joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40594c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405adc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 2
jl 0x405ab1
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x405af4
mov edx, dword [ebp - 4]
call fcn.004038f0
mov eax, dword [ebp - 0x150]
call fcn.00403aa4
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405a89
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040388c
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004038f0
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040388c
test byte [ebp - 0x14c], 0x10
je 0x405a52
mov eax, dword [ebp - 0xc]
mov edx, 0x405b00
call fcn.004039f0
je 0x405a74
mov eax, dword [ebp - 0xc]
mov edx, 0x405b0c
call fcn.004039f0
je 0x405a74
lea eax, [ebp - 0x158]
mov ecx, 0x405b18
mov edx, dword [ebp - 8]
call fcn.004038f0
mov eax, dword [ebp - 0x158]
call fcn.0040594c
jmp 0x405a74
mov eax, dword [ebp - 8]
call fcn.00403aa4
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x405a74
push 0x20
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4059d1
push ebx
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.00403aa4
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x405ab1
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ae3
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403750
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403750
ret
Function at 0x405c68
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x405d78
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004054a4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 4]
call fcn.004037c4
xor edx, edx
mov eax, 2
call fcn.00405214
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405234
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x405d48
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040388c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004054a4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004039f0
jne 0x405d39
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.00405254
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405cea
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d7f
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00403750
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x4061d8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406265
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406243
test ebx, ebx
je 0x406243
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.0040385c
jmp 0x40624a
mov eax, esi
call fcn.0040372c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40626c
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4065dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40663c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.0040388c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.00405468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406643
lea eax, [ebp - 0x1c]
call fcn.0040372c
ret

Function at 0x406648
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4066c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040388c
lea eax, [ebp - 0x10c]
mov edx, 0x4066dc
call fcn.004038ac
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004054a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066ce
lea eax, [ebp - 0x10c]
call fcn.0040372c
ret
Function at 0x4067e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406887
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4156c4], eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40688e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret

Function at 0x406898
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40695c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403bd4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
jne 0x40692f
mov eax, dword [ebx]
call fcn.00403aa4
mov edx, eax
mov eax, ebx
call fcn.0040385c
jmp 0x406936
mov eax, ebx
call fcn.0040372c
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406963
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret
Function at 0x40696c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406a40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4156c4], eax
cmp dword [ebp + 8], 0
jne 0x4069d9
lea eax, [ebp + 8]
mov edx, 0x406a58
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
push eax
lea eax, [ebp + 8]
call fcn.00403afc
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a47
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
lea eax, [ebp + 8]
call fcn.0040372c
ret

Function at 0x406a5c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406b01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4156c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b08
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret

Function at 0x406b14
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406b96
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406bac
call fcn.00405900
test al, al
jne 0x406b80
mov eax, dword [ebp - 4]
call fcn.00403aa4
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4156c0
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b9d
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x406c40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406ccf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406c80
lea eax, [ebp - 8]
mov edx, 0x406ce8
call fcn.004037c4
mov eax, dword [ebp - 8]
call fcn.004038a4
push eax
lea eax, [ebp - 8]
call fcn.00403afc
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cd6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret

Function at 0x406cec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406d4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d56
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x406d60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406df6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406dfd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret
Function at 0x407228
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x407486
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40749c
call fcn.00403780
lea eax, [ebp - 4]
mov ecx, 0x4074fc
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407510
mov edx, 0x407520
mov eax, 0x80000002
call fcn.0040696c
mov ecx, 0x4074fc
lea eax, [ebp - 8]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x407510
mov edx, 0x407558
mov eax, 0x80000001
call fcn.0040696c
mov ecx, 0x4074fc
lea eax, [ebp - 0xc]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407510
mov edx, 0x4075a0
mov eax, 0x80000002
call fcn.0040696c
lea eax, [ebp - 0x10]
mov ecx, 0x4075e0
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407520
mov ecx, 0x4075f4
mov eax, 0x80000001
call fcn.0040696c
lea eax, [ebp - 0x14]
mov ecx, 0x407604
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407558
mov ecx, 0x407618
mov eax, 0x80000002
call fcn.0040696c
mov eax, 0x415b14
mov edx, 0x407628
call fcn.00403780
cmp byte [0x415b58], 0
jne 0x40746b
push 0
mov ecx, 0x40768c
mov edx, 0x4076a4
mov eax, 0x80000002
call fcn.0040696c
push 0x4076d8
mov edx, 0x4076a4
mov ecx, 0x4076e8
mov eax, 0x80000002
call fcn.0040696c
push 0x407700
mov edx, 0x4076a4
mov ecx, 0x407738
mov eax, 0x80000002
call fcn.0040696c
push 0x40774c
mov edx, 0x4076a4
mov ecx, 0x407768
mov eax, 0x80000002
call fcn.0040696c
push 0x40777c
mov edx, 0x4076a4
mov ecx, 0x407790
mov eax, 0x80000002
call fcn.0040696c
push 0x4077a0
mov edx, 0x4076a4
mov ecx, 0x4077b4
mov eax, 0x80000002
call fcn.0040696c
mov ecx, 0x4074fc
lea eax, [ebp - 0x18]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x4076a4
mov ecx, 0x4077c8
mov eax, 0x80000002
call fcn.0040696c
push 1
mov edx, 0x4076a4
mov ecx, 0x4077dc
mov eax, 0x80000002
call fcn.00406a5c
push 3
mov edx, 0x4076a4
mov ecx, 0x4077f4
mov eax, 0x80000002
call fcn.00406a5c
push 2
mov edx, 0x4076a4
mov ecx, 0x407810
mov eax, 0x80000002
call fcn.00406a5c
push 0x120
mov edx, 0x4076a4
mov ecx, 0x407820
mov eax, 0x80000002
call fcn.00406a5c
mov eax, 0x415b14
mov edx, 0x407830
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40748d
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403750
ret
Function at 0x40bafc
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40bb04
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40bd3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40bd54
call fcn.00403780
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40bd20
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40bb8a
cmp eax, 0xea
jne 0x40bcfa
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40bb62
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40bbac
lea eax, [esi + edi*8]
call fcn.0040bafc
cmp dword [esi + edi*8 + 8], 3
jne 0x40bceb
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040385c
mov edx, dword [ebp - 0x14]
mov eax, 0x415afc
mov ecx, 0x40bdb8
call fcn.004038f0
inc dword [0x415b40]
mov eax, 0x415b14
mov edx, 0x40bdc4
call fcn.00403780
mov eax, dword [0x415b40]
cmp eax, dword [0x415b44]
jl 0x40bceb
mov eax, dword [0x415b40]
push eax
mov ecx, 0x40be24
mov edx, 0x40be34
mov eax, 0x80000002
call fcn.00406a5c
mov eax, dword [0x415afc]
push eax
mov edx, 0x40be34
mov ecx, 0x40be7c
mov eax, 0x80000002
call fcn.0040696c
xor eax, eax
mov dword [0x415b3c], eax
mov word [0x4141f0], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x415ad8]
call fcn.004038a4
mov ecx, eax
mov edx, 3
mov eax, dword [0x415afc]
call fcn.00403b04
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00405468
mov eax, dword [ebp - 0x18]
mov edx, dword [0x415ad8]
call fcn.004039f0
jne 0x40bc96
lea eax, [ebp - 0x20]
mov ecx, dword [0x415afc]
mov edx, 0x40be8c
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.0041328c
jmp 0x40bcbb
mov eax, dword [0x415afc]
call fcn.0040b2a4
lea eax, [ebp - 0x24]
mov ecx, dword [0x415afc]
mov edx, 0x40bea0
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.0041328c
mov eax, 0x415b14
mov edx, 0x40beb0
call fcn.00403780
xor eax, eax
mov dword [0x415b38], eax
mov eax, dword [0x415b38]
push eax
mov edx, 0x40be34
mov ecx, 0x40bf10
mov eax, 0x80000002
call fcn.00406a5c
inc ebx
dec dword [ebp - 0x10]
jne 0x40bb98
jmp 0x40bb62
mov eax, esi
call fcn.004024f0
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40bd20
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00406310
mov eax, dword [ebp - 0x28]
call fcn.0041328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd42
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00403750
ret
Function at 0x40c204
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40c3fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40c414
call fcn.00403780
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
jle 0x40c2a9
lea eax, [ebp - 4]
mov edx, 0x40c47c
call fcn.004038ac
push 0
mov eax, dword [ebp - 4]
call fcn.004038a4
push eax
lea eax, [ebp - 4]
call fcn.00403afc
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
test bl, bl
jne 0x40c2a9
mov edx, esi
mov eax, edi
call fcn.00405420
jmp 0x40c3d0
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
invalid
Function at 0x40cd24
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x40cd64
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40cd70
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40cd90
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40d8ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d951
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40d968
call fcn.00403780
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040388c
mov edx, dword [ebp - 4]
mov eax, 0x40d9cc
call fcn.00403b8c
test eax, eax
jne 0x40d939
mov edx, dword [ebp - 4]
mov eax, 0x40d9dc
call fcn.00403b8c
test eax, eax
jne 0x40d939
mov edx, dword [ebp - 4]
mov eax, 0x40d9f0
call fcn.00403b8c
test eax, eax
jne 0x40d939
xor ebx, ebx
jmp 0x40d93b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d958
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x41078c
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x41094e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x410964
call fcn.00403780
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004054a4
mov edx, dword [ebp - 4]
mov eax, 0x415ae8
call fcn.00403780
cmp byte [0x415b59], 0
jne 0x4107f7
mov eax, dword [0x415ae8]
push eax
mov ecx, 0x4109c8
mov edx, 0x4109d8
mov eax, 0x80000002
call fcn.0040696c
cmp byte [0x415b59], 0
je 0x41080a
call fcn.00410c80
jmp 0x410933
xor ebx, ebx
push 0
push 0x410a18
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x41082a
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x41080c
mov eax, 0x415b14
mov edx, 0x410a30
call fcn.00403780
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x410a90
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0x410a98
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x410870
push 0x410aa4
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4108d5
push 0x410ab0
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4108d5
call eax
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x410ac8
call fcn.00404dec
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x415b14
mov edx, 0x410ad8
call fcn.00403780
mov edx, 0x410b30
mov eax, 0x415b6c
mov ecx, 0xbb8
call fcn.004066e0
test al, al
je 0x410933
mov eax, 0x415b14
mov edx, 0x410b60
call fcn.00403780
call fcn.00410c80
mov eax, 0x415b14
mov edx, 0x410bc4
call fcn.00403780
call fcn.00413114
mov eax, 0x415b14
mov edx, 0x410c20
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410955
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret