joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8c0
Capabilities:
Delete directory
Delete file
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4182ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x62c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x654]
mov dword [esp + 0x64c], 0
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x42108c
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40c931
push 0x42108c
lea ecx, [esp + 0x650]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x1c]
call fcn.004160f0
mov ecx, dword [esp + 0x64c]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
lea edx, [esp + 0x440]
push str._s.
push edx
mov byte [esp + 0x650], 1
call esi
add esp, 0xc
lea eax, [esp + 0x43c]
lea ecx, [esp + 0x1c]
push 0
push eax
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x40cab6
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x650]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x40caaa
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFileName
mov edx, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
mov byte [esp + 0x648], 2
call dword [edx + 0x40]
test eax, eax
je 0x40ca53
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x64c]
push eax
push ecx
lea edx, [esp + 0x44]
push str._s_s
push edx
call esi
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp dword [eax - 8], 2
jle 0x40ca37
lea ecx, [esp + 0x3c]
inc edi
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esp + 0x64c]
push edi
push edx
lea eax, [esp + 0x44]
push str._s_d
push eax
call esi
mov edx, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esp + 0x3c]
push ecx
push edx
call ebx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push edi
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call sub.MFC42.DLL_CString::CString_2
call fcn.0040c8c0
add esp, 8
jmp 0x40ca99
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x64c]
push ecx
push edx
lea eax, [esp + 0x244]
push str._s_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x23c]
push ecx
call ebp
test eax, eax
jne 0x40ca99
lea edx, [esp + 0x23c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x23c]
push eax
call ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x644], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40c990
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::Close
mov ecx, dword [esp + 0x64c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x644], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x64c]
mov dword [esp + 0x644], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x638
ret
Function at 0x40cb20
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4182fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x64c]
mov dword [esp + 0x644], 0
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x42108c
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40cb93
push 0x42108c
lea ecx, [esp + 0x648]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x14]
call fcn.004160f0
mov ecx, dword [esp + 0x644]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
lea edx, [esp + 0x238]
push str._s.
push edx
mov byte [esp + 0x648], 1
call esi
add esp, 0xc
lea eax, [esp + 0x234]
lea ecx, [esp + 0x14]
push 0
push eax
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x40ccb6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x14]
mov ebx, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x40ccae
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::GetFileName
mov edx, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x640], 2
call dword [edx + 0x40]
test eax, eax
je 0x40cc63
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x644]
push eax
push ecx
lea edx, [esp + 0x43c]
push str._s_s
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x438]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.0040cb20
jmp 0x40cc9d
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x644]
push ecx
push edx
lea eax, [esp + 0x3c]
push str._s_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x34]
push ecx
call edi
test eax, eax
jne 0x40cc9d
lea edx, [esp + 0x34]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x34]
push eax
call edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x63c], 1
call sub.MFC42.DLL_CString::CString
test ebx, ebx
jne 0x40cbe5
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::Close
mov ecx, dword [esp + 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x63c], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x644]
mov dword [esp + 0x63c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x634]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x630
ret 4

Function at 0x40cd20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 1
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40cd54
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40cd54
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x40cd60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2b8]
test eax, eax
je 0x40cd8e
mov eax, dword [eax + 4]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0x2b8]
push 0xffffffffffffffff
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret

Function at 0x40cec0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x418338
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x148], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40cf5f
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esp + 0x148]
mov eax, dword [eax]
push edx
push eax
call edi
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x40cf52
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40cf11
jmp 0x40cf5f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040cd20
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x138]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret 4

Function at 0x40cfa0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
mov ebx, dword [esp + 0x130]
push edi
xor edi, edi
test ebx, ebx
jle 0x40d01b
push esi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40d006
cmp dword [esp + 0x14], ebx
je 0x40d001
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40cfd7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop esi
pop edi
pop ebx
add esp, 0x128
ret 4
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop esi
pop edi
pop ebx
add esp, 0x128
ret 4
mov eax, edi
pop edi
pop ebx
add esp, 0x128
ret 4
Function at 0x40d450
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x418408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x30]
xor edi, edi
test ebp, ebp
mov dword [esp + 0x20], 1
mov esi, 0xfffffff2
jle 0x40d5eb
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x422d04]
test eax, eax
jne 0x40d562
mov eax, dword [esp + 0x2c]
push 0
push eax
inc edi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jge 0x40d4c8
mov ecx, dword [esp + 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40d5a3
mov edx, dword [esp + 0x28]
push 0
push edx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
push ecx
mov ecx, esp
jl 0x40d5c6
lea eax, [esp + 0x30]
mov dword [esp + 0x34], esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.00410270
mov esi, eax
test esi, esi
jg 0x40d5eb
mov eax, dword [0x422d04]
test eax, eax
jne 0x40d5e6
mov esi, 0xfffffff2
call ebx
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x15
idiv ecx
add edx, 0xa
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebp
jl 0x40d491
jmp 0x40d5eb
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x422294
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x422c90
call fcn.00402730
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 0xffffd8f0
jmp 0x40d60c
push ecx
lea eax, [esp + 0x30]
mov edx, esp
mov dword [esp + 0x34], esp
push 0x42228c
push eax
push edx
call sub.MFC42.DLL_operator_2
mov ecx, 0x422c90
call fcn.00402730
jmp 0x40d5eb
mov dword [esp + 0x34], esp
lea edx, [esp + 0x2c]
push 0x42228c
push edx
push ecx
call sub.MFC42.DLL_operator_2
mov ecx, 0x422c90
call fcn.00402730
jmp 0x40d5eb
mov esi, 0xffffd8f0
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x18
Function at 0x40d630
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x418438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString_3
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esi + 0x50]
push edi
push ebp
push ebx
push eax
lea ecx, [esp + 0x20]
push str._s_.0f__d
push ecx
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::Format
add esp, 0x18
lea edx, [esp + 0x10]
push edi
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.0040e630
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x290]
test eax, eax
je 0x40d743
fld qword [esp + 0x2c]
fcomp qword [esi + 0x180]
fnstsw ax
test ah, 0x40
je 0x40d743
cmp dword [esi + 0x188], edi
jne 0x40d743
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x14]
mov byte [esp + 0x24], 2
test eax, eax
jl 0x40d705
push edi
push ebp
push ebx
lea eax, [esp + 0x40]
push str.__.0f___.4d_
mov dword [esp + 0x24], 0x64
push eax
jmp 0x40d712
push edi
push ebp
push ebx
lea ecx, [esp + 0x40]
push 0x4222a0
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea edx, [esp + 0x34]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x422c90
call fcn.00402730
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 0x10
Function at 0x40eea0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4187d8
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jge 0x40eeea
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0x2f02
push str.current
push str.finish
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0x2f02
jne 0x40ef2c
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
mov dword [edx], eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xc
ret
Function at 0x40f3e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push esi
mov esi, ecx
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x40f3fc
pop esi
add esp, 0x10
ret 8
mov word [esp + 4], 2
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x1c]
push ecx
mov eax, dword [edx]
mov dword [esp + 0xc], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 0x40], eax
ja 0x40f43a
xor eax, eax
pop esi
add esp, 0x10
ret 8
lea edx, [esp + 4]
push 0x10
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x40f47b
mov eax, dword [esi + 0x40]
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi + 0x40], 0
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x40f8a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x4188e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebx
push esi
mov esi, ecx
mov eax, dword [0x422d00]
mov ecx, dword [esp + 0xa4]
push eax
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xa4], ebx
call fcn.0040f3e0
test eax, eax
je 0x40f9ec
mov eax, dword [esi + 0x40]
push ebx
lea edx, [esp + 0xe]
push 2
push edx
push eax
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jle 0x40f9cb
cmp byte [esp + 0xa], 0x4b
jne 0x40f9cb
mov ecx, dword [0x422cbc]
mov edx, dword [0x422ce4]
mov eax, dword [0x422ce0]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x422cf0]
push edx
mov edx, dword [0x422cd8]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x1c], 0x578
call fcn.0040c5f0
mov ecx, dword [0x422ccc]
mov edx, dword [0x422cac]
push eax
mov eax, dword [0x422cd0]
push eax
push ecx
push edx
push 0x422cb8
lea eax, [esp + 0x38]
push str._s_s_d_d_d_s_d_.0f
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esi + 0x40]
add esp, 0x2c
lea ecx, [esp + 0xc]
push ebx
push 0x88
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jg 0x40f9a6
mov eax, dword [esi + 0x40]
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x40]
push ecx
jmp 0x40f9e3
lea ecx, [esp + 0xa4]
mov dword [esi + 0x3c], 1
mov dword [esp + 0x9c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40fa05
mov edx, dword [esi + 0x40]
push 2
push edx
call dword [sym.imp.WSOCK32.dll_shutdown]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi + 0x40], ebx
lea ecx, [esp + 0xa4]
mov dword [esp + 0x9c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x94]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x98
ret 4

Function at 0x40fa20
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x40ffc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret

Function at 0x40fa50
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [ecx + 0x3c], 1
push eax
push 0
push ecx
push 0x4159c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x410590
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x418a1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x140]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x138], ebx
jge 0x4106a8
mov eax, dword [esp + 0x14c]
cmp dword [eax - 8], ebx
jne 0x41061f
cmp edi, 0xffffffff
jge 0x41060e
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.0040c0f0
add esp, 8
push eax
lea ecx, [esp + 0x150]
mov byte [esp + 0x13c], 1
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], bl
call sub.MFC42.DLL_CString::CString
jmp 0x41061f
push 0x42259c
lea ecx, [esp + 0x150]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov dword [esi + 0x17c], ebx
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [esp + 0x14c]
mov eax, dword [0x422cac]
push edx
push eax
lea ecx, [esp + 0x14]
push str.__s__s
push ecx
mov byte [esp + 0x148], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0xc]
lea ecx, [esp + 0x14c]
push edx
call sub.MFC42.DLL_CString::operator_2
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x422c90
call fcn.00402730
mov ecx, dword [esi + 0x2b8]
cmp ecx, ebx
je 0x410698
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x2b8], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], bl
call sub.MFC42.DLL_CString::CString
cmp edi, 0x79
jne 0x4106b3
mov dword [esi + 0x17c], ebx
mov eax, dword [esp + 0x144]
mov edx, dword [esp + 0x14c]
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x30]
push 0x4211d4
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esi + 0x40]
add esp, 0xc
lea ecx, [esp + 0x18]
push ebx
push 0x118
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0x118
je 0x410723
lea ecx, [esp + 0x14c]
mov dword [esp + 0x138], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x41074e
cmp edi, ebx
jl 0x41072c
cmp edi, 0x64
jl 0x410732
mov dword [esi + 0x290], ebx
lea ecx, [esp + 0x14c]
mov dword [esp + 0x138], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x130
ret 0x10
Function at 0x410f30
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x418b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 2
mov edi, 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString_3
mov ebp, dword [sym.imp.MSVCRT.dll__access]
mov byte [esp + 0x2c], 4
mov esi, edi
mov bl, 5
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0x20]
push str._s__.4d.rar
push ecx
mov byte [esp + 0x3c], bl
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x48]
push edx
push eax
lea ecx, [esp + 0x2c]
push 0x42144c
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x5c]
push edx
push eax
lea ecx, [esp + 0x38]
push 0x42144c
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x44]
push 0
push edx
call ebp
add esp, 0x38
test eax, eax
jl 0x411052
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 2
push 0
push 0
push 0x40c0d0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov edi, eax
test edi, edi
jne 0x411052
lea edx, [esp + 0x14]
push str._copy
lea eax, [esp + 0x20]
push edx
push eax
call sub.MFC42.DLL_operator_2
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
push eax
push ecx
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_operator
mov ecx, 0x422c90
call fcn.00402730
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::CString
inc esi
cmp esi, 0x41
jl 0x410f7f
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret