joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x6c], eax
xor eax, eax
push ebp
push 0x406526
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x406534
push 0x406540
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
push 0x40654c
push 0x406560
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
push 0x406570
push 0x406560
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
xor ebx, ebx
call sub.user32.dll_GetDesktopWindow
mov esi, eax
push 0
push 0x406584
push ebx
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 7
lea eax, [ebp - 0x65]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x65]
mov ecx, 0x65
call fcn.00403344
mov eax, dword [ebp - 0x6c]
mov edx, 0x406594
call fcn.004034a8
jne 0x40649e
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
test ebx, ebx
jne 0x406457
push 0
push 0x40659c
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
push 0x4065ac
push 0x4065b8
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
mov eax, 0x4065cc
call fcn.0040662c
mov eax, 0x4065e0
call fcn.0040662c
mov eax, 0x4065f4
call fcn.0040662c
mov eax, 0x406608
call fcn.0040662c
mov eax, 0x406620
call fcn.0040662c
call fcn.004060e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40652d
lea eax, [ebp - 0x6c]
call fcn.0040311c
ret
Function at 0x40662c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x406748
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.00405448
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00405468
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x406714
lea eax, [ebp - 0x134]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403344
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00404728
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 4]
call fcn.004046f0
test eax, eax
je 0x4066ed
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403344
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 4]
call fcn.004046f0
test eax, eax
jne 0x406705
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.00405488
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x406692
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40674f
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x4068f0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x406aa2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x406ab0
call fcn.00403314
cmp dword [ebp - 4], 0
je 0x406a7a
cmp byte [0x419008], 0
je 0x406947
lea eax, [ebp - 0x18]
call fcn.004068a0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x40782c
call fcn.004033a8
jmp 0x40695f
lea eax, [ebp - 0x1c]
call fcn.00406850
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov ecx, 0x40783c
call fcn.004033a8
mov eax, dword [ebp - 0x10]
call fcn.0040496c
test al, al
je 0x406a7a
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.0040497c
mov esi, eax
cmp esi, 0xffffffff
je 0x406a7a
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.0040368c
mov eax, dword [ebp - 0xc]
call fcn.0040355c
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404620
mov edx, dword [ebp - 4]
mov eax, 0x407858
call fcn.00403644
mov ebx, eax
test ebx, ebx
jne 0x4069d3
mov eax, dword [ebp - 4]
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x4069d3
inc ebx
test ebx, ebx
je 0x406a74
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004035bc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.004048b4
lea ecx, [ebx + 1]
lea eax, [ebp - 4]
mov edx, 1
call fcn.004035fc
cmp dword [ebp - 8], 0
je 0x406a4a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00403644
test eax, eax
jne 0x406a4a
lea eax, [ebp - 8]
mov edx, 0x407858
call fcn.00403364
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0040335c
push eax
mov eax, dword [ebp - 8]
call fcn.0040355c
push eax
push esi
call sub.kernel32.dll_WriteFile_1
mov edx, dword [ebp - 4]
mov eax, 0x407858
call fcn.00403644
mov ebx, eax
test ebx, ebx
jne 0x406a6c
mov eax, dword [ebp - 4]
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x406a6c
inc ebx
test ebx, ebx
jne 0x4069db
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406aa9
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403140
ret
Function at 0x40785c
Capabilities:
Create process on windows
Create thread
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov byte [ebp - 1], al
mov esi, 0x40c7fc
xor eax, eax
push ebp
push 0x407a42
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x40b158]
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4078a1
mov eax, dword [0x40b158]
call sub.kernel32.dll_GetACP
cmp ebx, eax
jne 0x407a27
mov eax, dword [0x40b158]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov edx, 0x40c7e4
xor eax, eax
call fcn.004026c4
mov eax, 0x100000
call fcn.00402494
mov dword [0x40c7e8], eax
cmp dword [esi], 0x100000
jg 0x407a27
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.004026c4
mov eax, dword [ebp - 0x24]
mov edx, 0x40
call fcn.0040497c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407a27
mov eax, dword [esi]
call fcn.00402494
mov dword [0x40c7ec], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [0x40c7ec]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi]
jne 0x407a27
push 0x40c7f4
mov ecx, 0x40c7f0
mov edx, dword [esi]
mov eax, dword [0x40c7ec]
call fcn.004050c4
test al, al
je 0x407a27
call fcn.00407cb4
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocalTime
mov edx, dword [0x40b158]
mov edx, dword [edx + 0xc]
movzx eax, word [ebp - 0x20]
cmp edx, eax
jl 0x407a27
mov ecx, dword [0x40b158]
cmp edx, eax
jne 0x4079a3
mov edx, dword [0x40b158]
mov edx, dword [edx + 0x10]
movzx eax, word [ebp - 0x1e]
cmp edx, eax
jl 0x407a27
mov ecx, dword [0x40b158]
cmp edx, eax
jne 0x4079a3
movzx eax, word [ebp - 0x1a]
mov edx, dword [0x40b158]
cmp eax, dword [edx + 0x14]
jge 0x407a27
call fcn.00409fcc
test al, al
jne 0x407a27
call fcn.004068f0
call fcn.004063dc
push 0
push 0x407a50
call sub.kernel32.dll_WinExec
mov ecx, 0x407a78
mov edx, 0x407a80
mov eax, 0x80000002
call fcn.00405204
test al, al
jne 0x4079f0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40a1ac
push 0
push 0
call sub.kernel32.dll_CreateThread
cmp byte [ebp - 1], 0
je 0x407a0c
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x40a2e0
push 0
push 0
call sub.kernel32.dll_CreateThread
call fcn.00408188
lea eax, [ebp - 0x28]
call fcn.004093b8
mov eax, dword [ebp - 0x28]
mov edx, dword [0x40c7e4]
call fcn.00408f88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a49
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403140
ret
Function at 0x407ac8
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
lea edi, [ebp - 0x2c]
xor eax, eax
push ebp
push 0x407bf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x407bb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, 0x407c0c
call fcn.004033a8
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0xc]
call fcn.00409238
mov eax, dword [ebp - 0xc]
call fcn.00403c24
mov esi, eax
test esi, esi
jl 0x407bae
inc esi
xor ebx, ebx
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.0040355c
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x1c], eax
push 0
push 0
push 0x407c10
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
je 0x407b76
push 0
push 0
push 0
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
jne 0x407baa
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x34]
mov ecx, 0x407c1c
call fcn.004033a8
mov eax, dword [ebp - 0x34]
xor edx, edx
call fcn.00409728
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.0040355c
push eax
call sub.mpr.dll_WNetCancelConnectionA
inc ebx
dec esi
jne 0x407b36
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407bc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407bfa
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403140
lea eax, [ebp - 0xc]
mov edx, dword [0x407aa4]
call fcn.00403de4
lea eax, [ebp - 4]
call fcn.0040311c
ret

Function at 0x407c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
xor eax, eax
push ebp
push 0x407ca5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.0040455c
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 1
test ebx, ebx
jne 0x407c63
lea ebx, [ebp - 0x58]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040355c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407cac
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x408534
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], eax
mov edi, 0x40c7dc
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [esp]
call fcn.0040311c
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4085ce
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4085c2
test ebx, ebx
jne 0x408592
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [esp]
call fcn.004047c8
mov eax, dword [edi]
call fcn.00403c1c
inc eax
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x40682c]
call fcn.00403dd8
add esp, 4
mov eax, dword [edi]
call fcn.00403c24
mov edx, dword [edi]
mov ecx, dword [esi + ebx*4]
mov ecx, dword [ecx]
mov dword [edx + eax*4], ecx
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x40857e
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408ccc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
xor eax, eax
push ebp
push 0x408d69
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.0040311c
mov eax, dword [ebp - 4]
call fcn.0040355c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408d53
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408d47
test ebx, ebx
jne 0x408d46
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.004047c8
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x408d29
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d70
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x408d78
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
mov eax, dword [ebp - 8]
call fcn.0040354c
xor eax, eax
push ebp
push 0x408f52
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x20
call fcn.00402794
mov eax, dword [ebp - 4]
call fcn.0040355c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x408f2a
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0x2000
mov eax, dword [ebp - 0x18]
call fcn.00402494
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x408f11
cmp eax, 0xea
jne 0x408e68
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004024d4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x408f2a
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
dec eax
test eax, eax
jl 0x408e01
inc eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403314
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
call fcn.004034a8
je 0x408f00
mov byte [ebp - 0x21], 0
mov eax, dword [0x40c7e0]
call fcn.00403c24
mov ebx, eax
test ebx, ebx
jl 0x408ee4
inc ebx
xor edi, edi
lea eax, [ebp - 0x54]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403314
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x20]
call fcn.00408ccc
mov eax, dword [0x40c7e0]
mov eax, dword [eax + edi*4]
cmp eax, dword [ebp - 0x20]
jne 0x408ee0
mov byte [ebp - 0x21], 1
jmp 0x408ee4
inc edi
dec ebx
jne 0x408eb1
cmp byte [ebp - 0x21], 0
jne 0x408f00
lea eax, [ebp - 0x58]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403314
mov eax, dword [ebp - 0x58]
call fcn.00407ac8
add esi, 0x20
dec dword [ebp - 0x28]
jne 0x408e7f
jmp 0x408e01
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x408f2a
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f59
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00403140
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403140
ret
Function at 0x409238
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
xor eax, eax
push ebp
push 0x40939a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x20
call fcn.00402794
mov eax, dword [ebp - 4]
call fcn.0040355c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40937c
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov eax, dword [ebp - 0x14]
call fcn.00402494
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x409363
cmp eax, 0xea
jne 0x409301
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004024d4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x40937c
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x40929a
inc esi
mov eax, dword [ebx]
call fcn.00403c1c
inc eax
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x406800]
call fcn.00403dd8
add esp, 4
mov eax, dword [ebx]
call fcn.00403c24
mov edx, dword [ebx]
lea eax, [edx + eax*4]
push eax
lea eax, [ebp - 0x3c]
mov edx, dword [edi + 0x14]
add edx, 2
call fcn.00403314
mov ecx, dword [ebp - 0x3c]
mov edx, 0x4093b4
pop eax
call fcn.004033a8
add edi, 0x20
dec esi
jne 0x409311
jmp 0x40929a
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x40937c
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093a1
lea eax, [ebp - 0x3c]
call fcn.0040311c
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x409464
Capabilities:
Get file size
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
xor eax, eax
push ebp
push 0x40962c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0040497c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409616
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xa00000
jae 0x409610
cmp esi, dword [0x40c7fc]
jl 0x40953b
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x40c7fc]
push eax
mov eax, dword [0x40c7e8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, dword [0x40c7f4]
sub eax, dword [0x40c7ec]
add eax, dword [0x40c7f0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x40c7f4]
sub ecx, dword [0x40c7ec]
mov edx, dword [0x40c7ec]
mov eax, dword [0x40c7e8]
call fcn.004093e8
test al, al
je 0x409537
mov eax, dword [0x40c7ec]
mov edx, dword [ebp - 0xc]
lea edx, [eax + edx]
mov eax, dword [0x40c7e8]
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [0x40c7fc]
sub ecx, dword [ebp - 0xc]
call fcn.004093e8
test al, al
je 0x409537
xor eax, eax
jmp 0x40953d
mov al, 1
jmp 0x40953d
mov al, 1
test al, al
je 0x409610
mov eax, esi
call fcn.00402494
mov edi, eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00404620
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, dword [0x40c7ec]
mov ecx, dword [0x40c7fc]
mov eax, ebx
call fcn.004049f8
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.004049f8
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, edi
call fcn.004050c4
test al, al
je 0x4095f5
cmp dword [ebp - 0x28], 0
jbe 0x4095f5
cmp dword [ebp - 0x2c], 0
je 0x4095f5
mov esi, dword [0x40c7f4]
sub esi, dword [0x40c7ec]
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_SetFilePointer
cmp esi, eax
jne 0x4095f5
mov edx, dword [ebp - 0x28]
mov eax, dword [0x40c7f0]
call fcn.00407a9c
mov ecx, eax
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004049f8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov edx, esi
mov eax, edi
call fcn.004024b4
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409633
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x409640
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040354c
xor eax, eax
push ebp
push 0x4096ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
mov ecx, 0x409718
mov edx, dword [ebp - 4]
call fcn.004033a8
mov eax, dword [ebp - 0xc]
call fcn.0040496c
test al, al
jne 0x4096dc
lea eax, [ebp - 0x10]
mov ecx, 0x409718
mov edx, dword [ebp - 4]
call fcn.004033a8
mov eax, dword [ebp - 0x10]
call fcn.004049d4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4096dc
lea edx, [ebp - 8]
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.004049f8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
push 6
lea eax, [ebp - 0x14]
mov ecx, 0x409718
mov edx, dword [ebp - 4]
call fcn.004033a8
mov eax, dword [ebp - 0x14]
call fcn.0040355c
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409706
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x40a098
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.0040354c
mov eax, dword [ebp - 0x18]
call fcn.0040354c
mov eax, dword [ebp - 0x1c]
call fcn.0040354c
xor eax, eax
push ebp
push 0x40a19c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.0040355c
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040355c
mov edx, eax
mov eax, dword [0x40c650]
pop ecx
call fcn.0040a020
pop ecx
test al, al
je 0x40a181
mov eax, dword [ebp - 0x1c]
call fcn.0040496c
test al, al
je 0x40a112
mov eax, dword [ebp - 0x1c]
call fcn.0040355c
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x40a166
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.0040355c
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a170
mov eax, dword [ebp - 0x10]
call fcn.00404564
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a1a3
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403140
ret