joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ef30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x1003777b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov eax, dword [esp + 0x228]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x10]
mov ebx, 1
call fcn.1002ff9d
lea ecx, [esp + 0x94]
mov dword [esp + 0x22c], 0
push ecx
push 0x102
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1001efa0
lea ecx, [esp + 0xc]
mov dword [esp + 0x22c], 0xffffffff
call fcn.1002ff73
xor eax, eax
jmp 0x1001f09c
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
jne 0x1001f01d
lea eax, [esp + 0x30]
push 0x64
push eax
call sub.WS2_32.dll_gethostname
lea ecx, [esp + 0x30]
push ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x1001efe5
call sub.WS2_32.dll_WSACleanup
lea ecx, [esp + 0xc]
mov dword [esp + 0x22c], 0xffffffff
call fcn.1002ff73
xor eax, eax
jmp 0x1001f09c
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 0x24]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push ecx
call sub.WS2_32.dll_inet_ntoa
push eax
lea edx, [esp + 0x10]
push 0x11f8cd90
push edx
call fcn.1002e991
add esp, 0xc
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x1001f045
lea ecx, [esp + 0xc]
mov dword [esp + 0x22c], edi
call fcn.1002ff73
xor eax, eax
jmp 0x1001f09c
mov eax, dword [esp + 0x238]
mov word [esp + 0x10], 2
push eax
call sub.WS2_32.dll_htons
mov ecx, dword [esp + 0xc]
mov word [esp + 0x12], ax
push ecx
call sub.WS2_32.dll_inet_addr
lea edx, [esp + 0x10]
push 0x10
push edx
push esi
mov dword [esp + 0x20], eax
call sub.WS2_32.dll_connect
cmp eax, edi
jne 0x1001f07f
xor ebx, ebx
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
lea ecx, [esp + 0xc]
mov dword [esp + 0x22c], edi
call fcn.1002ff73
mov eax, ebx
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 8
Function at 0x100332e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10033326
call fcn.10035d9f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10033326
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1003331d
xor eax, eax
jmp 0x1003332e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10033334
pop edi
pop esi
pop ebx
ret 4
Function at 0x4010d9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.mcmm.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x40110f
push 0
push 0
push str.File__mcmm.dll__not_found
call sub.MFC42.DLL_AfxMessageBox_1
xor eax, eax
jmp 0x401248
push str.MCMM_GetAudioDeviceList
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x401137
xor eax, eax
jmp 0x401248
push str.MCMM_OpenAudioDevice
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x40115f
xor eax, eax
jmp 0x401248
push str.MCMM_AudioClose
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x401187
xor eax, eax
jmp 0x401248
push str.MCMM_CompressAudioData
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
jne 0x4011af
xor eax, eax
jmp 0x401248
push str.MCMM_DecompressAndPlay
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x4011d4
xor eax, eax
jmp 0x401248
push str.MCMM_GetCARTParams
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x4011f9
xor eax, eax
jmp 0x401248
push str.MCMM_SetCARTParams
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
jne 0x40121e
xor eax, eax
jmp 0x401248
push str.MCMM_GetMMErrorString
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x24], 0
jne 0x401243
xor eax, eax
jmp 0x401248
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40358a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x42f19c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4035c8
xor eax, eax
jmp 0x4035fe
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x42f1d4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x4035fc
mov eax, 1
jmp 0x4035fe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403602
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425fde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x264
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x260], 0
lea eax, [ebp - 0x254]
push eax
call fcn.0041afef
add esp, 4
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x258]
call fcn.00425570
mov dword [ebp - 4], 0
push str.All_UsersApplication_DataMicrosoftUser_Account_Pictures.bmp
lea ecx, [ebp - 0x258]
call sub.MFC42.DLL_CString::operator_1
lea edx, [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x258]
call fcn.00403090
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffff
jne 0x4036b7
mov dword [ebp - 0x268], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x268]
jmp 0x4037fe
mov dword [ebp - 0x25c], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x120]
push eax
push 0xffffffffffffffff
push str.Administrator.bmp
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x4036e8
jmp 0x403791
push 0xffffffffffffffff
lea ecx, [ebp - 0x120]
push ecx
push 0xffffffffffffffff
push str.Guest.bmp
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x403716
mov dword [ebp - 0x25c], 1
jmp 0x403791
mov dword [ebp - 0x264], 0
mov edx, dword [ebp - 0x264]
movsx eax, byte [ebp + edx - 0x120]
cmp eax, 0x2e
je 0x403778
mov ecx, dword [ebp - 0x264]
movsx edx, byte [ebp + ecx - 0x120]
test edx, edx
je 0x403778
cmp dword [ebp - 0x264], 0x104
jge 0x403778
mov eax, dword [ebp - 0x264]
mov cl, byte [ebp + eax - 0x120]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
jmp 0x403720
push 8
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4036c1
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x25c], 0
je 0x4037d0
push str.Guest_b
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::operator_1
push 0
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x404996
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push esi
push edi
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x130], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x138], edx
cmp dword [ebp - 0x138], 0x14
je 0x4049e6
cmp dword [ebp - 0x138], 0x90
je 0x4049dd
jmp 0x4049ed
mov dword [ebp - 4], 1
jmp 0x4049ed
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x110]
and eax, dword [ebp - 4]
test eax, eax
je 0x404a04
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x10c], 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x108], ax
movsx edx, word [ebp - 0x108]
and edx, 1
test edx, edx
je 0x404a37
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x10c]
jne 0x404a4a
jmp 0x404af1
mov esi, dword [ebp + 8]
mov ecx, 7
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x128], 0x100
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], 0
lea edx, [ebp - 0x12c]
push edx
push 1
mov al, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x134]
call fcn.00405cc2
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x128], 0x101
lea ecx, [ebp - 0x12c]
push ecx
push 0
mov dl, byte [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x134]
call fcn.00405cc2
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x104], dl
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x405cc2
Capabilities:
Log keystrokes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42602d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0
push 0
mov eax, dword [ebp + 8]
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x1c], eax
cmp dword [0x432568], 2
je 0x405d19
mov ecx, dword [ebp + 0xc]
push ecx
mov dl, byte [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00405c8b
jmp 0x405e3b
cmp dword [0x43248c], 0
jne 0x405d63
cmp dword [ebp + 0x10], 0
je 0x405d63
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sym.MiniRem.exe_WIN32MSG_Dispatcher
add esp, 8
cmp eax, 1
jne 0x405d5e
push 0
push 0x31
push 0x414
mov ecx, dword [ebp - 0x24]
call fcn.00406960
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xdc], 1
jmp 0x405e3b
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x18], 0
mov cl, byte [ebp - 0x1c]
mov byte [ebp - 0x10], cl
cmp dword [ebp + 0xc], 0
je 0x405d83
mov byte [ebp - 0xf], 1
jmp 0x405d87
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xd], 0
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0xe], dl
cmp dword [0x432488], 0
je 0x405da3
cmp dword [0x432488], 0xffffffff
jne 0x405df8
push 0x42f274
lea ecx, [ebp - 0x20]
call fcn.00425570
mov dword [ebp - 4], 0
push 0x42f27c
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_1
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push 1
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x432488], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
cmp dword [0x432488], 0
je 0x405e24
cmp dword [0x432488], 0xffffffff
je 0x405e24
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x432488]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x432488]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x432488], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405e4b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov word [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x405e6c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jge 0x405f85
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov al, byte [edx]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [ebp - 0xc], al
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
and ecx, 1
test ecx, ecx
je 0x405ebc
push 0
push 1
push 0x10
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
mov edx, dword [ebp - 0xc]
and edx, 0xff
and edx, 2
test edx, edx
je 0x405eda
push 0
push 1
push 0x11
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
mov eax, dword [ebp - 0xc]
and eax, 0xff
and eax, 4
test eax, eax
je 0x405ef7
push 0
push 1
push 0x12
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
push 0
push 1
mov cl, byte [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov dl, byte [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
and eax, 0xff
and eax, 4
test eax, eax
je 0x405f44
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
and ecx, 2
test ecx, ecx
je 0x405f62
push 0
push 0
push 0x11
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
mov edx, dword [ebp - 0xc]
and edx, 0xff
and edx, 1
test edx, edx
je 0x405f80
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x10]
call fcn.00405cc2
jmp 0x405e63
mov esp, ebp
pop ebp
ret 8
Function at 0x408e69
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
je 0x408eb9
push 0
mov eax, dword [ebp + 8]
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x408e9b
mov dword [ebp - 0xc], 0
jmp 0x408ea2
mov dword [ebp - 0xc], 2
mov ecx, dword [ebp - 8]
and ecx, 0xff
shl ecx, 0x10
add ecx, 0x28000001
mov dword [ebp - 4], ecx
jmp 0x408f04
movzx dx, byte [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OemKeyScan]
mov dword [ebp - 8], eax
push 1
mov eax, dword [ebp - 8]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [ebp + 8], al
cmp dword [ebp + 0xc], 0
je 0x408eeb
mov dword [ebp - 0xc], 0
jmp 0x408ef2
mov dword [ebp - 0xc], 2
mov ecx, dword [ebp - 8]
and ecx, 0xff
shl ecx, 0x10
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov cl, byte [ebp - 8]
push ecx
mov dl, byte [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_keybd_event]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409945
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov dword [ebp - 0x40c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40c]
call fcn.0040985c
test eax, eax
jne 0x40996e
xor eax, eax
jmp 0x409a7e
mov ecx, 0x4317b0
call fcn.0040b0b0
push 1
push 0x40977e
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 8], 0
jmp 0x409997
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov ecx, 0x4317b0
call fcn.0040f5c0
cmp dword [ebp - 8], eax
jge 0x409a72
push 0x3ff
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4317b0
call fcn.0040b120
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x408]
push edx
mov ecx, dword [ebp - 0x40c]
call fcn.0040985c
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409a16
mov edx, dword [ebp - 8]
push edx
mov ecx, 0x4317b0
call fcn.0040b120
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ecx, 0x4317b0
call fcn.0040b0b0
mov eax, dword [ebp - 4]
jmp 0x409a7e
push 5
mov ecx, dword [ebp - 8]
push ecx
mov ecx, 0x4317b0
call fcn.0040b120
mov edx, dword [eax]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409a6d
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4317b0
call fcn.0040b0f0
push 2
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040ac40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409a6d
mov edx, dword [ebp - 4]
push edx
mov ecx, 0x4317b0
call fcn.0040b0f0
jmp 0x409a46
jmp 0x40998e
mov ecx, 0x4317b0
call fcn.0040b0b0
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x409b68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov dword [ebp - 0x664], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x520]
push edx
mov ecx, dword [ebp - 0x664]
call fcn.00409a84
push 0
push 4
lea eax, [ebp - 0x660]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x409bc9
jmp 0x409c39
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x112], 0
cmp dword [ebp - 4], 0xffffffff
je 0x409c39
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x212]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x520]
push eax
mov ecx, dword [ebp - 0x664]
call fcn.00409ada
push 1
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, dword [ebp - 0x664]
call fcn.00409b44
test eax, eax
jne 0x409c20
jmp 0x409c39
lea edx, [ebp - 0x660]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409c37
jmp 0x409c39
jmp 0x409bda
mov esp, ebp
pop ebp
ret 4
Function at 0x40c598
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426482
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x158], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00425570
mov dword [ebp - 4], 0
push 0x42fc4c
push 1
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Right
mov dword [ebp - 0x174], eax
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x178], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x178]
push eax
call fcn.0040d8b0
mov byte [ebp - 0x160], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x164]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x160]
and ecx, 0xff
test ecx, ecx
je 0x40c643
push 0x42fc50
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
push 0x42fc54
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
lea edx, [ebp - 0x150]
push edx
lea ecx, [ebp - 0x10]
call fcn.00403090
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x40c752
mov eax, dword [ebp - 0x150]
and eax, 0x10
test eax, eax
je 0x40c720
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00425570
mov byte [ebp - 4], 2
push 0x42fc58
lea edx, [ebp - 0x15c]
push edx
call fcn.0040d8b0
and eax, 0xff
test eax, eax
je 0x40c711
push 0x42fc5c
lea eax, [ebp - 0x15c]
push eax
call fcn.0040d8b0
and eax, 0xff
test eax, eax
je 0x40c711
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x168], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x168]
jmp 0x40c773
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15c]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40c745
cmp dword [ebp - 0x158], 0
je 0x40c679
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c854
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4264a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
push 0x42fc64
lea ecx, [ebp - 0x14]
call fcn.00425570
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x40c8ed
mov eax, dword [ebp + 8]
and eax, 1
test eax, eax
je 0x40c8da
mov ecx, dword [ebp - 0x10]
add ecx, 0x41
push ecx
push 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::SetAt
lea ecx, [ebp - 0x14]
call fcn.00403090
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov byte [edx + 0xcc], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + eax*4 + 0x10c], 0xffffffff
mov edx, dword [ebp + 8]
shr edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x40c88d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4