joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f80
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4191d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x138]
call fcn.004064f0
movzx eax, al
test eax, eax
jne 0x405fc5
or eax, 0xffffffff
jmp 0x4060da
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf4240
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0x40
jae 0x40602f
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
mov dword [ebp + edx*4 - 0x124], ecx
mov edx, dword [ebp - 0x128]
add edx, 1
mov dword [ebp - 0x128], edx
xor eax, eax
jne 0x406001
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jle 0x4060a9
lea ecx, [ebp - 0x134]
push ecx
push 0
lea edx, [ebp - 0x128]
push edx
push 0
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x406064
jmp 0x4060a9
cmp dword [ebp - 0x1c], 0
jge 0x40606c
jmp 0x4060a9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x406095
or eax, 0xffffffff
jmp 0x4060da
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
jmp 0x40603a
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
jmp 0x4060d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4060f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4191da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x138]
call fcn.004064f0
movzx eax, al
test eax, eax
jne 0x406135
or eax, 0xffffffff
jmp 0x4062dd
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x12c], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0x40
jae 0x406198
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
mov dword [ebp + edx*4 - 0x124], ecx
mov edx, dword [ebp - 0x128]
add edx, 1
mov dword [ebp - 0x128], edx
xor eax, eax
jne 0x40616a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf4240
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jle 0x4062b8
cmp dword [ebp - 0x1c], 0
je 0x4062b8
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0x40
jae 0x4061fd
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x124], eax
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
xor edx, edx
jne 0x4061cf
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf4240
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x406233
jmp 0x4062b8
cmp dword [ebp - 0x20], 0
jg 0x406263
cmp dword [ebp - 0x12c], 0
jle 0x406261
mov edx, dword [ebp - 0x12c]
sub edx, 1
mov dword [ebp - 0x12c], edx
push 0x5dc
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4061b1
jmp 0x4062b8
cmp dword [ebp - 0x20], 0
jge 0x40626e
or eax, 0xffffffff
jmp 0x4062dd
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_recv
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x12c], 0
cmp dword [ebp - 0x1c], 0
jge 0x4062a1
or eax, 0xffffffff
jmp 0x4062dd
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x1c]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x4061b1
mov ecx, dword [ebp - 0x134]
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
jmp 0x4062d3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4062f0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
movzx eax, byte [ebp + 8]
test eax, eax
jne 0x40630f
mov dword [ebp - 4], 2
push 0
mov ecx, dword [ebp - 4]
push ecx
push 2
call sub.WS2_32.dll_socket
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4063b0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4191e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 4], 0
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.004100c0
add esp, 0xc
mov word [ebp - 0x28], 2
mov cx, word [ebp + 0xc]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x26], ax
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x406447
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40643a
or eax, 0xffffffff
jmp 0x406475
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
push 0x10
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_connect
mov dword [ebp - 0x14], eax
jmp 0x40646b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret 8
Function at 0x4074e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], ecx
cmp dword [ebp + 8], 0
je 0x407509
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x407513
mov eax, 6
jmp 0x407661
push 0x104
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.004100c0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0040f9f0
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax - 1]
sub edx, 0x5c
neg edx
sbb edx, edx
inc edx
mov byte [ebp - 0x111], dl
movzx eax, byte [ebp - 0x111]
test eax, eax
jne 0x407575
mov ecx, dword [ebp + 8]
push ecx
push 0x41acc0
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.004105f6
add esp, 0x10
jmp 0x407592
mov eax, dword [ebp + 8]
push eax
push str._s.dll
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.004105f6
add esp, 0x10
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40765f
push 0x104
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.004100c0
add esp, 0xc
movzx edx, byte [ebp - 0x111]
test edx, edx
jne 0x407600
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41acd4
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.004105f6
add esp, 0x14
jmp 0x407624
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41acdc
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.004105f6
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x25c]
call fcn.00407680
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4075b9
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret 4
Function at 0x40bd10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.0040bb90
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [ebp - 4], eax
push str.Error_delete_DLL
call fcn.00403dd0
add esp, 4
xor eax, eax
cmp dword [ebp - 4], 0
setne al
dec eax
and eax, 0xf
mov esp, ebp
pop ebp
ret

Function at 0x40d260
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [ebp - 0x118]
push ecx
call fcn.0040f9f0
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x40d2cf
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x118]
cmp eax, 0x5c
je 0x40d2cf
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x118], 0
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x40d2a3
cmp dword [ebp - 4], 0
jb 0x40d2e0
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x118], 0
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x40d8a0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
jne 0x40d8d9
push str.OpenSCManager_for_Delete_service
call fcn.00403dd0
add esp, 4
xor eax, eax
jmp 0x40d9a8
push 0xf01ff
mov eax, dword [0x420d90]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40d915
push str.OpenService_for_Delete_service
call fcn.00403dd0
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40d9a8
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40d936
push str.ControlService_set_Status_SERVICE_CONTROL_STOP
call fcn.00403dd0
add esp, 4
lea edx, [ebp - 0x28]
push edx
push 0x82
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40d95a
push str.ControlService_set_Status_SERVICE_USER_CONTROL_STOP_DEF
call fcn.00403dd0
add esp, 4
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40d992
push str.DeleteService_for_Delete_service
call fcn.00403dd0
add esp, 4
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40d9a8
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d9b0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0040d8a0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], 0
cmp dword [ebp - 0x320], 0
jne 0x40da04
push str.OpenSCManager_for_Install_service
call fcn.00403dd0
add esp, 4
xor eax, eax
jmp 0x40db6d
push 0x104
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [ebp - 0x318]
push ecx
push str._s_service
push 0x208
lea edx, [ebp - 0x210]
push edx
call fcn.004105f6
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
push 2
push 0x120
push 0xf01ff
mov ecx, dword [0x420d8c]
push ecx
mov edx, dword [0x420d90]
push edx
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x40daef
push str.CreateService_for_Install_service
call fcn.00403dd0
add esp, 4
cmp eax, 0x431
je 0x40daa9
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40db6d
push 0xf01ff
mov edx, dword [0x420d90]
push edx
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x40daef
push str.OpenService_for_Start_service
call fcn.00403dd0
add esp, 4
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40db6d
mov edx, dword [0x420d94]
mov dword [ebp - 0x324], edx
lea eax, [ebp - 0x324]
push eax
push 1
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40db51
push str.Starting_Service_after_Install_service
call fcn.00403dd0
add esp, 4
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40db6d
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x40db80
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0040d8a0
push 0x104
lea eax, [ebp - 0x328]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48c], edx
push 0x41bee0
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00410570
add esp, 8
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
je 0x40dbfc
mov ecx, dword [ebp - 0x48c]
add ecx, 1
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp - 0x48c]
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x48c], 0
jne 0x40dbbe
push 0x104
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
jne 0x40dc54
lea ecx, [ebp - 0x440]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
jne 0x40dc54
push str.c:_temp
lea edx, [ebp - 0x440]
push edx
call fcn.0040fec0
add esp, 8
push 0
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [ebp - 0x440]
push ecx
call fcn.0040f9f0
add esp, 4
movsx edx, byte [ebp + eax - 0x441]
cmp edx, 0x5c
je 0x40dc84
push 0x41beec
lea eax, [ebp - 0x440]
push eax
call fcn.0040fed0
add esp, 8
mov ecx, dword [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x440]
push edx
call fcn.0040fed0
add esp, 8
push 0x44
push 0
lea eax, [ebp - 0x488]
push eax
call fcn.004100c0
add esp, 0xc
mov dword [ebp - 0x488], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x338]
push ecx
call fcn.004100c0
add esp, 0xc
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x61
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 7], 0x6c
mov byte [ebp - 5], 0
push 0
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x40dd5c
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.0040fec0
add esp, 8
push 0x41bef0
lea eax, [ebp - 0x218]
push eax
call fcn.0040fed0
add esp, 8
lea ecx, [ebp - 0x338]
push ecx
lea edx, [ebp - 0x488]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
jmp 0x40ddc6
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0040fec0
add esp, 8
push 0x41bef4
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040fed0
add esp, 8
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x488]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x40ed00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419737
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x47c
mov eax, dword [0x420070]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x488], ecx
mov eax, dword [0x420c00]
push eax
push connect
lea ecx, [ebp - 0x12c]
call fcn.00401ad0
mov dword [ebp - 4], 0
push 0x208
push 0
lea ecx, [ebp - 0x334]
push ecx
call fcn.004100c0
add esp, 0xc
mov dword [ebp - 0x120], 0x208
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x334]
push eax
push 0x41c0c4
lea ecx, [ebp - 0x12c]
call fcn.00401bc0
test eax, eax
je 0x40edb4
mov dword [ebp - 0x480], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00401b00
mov eax, dword [ebp - 0x480]
jmp 0x40eeed
push 4
push 0
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004100c0
add esp, 0xc
lea edx, [ebp - 0x334]
push edx
call fcn.0040f9f0
add esp, 4
movsx eax, byte [ebp + eax - 0x335]
cmp eax, 0x5c
jne 0x40edfa
lea ecx, [ebp - 0x334]
push ecx
call fcn.0040f9f0
add esp, 4
mov byte [ebp + eax - 0x335], 0
lea edx, [ebp - 0x334]
push edx
mov ecx, dword [ebp - 0x488]
add ecx, 0x30
call fcn.0040c770
lea eax, [ebp - 0x334]
push eax
mov ecx, dword [ebp - 0x488]
mov edx, dword [ecx + 0x3c]
push edx
push 0x104
lea eax, [ebp - 0x11c]
push eax
call fcn.004105f6
add esp, 0x10
lea ecx, [ebp - 0x47c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0xffffffff
je 0x40eecb
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004100c0
add esp, 0xc
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x334]
push edx
push str._s_s
push 0x104
lea eax, [ebp - 0x11c]
push eax
call fcn.004105f6
add esp, 0x14
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x488]
call fcn.0040ef10
lea edx, [ebp - 0x47c]
push edx
mov eax, dword [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x40ee57
mov ecx, dword [ebp - 0x338]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [ebp - 0x484], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00401b00
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410051
mov esp, ebp
pop ebp
ret
Function at 0x40f240
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419769
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.0040f490
mov dword [ebp - 0x18], 0
jmp 0x40f28d
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
call fcn.0040d1f0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x28]
jae 0x40f2d4
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.0040d170
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40f2bd
jmp 0x40f284
mov ecx, dword [ebp - 0x14]
call fcn.0040e350
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp + 8]
jne 0x40f2d2
jmp 0x40f2d4
jmp 0x40f284
cmp dword [ebp - 0x14], 0
je 0x40f2ed
mov ecx, dword [ebp - 0x14]
call fcn.0040e350
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp + 8]
je 0x40f2fc
mov ecx, dword [ebp - 0x24]
call fcn.0040f4b0
xor eax, eax
jmp 0x40f399
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0040e2f0
mov ecx, dword [ebp - 0x14]
call fcn.0040e2d0
mov dword [ebp - 0x38], eax
push 0x80
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov ecx, dword [ebp - 0x14]
call fcn.0040e2d0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.0040d130
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x40f36a
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
jmp 0x40f371
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x24]
call fcn.0040f4b0
jmp 0x40f390
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4108ec
Capabilities:
Terminate process

Disassembly:
push 8
push 0x41c148
call fcn.00412024
push 8
call fcn.00412e4f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x420ddc], esi
jne 0x410920
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [0x420dd8], esi
mov al, byte [ebp + 0x10]
mov byte [0x420dd4], al
cmp dword [ebp + 0xc], edi
jne 0x41096a
cmp dword [0x422638], edi
je 0x41095a
mov eax, dword [0x422634]
sub eax, 4
mov dword [0x422634], eax
cmp eax, dword [0x422638]
jb 0x41095a
mov eax, dword [eax]
cmp eax, edi
je 0x41093b
call eax
jmp 0x41093b
push 0x420038
mov eax, 0x42002c
call fcn.0041086a
pop ecx
push 0x420044
mov eax, 0x42003c
call fcn.0041086a
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41099b
cmp dword [ebp + 0x10], edi
jne 0x4109a9
mov dword [0x420ddc], esi
push dword [ebp + 8]
call fcn.00410828
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4109a8
push 8
call fcn.00412d9a
pop ecx
ret
call fcn.0041205f
ret

Function at 0x410d33
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x410d50
call fcn.00414997
mov dword [eax], 0x16
xor eax, eax
jmp 0x410dba
push esi
push 0x8c
push 1
call fcn.0041515b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x410da5
push esi
call fcn.00411a64
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x410d83
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x410c9e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x410db9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
push esi
call fcn.004101d9
test ebx, ebx
pop ecx
je 0x410db7
push ebx
call fcn.004149a9
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret