5
jge 0x40429d
mov eax, dword [ebp - 0x424]
imul eax, eax, 0x118
movzx ecx, word [eax + 0x433ca0]
test ecx, ecx
jne 0x404275
jmp 0x404244
push 1
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x424]
imul ecx, ecx, 0x118
add ecx, 0x433ca0
push ecx
call fcn.00404f50
add esp, 0x10
jmp 0x404244
push 0x434a70
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.0040f97c
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4042d2
mov dword [ebp - 0x41c], 2
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret
Function at 0x404580
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c0
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x9c0], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x9be]
push ecx
call fcn.00411980
add esp, 0xc
lea edx, [ebp - 0x9c0]
mov dword [ebp - 0x19c], edx
cmp dword [ebp + 0x14], 0
je 0x4045cd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x19c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x19c]
mov word [edx], cx
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0
lea eax, [ebp - 0x198]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404618
xor eax, eax
jmp 0x404709
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffff
jne 0x404638
xor eax, eax
jmp 0x404709
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x404678
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1bc], eax
push 2
push 4
lea edx, [ebp - 0x1bc]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x404685
jmp 0x4046dd
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x1a8], eax
mov ecx, 2
mov word [ebp - 0x1ac], cx
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1aa], ax
push 0x10
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4046d3
jmp 0x4046dd
mov dword [ebp - 0x1b8], 1
cmp dword [ebp - 0x1b8], 0
jne 0x404703
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x404703
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret
Function at 0x404940
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x404974
jmp 0x404a30
mov dword [ebp - 0x18], 0
jmp 0x404986
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jge 0x4049a3
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
not ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x18]
mov byte [edx], cl
jmp 0x40497d
mov eax, dword [ebp + 0x10]
add eax, 7
push eax
call fcn.004054a0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
movzx edx, word [ebp + 0x10]
add edx, 5
mov eax, dword [ebp - 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov edx, dword [0x430f94]
mov dword [ecx], edx
mov al, byte [0x430f98]
mov byte [ecx + 4], al
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
add eax, 7
push eax
call fcn.00417450
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 7
mov dword [ebp + 0x10], ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404a25
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x404a29
jmp 0x404a30
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x404a48
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004054cf
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4052f0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00413e30
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x1014], 0
push 0x42ae6c
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0040fc5f
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x40533a
xor eax, eax
jmp 0x4053d1
push 0
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x405357
xor eax, eax
jmp 0x4053d1
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x4053b1
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405387
jmp 0x4053b1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
lea edx, [ebp - 0x1010]
push edx
call fcn.004101c4
add esp, 0x10
mov eax, dword [ebp - 0x1014]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1014], eax
jmp 0x405357
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040ffe6
add esp, 4
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x4053cc
xor eax, eax
jmp 0x4053d1
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f8fe
mov esp, ebp
pop ebp
ret

Function at 0x40f8fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fc20]
jne 0x40f908
repz ret
jmp fcn.00413e5b
Function at 0x41f1e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004182df
and dword [ebp - 4], 0
cmp dword [0x433a9c], 0
mov ebx, eax
jne 0x41f296
push 0x427ddc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f347
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x427dd0
push edi
call esi
test eax, eax
je 0x41f347
push eax
call fcn.0041826d
mov dword [esp], 0x427dc0
push edi
mov dword [0x433a9c], eax
call esi
push eax
call fcn.0041826d
mov dword [esp], 0x427dac
push edi
mov dword [0x433aa0], eax
call esi
push eax
call fcn.0041826d
mov dword [esp], 0x427d90
push edi
mov dword [0x433aa4], eax
call esi
push eax
call fcn.0041826d
pop ecx
mov dword [0x433aac], eax
test eax, eax
je 0x41f296
push 0x427d78
push edi
call esi
push eax
call fcn.0041826d
pop ecx
mov dword [0x433aa8], eax
mov eax, dword [0x433aa8]
cmp eax, ebx
je 0x41f2ee
cmp dword [0x433aac], ebx
je 0x41f2ee
push eax
call fcn.004182e8
push dword [0x433aac]
mov esi, eax
call fcn.004182e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f2ee
test edi, edi
je 0x41f2ee
call esi
test eax, eax
je 0x41f2e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f2e5
test byte [ebp - 0xc], 1
jne 0x41f2ee
or dword [ebp + 0x10], 0x200000
jmp 0x41f327
mov eax, dword [0x433aa0]
cmp eax, ebx
je 0x41f327
push eax
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f327
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f327
mov eax, dword [0x433aa4]
cmp eax, ebx
je 0x41f327
push eax
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f327
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433a9c]
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f347
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b220
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46a9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045f377
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b2a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045d0ed
mov eax, dword [eax]
push 0x4821c0
push eax
call fcn.0044fee4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045f602
test bl, bl
je 0x40b2a2
push 0x4821c0
lea ecx, [esp + 0xc]
call fcn.0045f992
push 0x485d34
lea ecx, [esp + 0xc]
call fcn.0045f992
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b2de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045f602
jmp 0x40b3a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b362
lea edx, [esp + 0x7c]
push 0x485d30
push edx
call fcn.0044fee4
add esp, 8
test eax, eax
je 0x40b362
lea eax, [esp + 0x7c]
push 0x485d2c
push eax
call fcn.0044fee4
add esp, 8
test eax, eax
je 0x40b362
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b2f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045f602
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40bbc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40bc22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc