joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4092c6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi + 0x3a8]
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.004064d1
test eax, eax
je 0x4092fe
mov eax, dword [ebp - 4]
push 5
push 0
push 0
add eax, 0x3d
push eax
push str.open
push dword [esi + 0x108]
call dword [sym.imp.___s__a___h4__p__ShellExecuteA]
mov eax, edi
call fcn.00405de7
pop edi
leave
ret

Function at 0x409308
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 8], esi
call fcn.0040459e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3a8]
call fcn.00405dc3
mov edi, eax
dec edi
js 0x409427
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3a8]
call fcn.00406477
test eax, eax
je 0x409366
mov ebx, dword [ebp - 8]
add ebx, 0x3d
push ebx
call sub..net___target_newwin___s__a___h4__p__strlen
pop ecx
lea esi, [esi + eax + 1]
push ebx
lea eax, [ebp - 0x44]
call fcn.004045e6
dec edi
jns 0x409335
test esi, esi
jle 0x409427
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
stosd dword es:[edi], eax
pop ebx
add esi, 0x15
push esi
stosd dword es:[edi], eax
and dword [ebp - 0x14], 0
push 0x2042
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ir_rtl___tr__td__GlobalAlloc]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.ir_rtl___tr__td__GlobalLock]
mov edi, eax
push ebx
lea eax, [ebp - 0x24]
push eax
push edi
call sub..net___target_newwin___s__a___h4__p__memcpy
xor ebx, ebx
add esp, 0xc
xor esi, esi
cmp dword [ebp - 0x28], ebx
jle 0x4093e9
mov eax, ebx
lea ecx, [ebp - 0x44]
call fcn.00404681
push eax
mov dword [ebp - 0xc], eax
call sub..net___target_newwin___s__a___h4__p__strlen
push dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [esi + edi + 0x14]
push eax
call sub..net___target_newwin___s__a___h4__p__strcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x28]
lea esi, [esi + eax + 1]
jl 0x4093b6
push dword [ebp - 8]
call dword [sym.imp.ir_rtl___tr__td__GlobalUnlock]
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
call dword [sym.imp.__p__OpenClipboard]
test eax, eax
je 0x40941e
call dword [sym.imp.__p__EmptyClipboard]
push dword [ebp - 8]
push 0xf
call dword [sym.imp.__p__SetClipboardData]
call dword [sym.imp.__p__CloseClipboard]
jmp 0x409427
push dword [ebp - 8]
call dword [sym.imp.ir_rtl___tr__td__GlobalFree]
lea esi, [ebp - 0x44]
call fcn.004045c0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x409612
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [eax + 0x3a8]
push ebx
push esi
push edi
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 4], eax
call fcn.004064d1
test eax, eax
je 0x40971c
mov ebx, 0x104
push ebx
xor edi, edi
lea eax, [ebp - 0x26f]
push edi
push eax
mov byte [ebp - 0x270], 0
call sub..net___target_newwin___s__a___h4__p__memset
push ebx
lea eax, [ebp - 0x167]
push edi
push eax
mov byte [ebp - 0x168], 0
call sub..net___target_newwin___s__a___h4__p__memset
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x66f]
push edi
push eax
mov byte [ebp - 0x670], 0
call sub..net___target_newwin___s__a___h4__p__memset
mov eax, dword [ebp - 8]
add eax, 0x3d
push eax
lea edi, [ebp - 0x270]
call fcn.00403a0b
add esp, 0x28
push ebx
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.ir_rtl___tr__td__GetSystemDirectoryA]
mov eax, edi
push eax
lea eax, [ebp - 0x168]
push eax
push eax
push str.__s_rundll32.exe___s_shell32.dll_OpenAs_RunDLL__s
lea eax, [ebp - 0x670]
push esi
push eax
call sub..net___target_newwin___s__a___h4__p___snprintf
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
call sub..net___target_newwin___s__a___h4__p__memset
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x670]
push eax
push ebx
mov dword [ebp - 0x60], 0x44
mov word [ebp - 0x30], 5
call dword [sym.imp.ir_rtl___tr__td__CreateProcessA]
test eax, eax
je 0x40971c
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ir_rtl___tr__td__CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 4]
call fcn.00405de7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b1c2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040bf50
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
mov byte [ebp - 0x2004], al
je 0x40b219
push 0x2000
push eax
lea eax, [ebp - 0x2003]
push eax
call sub..net___target_newwin___s__a___h4__p__memset
push dword [edi]
lea ebx, [ebp - 0x2004]
push dword [ebp + 0x14]
call fcn.00404291
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ir_rtl___tr__td__WritePrivateProfileStringA]
mov esi, eax
jmp 0x40b264
mov esi, 0x2000
push esi
push eax
lea eax, [ebp - 0x2003]
push eax
call sub..net___target_newwin___s__a___h4__p__memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x2004]
push esi
push eax
push 0x40d3e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ir_rtl___tr__td__GetPrivateProfileStringA]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea ebx, [ebp - 0x2004]
neg esi
call fcn.0040430c
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40b26a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40b288
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b176
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ir_rtl___tr__td__GetPrivateProfileIntA]
mov dword [esi], eax
pop ebp
ret

Function at 0x40b54e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
and dword [esp], 0
push 0x15c
lea eax, [esp + 8]
push 0
push eax
call sub..net___target_newwin___s__a___h4__p__memset
add esp, 0xc
push 0x111
push 0x160
lea eax, [esp + 8]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.___s__a___h4__p__SHGetFileInfoA]
mov eax, dword [esp]
mov esp, ebp
pop ebp
ret

Function at 0x40b5c2
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
call fcn.0040b593
xor ebx, ebx
cmp dword [0x410cb4], ebx
je 0x40b5ed
call fcn.00403bda
push ebx
push 0x20
push edi
push ebx
call dword [0x410cb4]
jmp 0x40b659
push 0x103
lea eax, [ebp - 0x127]
push ebx
push eax
mov byte [ebp - 0x128], bl
call sub..net___target_newwin___s__a___h4__p__memset
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0040b29b
add esp, 0x18
cmp eax, ebx
jne 0x40b643
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov eax, 0x104
lea esi, [ebp - 0x128]
call fcn.0040b2b5
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp._td__RegCloseKey]
pop esi
lea eax, [ebp - 0x128]
push eax
push edi
call sub..net___target_newwin___s__a___h4__p__strcpy
xor eax, eax
cmp byte [edi], bl
pop ecx
pop ecx
setne al
pop ebx
leave
ret
Function at 0x40b828
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub..net___target_newwin___s__a___h4__p__memset
add esp, 0xc
lea eax, [ebp - 0x108]
call fcn.0040b75d
test eax, eax
je 0x40b882
push 1
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.___s__a___h4__p__ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
leave
ret
xor eax, eax
leave
ret
Function at 0x40bd0e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40d3b0
call fcn.0040bef8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.ir_rtl___tr__td__GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40bd4b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bd4b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40bd63
cmp eax, 0x20b
je 0x40bd50
mov dword [ebp - 0x1c], ebx
jmp 0x40bd77
cmp dword [ecx + 0x84], 0xe
jbe 0x40bd4b
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40bd71
cmp dword [ecx + 0x74], 0xe
jbe 0x40bd4b
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp..net___target_newwin___s__a___h4__p____set_app_type]
pop ecx
or dword [0x410f4c], 0xffffffff
or dword [0x410f50], 0xffffffff
call dword [sym.imp..net___target_newwin___s__a___h4__p____p__fmode]
mov ecx, dword [0x41032c]
mov dword [eax], ecx
call dword [sym.imp..net___target_newwin___s__a___h4__p____p__commode]
mov ecx, dword [0x410328]
mov dword [eax], ecx
mov eax, dword [sym.imp..net___target_newwin___s__a___h4__p___adjust_fdiv]
mov eax, dword [eax]
mov dword [0x410f48], eax
call fcn.00406764
cmp dword [section..data], ebx
jne 0x40bdd2
push fcn.00406764
call dword [sym.imp..net___target_newwin___s__a___h4__p____setusermatherr]
pop ecx
call fcn.0040bee6
push 0x40d38c
push 0x40d388
call sub..net___target_newwin___s__a___h4__p___initterm
mov eax, dword [0x410324]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x410320]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp..net___target_newwin___s__a___h4__p____getmainargs]
mov dword [ebp - 0x30], eax
push 0x40d384
push 0x40d36c
call sub..net___target_newwin___s__a___h4__p___initterm
add esp, 0x24
mov eax, dword [sym.imp..net___target_newwin___s__a___h4__p___acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x40be68
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40be3c
cmp al, 0x22
jne 0x40be2e
cmp byte [esi], 0x22
jne 0x40be45
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40be4f
cmp al, 0x20
jbe 0x40be41
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.ir_rtl___tr__td__GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x40be73
movzx eax, word [ebp - 0x48]
jmp 0x40be76
cmp byte [esi], 0x20
jbe 0x40be45
inc esi
mov dword [ebp - 0x34], esi
jmp 0x40be68
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40be93
push esi
call dword [sym.imp..net___target_newwin___s__a___h4__p__exit]
call dword [sym.imp..net___target_newwin___s__a___h4__p___cexit]
jmp 0x40bec8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040bf31
ret
Function at 0x402520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5aaef0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 0xc], ecx
jle 0x402680
push ebx
push esi
push edi
lea edi, [eax + 0x2a8]
add eax, 0x298
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], eax
lea ecx, [ecx]
lea ebx, [ecx + 4]
mov esi, 4
add ebx, edx
lea edx, [ebp - 0x13]
mov dword [ebp - 0x28], ebx
mov ecx, ebx
movzx eax, byte [ecx - 4]
lea ecx, [ecx + 1]
mov byte [edx - 1], al
lea edx, [edx + 4]
movzx eax, byte [ecx - 1]
mov byte [edx - 4], al
movzx eax, byte [ecx + 3]
mov byte [edx - 3], al
movzx eax, byte [ecx + 7]
mov byte [edx - 2], al
dec esi
jne 0x402572
lea ecx, [ebp - 0x10]
mov edx, edi
mov esi, 4
movzx eax, byte [edx - 4]
lea edx, [edx + 1]
xor byte [ecx - 4], al
lea ecx, [ecx + 1]
movzx eax, byte [edx - 1]
xor byte [ecx - 1], al
movzx eax, byte [edx + 3]
xor byte [ecx + 3], al
movzx eax, byte [edx + 7]
xor byte [ecx + 7], al
dec esi
jne 0x4025a1
mov ebx, dword [ebp - 0x20]
lea edi, [esi + 9]
mov esi, dword [ebp - 0x2c]
nop
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.004022e0
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00402380
xor eax, eax
jmp 0x4025f0
movzx ecx, byte [esi + eax - 4]
xor byte [ebp + eax - 0x14], cl
movzx ecx, byte [esi + eax]
xor byte [ebp + eax - 0x10], cl
movzx ecx, byte [esi + eax + 4]
xor byte [ebp + eax - 0xc], cl
movzx ecx, byte [esi + eax + 8]
xor byte [ebp + eax - 8], cl
inc eax
cmp eax, 4
jl 0x4025f0
test edi, edi
je 0x402628
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00402190
sub esi, 0x10
dec edi
jns 0x4025d0
mov ebx, dword [ebp - 0x28]
lea ecx, [ebp - 0x13]
mov edx, 4
lea esp, [esp]
movzx eax, byte [ecx - 1]
lea ebx, [ebx + 1]
mov byte [ebx - 5], al
lea ecx, [ecx + 4]
movzx eax, byte [ecx - 4]
mov byte [ebx - 1], al
movzx eax, byte [ecx - 3]
mov byte [ebx + 3], al
movzx eax, byte [ecx - 2]
mov byte [ebx + 7], al
dec edx
jne 0x402640
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add ecx, 0x10
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp + 0xc]
jl 0x402560
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.0052fe70
mov esp, ebp
pop ebp
ret 8
Function at 0x4043c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549c33
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x5aaef0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x150], 0x128
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x164], eax
push ecx
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40459b
lea ecx, [ecx]
push 0x5c
push str.vmware.exe_vmnat.exe_VBoxTray.exe_VBoxService.exe_PowerRemind.exe_DF5Serve.exe_mdservice.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00402c10
mov dword [ebp - 4], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push 1
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x55b000
mov byte [ecx], 0
call fcn.00402c10
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00407010
mov ecx, dword [ebp - 0x158]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x15c]
add esp, 0x20
sub ecx, esi
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x4044f2
cmp dword [esi + 0x14], 0x10
jb 0x4044ca
mov eax, dword [esi]
jmp 0x4044cc
mov eax, esi
lea ecx, [ebp - 0x12c]
push ecx
push eax
call fcn.0053b5f4
add esp, 8
test eax, eax
mov eax, 1
cmove edi, eax
add esi, 0x18
dec ebx
jne 0x4044c0
mov esi, dword [ebp - 0x15c]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x164]
call sub.KERNEL32.dll_Process32Next
mov ebx, eax
mov dword [ebp - 0x160], ebx
test esi, esi
je 0x40457b
mov ebx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x158]
cmp ebx, eax
je 0x40454e
cmp dword [esi + 0x14], 0x10
jb 0x404536
push dword [esi]
call fcn.0040b2d3
mov eax, dword [ebp - 0x158]
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
add esi, 0x18
cmp esi, eax
jne 0x404520
push ebx
call fcn.0040b2d3
mov ebx, dword [ebp - 0x160]
add esp, 4
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x404593
push dword [ebp - 0x28]
call fcn.0040b2d3
add esp, 4
test ebx, ebx
jne 0x404420
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052fe70
mov esp, ebp
pop ebp
ret
Function at 0x4056d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549d58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5aaef0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x4057d4
cmp byte [edx], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x405721
xor ecx, ecx
jmp 0x40572f
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405726
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402c10
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
lea ecx, [edi - 1]
cmp edi, ecx
ja 0x405754
push str.invalid_string_position
call fcn.00549789
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp byte [eax + ecx], 0x5c
je 0x405774
push 0x5c
push 1
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov edi, dword [ebp - 0x18]
xor esi, esi
test edi, edi
jle 0x4057c3
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp byte [eax + esi], 0x5c
jne 0x4057be
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407260
cmp dword [eax + 0x14], 0x10
jb 0x4057a8
mov eax, dword [eax]
push 0
push eax
call ebx
cmp dword [ebp - 0x2c], 0x10
jb 0x4057be
push dword [ebp - 0x40]
call fcn.0040b2d3
add esp, 4
inc esi
cmp esi, edi
jl 0x405780
cmp dword [ebp - 0x14], 0x10
jb 0x4057d4
push dword [ebp - 0x28]
call fcn.0040b2d3
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052fe70
mov esp, ebp
pop ebp
ret
Function at 0x4067e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4067f5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406834
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406830
lea ebx, [ebx]
cmp esi, edx
jae 0x406834
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x406820
cmp esi, edx
jb 0x406839
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x407350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00414471

Function at 0x407f40
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5aaef0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.0040c608
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x407f8b
push 0x80004005
call fcn.00403940
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push edi
call fcn.00408f30
add esp, 8
test eax, eax
je 0x408058
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push 2
call fcn.00409240
add esp, 0x10
test eax, eax
je 0x408058
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x408014
push 0x30
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x40805a
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40800d
cmp eax, 0xffffffff
jne 0x408058
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x408058
mov edi, 1
jmp 0x40805a
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40805a
push 0x23
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x40805a
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x10]
call dword [eax + 0x44]
cmp eax, 2
je 0x40805a
mov dword [esi + 0x58], 1
mov edi, 1
jmp 0x40805a
xor edi, edi
mov esi, dword [ebp - 0x24]
or ecx, 0xffffffff
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40807e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052fe70
mov esp, ebp
pop ebp
ret 8
Function at 0x4080a0
Capabilities:
Create tcp socket

Disassembly:
push esi
push 6
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4080fb
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x4080cb
cmp dword [esi + 0x6c], 0
jbe 0x4080cb
mov edx, 1
jmp 0x4080cd
xor edx, edx
push dword [esi + 0x6c]
push ecx
push edx
push eax
call fcn.004091c0
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push 0x5b0bb4
mov dword [esi + 0xc], eax
call fcn.00408f10
add esp, 4
mov dword [esi + 0x10], eax
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x408100
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x408a00
push 0
push 0
call fcn.0053284f
xor ecx, ecx
mov dword [esi + 0x18], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
ret

Function at 0x408130
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 4], 0
jbe 0x4081be
mov ecx, dword [ebx + 0x64]
cmp dword [esi + 4], ecx
push 0
cmovl ecx, dword [esi + 4]
push ecx
push dword [esi]
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x4081f3
mov edx, dword [ebx]
mov ecx, ebx
push edi
push dword [esi]
push dword [ebx + 0x10]
call dword [edx + 0x48]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
sub ebx, edi
push ebx
lea eax, [ecx + edi]
push eax
push ecx
call fcn.00531000
mov ecx, dword [esi + 4]
add esp, 0xc
cmp ebx, ecx
je 0x4081b5
lea edx, [ebx + ebx]
mov eax, ecx
cmp edx, ecx
cmovb eax, edx
cmp ebx, eax
jbe 0x4081a2
mov edi, ebx
jmp 0x4081a9
cmp edx, ecx
mov edi, ecx
cmovb edi, edx
cmp ebx, dword [esi + 8]
ja 0x4081cc
cmp edi, ecx
jb 0x4081cc
mov dword [esi + 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [esi + 4], 0
ja 0x408145
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push dword [esi]
call fcn.005327a4
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x4081eb
test edi, edi
je 0x4081eb
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
jmp 0x4081b5
mov dword [esi + 4], ebx
mov dword [esi + 8], edi
jmp 0x4081b5
cmp edi, 0xffffffff
jne 0x4081b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4081be
mov edx, dword [ebx]
mov ecx, ebx
push eax
push 3
push dword [ebx + 0x10]
mov dword [ebx + 0x5c], 7
call dword [edx + 0x58]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4