joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a400
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1020
call fcn.004b63b0
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x101c], eax
mov eax, dword [esp + 0x1024]
push ebx
push ebp
mov ebp, dword [esp + 0x1030]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1034]
push esi
mov dword [esp + 0x24], eax
xor esi, esi
mov eax, dword [esp + 0x103c]
push edi
mov dword [esp + 0x24], eax
xor edi, edi
mov eax, dword [esp + 0x1044]
push ebp
mov dword [esp + 0x1c], eax
call fcn.004ca943
pop ecx
jmp 0x44a510
push ebp
push 0x1000
lea eax, [esp + 0x34]
push 1
push eax
call fcn.004bd0d6
add esp, 0x10
mov dword [esp + 0x10], eax
call fcn.004bb8cc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
or eax, 0xffffffff
sub eax, ecx
cmp esi, eax
ja 0x44a5ce
lea eax, [ecx + esi]
mov dword [esp + 0x1c], eax
cmp eax, edi
jb 0x44a4e1
test ebx, ebx
je 0x44a4b5
cmp edi, 0x7fffffff
ja 0x44a5ce
add edi, edi
jmp 0x44a4c4
lea eax, [ecx + 1]
mov ecx, 0x1000
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
push edi
push ebx
call fcn.00441e99
pop ecx
pop ecx
test eax, eax
je 0x44a562
mov ebx, eax
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x1c], edi
jae 0x44a4a1
push ebp
call fcn.004ca96f
pop ecx
test eax, eax
jne 0x44a59f
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esi + ebx]
push eax
call fcn.004b8970
mov esi, dword [esp + 0x28]
push ebp
call fcn.004ca943
add esp, 0x10
test eax, eax
je 0x44a461
push ebp
call fcn.004bcd32
pop ecx
test edi, edi
jne 0x44a532
push 1
push 1
call fcn.00441e16
pop ecx
pop ecx
mov ebx, eax
xor esi, esi
mov eax, dword [esp + 0x24]
mov byte [esi + ebx], 0
test eax, eax
je 0x44a540
mov dword [eax], esi
mov ecx, dword [esp + 0x28]
xor eax, eax
inc eax
mov dword [ecx], ebx
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x1020
ret
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push edi
push edi
push 0x52a2c8
push 0x52a2fc
push 0x502514
call fcn.00451b36
add esp, 0x10
push eax
push 0xd
call fcn.00449b7d
push eax
push dword [esp + 0x2c]
call fcn.004418a5
add esp, 0x18
jmp 0x44a5fb
push dword [esp + 0x14]
call fcn.00458495
mov edi, dword [esp + 0x24]
mov esi, eax
push edi
call fcn.00447d32
pop ecx
pop ecx
push eax
push esi
push 0x52a330
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00449a7e
pop ecx
push eax
jmp 0x44a58b
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push 0x52a350
call fcn.00451b5b
pop ecx
push eax
push 0x18
call fcn.00449b7d
push eax
push dword [esp + 0x28]
call fcn.004418a5
add esp, 0x14
push esi
call fcn.00441dce
push ebx
call fcn.00441dce
push ebp
call fcn.004bcd32
add esp, 0xc
xor eax, eax
jmp 0x44a549

Function at 0x44b172
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1505
jmp 0x44b186
imul ecx, ecx, 0x21
movsx eax, al
add ecx, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x44b17d
mov eax, ecx
ret
Function at 0x44d226
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push edi
push 0x34
call fcn.00446395
mov ecx, dword [esp + 0x18]
mov edi, eax
push dword [esp + 0x24]
xor eax, eax
xor ebp, ebp
inc eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ebp
mov dword [edi + 0x10], 2
mov dword [edi + 4], eax
call fcn.00447c7a
push ebp
push ebp
mov dword [edi + 0x18], eax
call fcn.0044ad70
mov dword [edi + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 4
push edi
push 0x44d4e0
push dword [esp + 0x38]
push ebp
call fcn.004caaf7
add esp, 0x28
mov dword [edi + 0x30], eax
test eax, eax
jne 0x44d29a
mov ebx, 0x52a788
jmp 0x44d2e9
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44d2a6
mov eax, dword [eax]
jmp 0x44d2b3
call dword [0x4fe1b8]
push eax
call dword [0x4fe1c0]
cmp eax, 0x7fffffff
jne 0x44d2c1
mov ebx, 0x52a7a0
jmp 0x44d2e9
push eax
push dword [edi + 0x30]
call dword [0x4fe1bc]
test eax, eax
jne 0x44d2d6
mov ebx, 0x52a7c8
jmp 0x44d2e9
push dword [edi + 0x30]
call dword [0x4fe1c8]
cmp eax, 0xffffffff
jne 0x44d33f
mov ebx, 0x52a7ec
push esi
call dword [0x4fe0c4]
push eax
call fcn.0045621f
pop ecx
mov esi, eax
push esi
push ebx
push 0x5037b0
push ebp
call fcn.00441a43
push eax
push dword [esp + 0x44]
call fcn.004418a5
push esi
call fcn.00441dce
add esp, 0x1c
pop esi
cmp dword [edi + 0x30], ebp
je 0x44d328
push dword [edi + 0x30]
call dword [0x4fe0c0]
push dword [edi + 0x24]
call fcn.0044b111
push edi
push 0x34
call fcn.004463df
add esp, 0xc
xor eax, eax
jmp 0x44d341
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x45fc56
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
test byte [ebp + 0x76180844], 0x23

Function at 0x45ff65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0045fc10
inc esi
inc eax
sbb edi, eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
in eax, dx
salc

Function at 0x45ff8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf

Function at 0x467b3b
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x78e344
push edi
call fcn.0044d056
mov esi, eax
pop ecx
test esi, esi
jne 0x467b78
push 0x467e0b
push fcn.00441dce
push fcn.0044b15d
push fcn.0044b172
call fcn.0044ad85
mov esi, eax
push esi
push edi
call fcn.0044d0f2
add esp, 0x18
mov ebp, dword [esp + 0x1c]
push ebp
call fcn.00467d9e
test eax, eax
mov ebx, 0x52ae14
push ebp
push esi
cmovne ebx, eax
call fcn.0044ac12
mov edi, eax
add esp, 0xc
test edi, edi
je 0x467bb3
cmp dword [edi], 0
je 0x467bb3
push ebx
push dword [edi]
call fcn.004bb3f0
pop ecx
pop ecx
test eax, eax
je 0x467c5a
push ebp
push esi
call fcn.0044ade6
push 8
call fcn.0044c9bf
push 0
push 0x503798
push ebx
mov dword [esp + 0x28], eax
call fcn.004481b8
add esp, 0x18
mov dword [esp + 0x14], eax
mov edi, eax
mov ecx, dword [eax]
test ecx, ecx
je 0x467bff
mov ebp, dword [esp + 0x10]
push ecx
push ebp
call fcn.004677c9
pop ecx
pop ecx
lea edi, [edi + 4]
mov ecx, dword [edi]
test ecx, ecx
jne 0x467be5
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call fcn.00447f62
mov dword [esp], 0x52ae14
call fcn.00447c7a
mov edi, dword [esp + 0x14]
push eax
push edi
call fcn.0044c720
push 0
push edi
call fcn.0044c720
push 8
push 1
call fcn.00441e05
push ebx
mov edi, eax
call fcn.00447c7a
push 0
push dword [esp + 0x34]
mov dword [edi], eax
call fcn.0044c74b
add esp, 0x28
mov dword [edi + 4], eax
push edi
push ebp
call fcn.00447c7a
pop ecx
push eax
push esi
call fcn.0044aa72
add esp, 0xc
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4b6c32
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x4fe1dc]
test eax, eax
je 0x4b6c71
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b6c71
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b6c71
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4b6c71
cmp dword [ecx + 0x74], 0xe
jbe 0x4b6c71
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4f0a56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push dword [ebp + 8]
call fcn.004f0a27
mov esi, eax
pop ecx
test esi, esi
je 0x4f0af3
mov eax, dword [esi + 0x3c]
push edi
mov edi, dword [eax + esi + 0x78]
mov edx, dword [eax + esi + 0x7c]
add edi, esi
dec edx
add edx, edi
mov dword [ebp - 8], edx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4f0af2
mov ecx, dword [edi + 0x1c]
add eax, esi
mov dword [ebp - 4], eax
add ecx, esi
mov eax, dword [edi + 0x24]
push ebx
add eax, esi
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp dword [edi + 0x18], ebx
jbe 0x4f0af1
movzx eax, word [eax + ebx*2]
mov ecx, dword [ecx + eax*4]
add ecx, esi
cmp ecx, edi
jb 0x4f0ab9
cmp ecx, edx
jbe 0x4f0ae5
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 1
mov eax, dword [eax + ebx*4]
add eax, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
call dword [ebp + 0xc]
pop ecx
pop ecx
test eax, eax
je 0x4f0af1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc ebx
mov ecx, dword [ebp - 0x10]
cmp ebx, dword [edi + 0x18]
jb 0x4f0aa8
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4f3890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4f38bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4f38bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, reloc.kernel32.dll_SetUnhandledExceptionFilter
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0xc3904b6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7e680367
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401bab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4052e8
cmp dword [edi], ebx
je 0x401c50
push str._mozilla.org_observer_service_1
mov edx, 0x4058bc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00403951
mov eax, dword [ebp - 4]
test eax, eax
je 0x401c30
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00403a3e
mov eax, dword [ebp - 4]
test eax, eax
je 0x401c50
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401c87
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401c87
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00402a9d
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.0040355e
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x401ca3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x401cb0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x401cbc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x401ccc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002ea5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
jne 0x1002ebd
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp + 8], eax
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002f3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
je 0x1002f3a
cmp ebx, 2
je 0x1002f3a
cmp ebx, 5
jne 0x1002ee7
xor esi, esi
jmp 0x1002f5e
test ebx, ebx
mov esi, ebx
jle 0x1002ef9
and esi, 0xffff
or esi, 0x80070000
cmp ebx, 0x15
jne 0x1002f1d
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 3
pop ecx
jle 0x1002f1d
cmp word [edi + eax*2 - 2], 0x5c
jne 0x1002f1d
cmp word [edi + eax*2 - 4], 0x3a
jne 0x1002f1d
xor esi, esi
test esi, esi
jge 0x1002f5e
cmp dword [ebp + 0x10], 0
je 0x1002f5e
push edi
push 0x23
push ebx
push 0
push dword [ebp + 8]
call fcn.010061b2
add esp, 0x14
jmp 0x1002f5e
xor esi, esi
inc esi
jmp 0x1002f5e
test al, 0x10
jne 0x1002f5e
cmp dword [ebp + 0x10], esi
je 0x1002f59
push edi
push 0x14
push esi
push 0x10
push dword [ebp + 8]
call fcn.010061b2
add esp, 0x14
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003866
Capabilities:
Create directory

Disassembly:
mov eax, 0x10077ad
call fcn.010071b8
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
call fcn.01006243
lea ecx, [ebp - 0x14]
mov esi, eax
call sub.MFC42u.DLL_CString::CString_2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.01006328
cmp esi, edi
mov eax, 0x1001720
jne 0x10038ad
mov eax, 0x1001710
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString_1
cmp esi, edi
mov byte [ebp - 4], 1
je 0x10038c3
lea eax, [ebp - 0x14]
jmp 0x10038e2
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::Right
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.01006ecc
test byte [ebp - 0x18], 1
mov dword [ebp - 4], 1
je 0x1003900
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::CString
push edi
push dword [ebp - 0x10]
push edi
call fcn.01002ea5
neg esi
sbb esi, esi
and esi, 0x16
add esi, 0x24
push esi
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_wcschr]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.msvcrt.dll_wcsrchr]
add eax, 4
push 0x5c
push eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x18], eax
call ebx
add esp, 0x10
jmp 0x1003966
and word [esi], 0
push 1
push dword [ebp + 8]
push 0
call fcn.01002ea5
test eax, eax
jl 0x100396e
je 0x1003973
test edi, edi
je 0x100395a
mov word [edi - 2], 0x5c
push 0x5c
push dword [ebp - 0x18]
lea edi, [esi + 2]
call ebx
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x100393a
jmp 0x1003978
xor esi, esi
inc esi
jmp 0x10039d8
mov word [esi], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
jmp 0x10039ad
xor ebx, ebx
cmp edi, ebx
je 0x10039d6
cmp word [edi], bx
je 0x10039d6
push 0x5c
push edi
mov word [edi - 2], 0x5c
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, ebx
pop ecx
pop ecx
je 0x10039aa
mov word [eax], bx
lea edi, [eax + 2]
jmp 0x10039ac
xor edi, edi
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1003982
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10039c6
call esi
jmp 0x10039d2
call esi
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10039d8
xor esi, esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1005f46
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xffffffffffffffff
xor eax, eax
lea ecx, [ebp - 0x10]
inc eax
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call sub.NETAPI32.dll_NetShareEnum
cmp eax, esi
jne 0x1005fec
cmp dword [ebp - 0xc], esi
push edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 8], esi
jbe 0x1005fe1
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_towupper]
test byte [edi + 7], 0x80
je 0x1005fcc
push dword [edi]
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 2
pop ecx
jne 0x1005fcc
mov esi, dword [edi]
cmp word [esi + 2], 0x24
jne 0x1005fcc
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
push eax
call ebx
xor ecx, ecx
mov cx, word [esi]
mov word [ebp + 0xa], ax
push ecx
call ebx
pop ecx
pop ecx
mov cx, word [ebp + 0xa]
cmp ax, cx
je 0x1005fdc
add edi, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x1005f8f
jmp 0x1005fe0
and dword [ebp - 4], 0
pop ebx
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
jmp 0x1005ffb
jle 0x1005ff8
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret 8

Function at 0x1006243
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1009264]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], eax
je 0x1006312
cmp word [edi], si
je 0x1006312
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 2
pop ecx
jbe 0x100628b
cmp word [edi], 0x5c
jne 0x100628b
cmp word [edi + 2], 0x5c
jne 0x100628b
add edi, 4
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
mov dword [ebp - 0x208], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x10062b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100630e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
lea eax, [ebp - 0x204]
push eax
call ebx
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x100630d
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
mov dword [ebp - 0x208], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1006307
push edi
lea eax, [ebp - 0x204]
push eax
call ebx
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x100630d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov eax, esi
jmp 0x1006315
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010068c7
leave
ret 4