joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4614ce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
test byte [ebp + 0x14], 1
mov eax, ebx
push edi
mov dword [ebp - 4], eax
mov edi, ebx
je 0x4614e6
inc edi
jmp 0x4614ef
test byte [ebp + 0x14], 2
je 0x4614ef
push 2
pop edi
test byte [ebp + 0x14], 4
je 0x46152e
push esi
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], ebx
push eax
push 0xa
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 1
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
push dword [ebp + 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
pop esi
je 0x46155a
mov eax, dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
or eax, 0x400
push eax
push dword [ebp + 0x1c]
push ebx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
cmp dword [ebp - 4], 0
je 0x461569
push dword [ebp - 4]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
mov al, bl
pop ebx
leave
ret 0x28

Function at 0x461663
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
test eax, eax
je 0x4616ba
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp eax, 1
pop ebx
sete al
leave
ret

Function at 0x461803
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov ebx, eax
push 2
push 0
push 0
push ebx
call edi
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 2
push 0
push 0
lea eax, [ebx + 8]
push eax
call edi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 4], eax
xor eax, eax
push eax
push eax
push ebx
push 0x461874
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x461b2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
mov esi, ecx
lea eax, [ebp - 8]
push eax
push 0xb0
mov dword [ebp - 0x10], esi
push dword [esi]
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x461bcf
xor ebx, ebx
push ebx
push ebx
push 0xe
push dword [esi]
call edi
mov edi, eax
test edi, edi
je 0x461bcf
cmp edi, dword [ebp - 8]
jb 0x461bcf
cmp edi, dword [ebp - 4]
jb 0x461bcf
xor ecx, ecx
lea esi, [edi + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe0b
pop ecx
push eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0xc]
test eax, eax
je 0x461bc4
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x461bb3
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.00406b57
mov bl, 1
push esi
call fcn.0041fe14
pop ecx
mov al, bl
jmp 0x461bd1
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4625a2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov dl, 1
push esi
push edi
mov ecx, dword [ebx]
call fcn.00463a3d
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [ebp + 8], 0
push eax
jge 0x4625f8
push 0x25
push 0x100
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x46261c
push 0x27
push 0x100
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [ebx]
call esi
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebx]
xor dl, dl
call fcn.00463a3d
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x462da7
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dl, 1
jne 0x462dd3
lea eax, [ebp - 4]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x462dea
push 1
jmp 0x462dd4
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
leave
ret
Function at 0x46b0a8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x46b12c
jne 0x46b0bb
push 0
jmp 0x46b126
cmp esi, 0xf
jae 0x46b125
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
test eax, eax
je 0x46b125
mov dword [ebp - 4], esi
fild dword [ebp - 4]
test esi, esi
jns 0x46b0de
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 0x20]
call fcn.0041e398
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x46b0e7
jmp 0x46b12c
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop esi
leave
ret

Function at 0x46b27a
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00469f7e
mov eax, dword [ebp + 8]
mov word [esi + 8], ax
test ax, ax
je 0x46b2d8
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x46b2d8
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x46b2c1
mov byte [esi + 1], 1
test bl, 2
je 0x46b2ca
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x46b2d4
mov byte [esi + 4], 1
mov al, 1
jmp 0x46b2da
xor al, al
pop esi
pop ebp
ret 4

Function at 0x46ccff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x46cd19
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0046cc37
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edi
pop edi
pop esi
leave
ret 8
Function at 0x46cf00
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20034
call fcn.00441f50
push ebx
push esi
lea eax, [ebp - 0x20034]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046dde0
lea eax, [ebp - 0x10034]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046dde0
pop ecx
pop ecx
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x46cf8a
cmp byte [ebp + 8], al
je 0x46cfae
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call fcn.00425232
pop ecx
pop ecx
test eax, eax
je 0x46d06f
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x46d06f
lea ecx, [ebp - 0x20034]
call fcn.0046e199
test al, al
je 0x46cfae
lea ecx, [ebp - 0x10034]
call fcn.0046e199
test al, al
je 0x46cfb4
cmp byte [ebp + 8], 0
jne 0x46cfed
xor al, al
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x34]
call fcn.00409cb3
lea ecx, [ebp - 0x34]
call fcn.0046d2c1
mov bl, al
lea ecx, [ebp - 0x34]
neg bl
sbb bl, bl
call fcn.0040988f
add bl, 1
jne 0x46cfae
lea ecx, [ebp - 0x10034]
call fcn.0046e199
test al, al
je 0x46cfae
lea eax, [ebp - 0x20034]
push 0x4c68d8
push eax
call fcn.00429038
lea eax, [ebp - 0x20034]
push eax
call fcn.00424963
xor ecx, ecx
mov word [ebp + eax*2 - 0x20032], cx
lea eax, [ebp - 0x10034]
push eax
call fcn.00424963
xor ecx, ecx
mov dword [ebp - 0x20], 2
add esp, 0x10
mov word [ebp + eax*2 - 0x10032], cx
lea eax, [ebp - 0x20034]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10034]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0x24], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46cfae
mov al, 1
jmp 0x46cfb0
Function at 0x46d2c1
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x49cb68
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.004037a0
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d38e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x46d325
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x46d32a
jmp 0x46d392
cmp eax, 3
jne 0x46d396
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x49cb68
inc dword [eax]
call fcn.00404518
cmp eax, 0xffffffff
je 0x46d383
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.004093b2
lea ecx, [esp + 0x18]
call fcn.0046d2c1
test al, al
je 0x46d381
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.0040988f
jmp 0x46d398
test al, 0x10
je 0x46d396
mov bl, 1
jmp 0x46d398
xor bl, bl
lea ecx, [esp + 8]
call fcn.0040988f
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d3a9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.0040a961
lea ecx, [esp + 0x30]
call fcn.0040a961
lea ecx, [esp + 0x20]
call fcn.0040a961
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00403aa2
mov ecx, dword [esp + 0x10]
call fcn.0046e199
test al, al
je 0x46d400
push 0x4c68d8
lea ecx, [esp + 0x14]
call fcn.004033c6
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.0040525f
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x46d4a0
cmp al, 1
jne 0x46d4a0
test byte [esp + 0x40], 0x10
jne 0x46d47b
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0040a8c7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00406350
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.004033c6
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
jne 0x46d497
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x46d433
mov al, bl
mov byte [esp + 0xe], al
jmp 0x46d433
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x46d4ab
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0040988f
lea ecx, [esp + 0x30]
call fcn.0040988f
lea ecx, [esp + 0x10]
call fcn.0040988f
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d4dc
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
push ebx
push esi
push edi
push 0
mov ebx, ecx
mov dword [esp + 0x18], edx
push 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x50], 0x22c
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov byte [esi], 0
call fcn.0046def7
mov ebx, eax
jmp 0x46d5d2
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
cmp eax, 1
jne 0x46d5db
lea ecx, [esp + 0x18]
call fcn.0040a961
lea ecx, [esp + 0x28]
call fcn.0040a961
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00409cb3
lea eax, [esp + 0x28]
xor edx, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x44]
call fcn.0040525f
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.0040988f
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.00406350
mov eax, dword [esp + 0x10]
push 0
push dword [eax + 4]
push dword [eax]
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0041ce60
test eax, eax
mov eax, dword [esp + 0x50]
je 0x46d5b7
test ebx, ebx
je 0x46d5c0
cmp ebx, eax
jne 0x46d5c0
mov ecx, dword [esp + 0x14]
mov byte [esi], 1
mov dword [ecx], eax
lea ecx, [esp + 0x28]
call fcn.0040988f
lea ecx, [esp + 0x18]
call fcn.0040988f
cmp byte [esi], 0
je 0x46d529
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d5eb
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor esi, esi
mov eax, 0x80
push esi
push eax
push 3
push esi
push 3
mov ebx, edx
push eax
push ecx
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edx, eax
mov dword [ebp - 8], edx
cmp edx, 0xffffffff
je 0x46d663
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x14], esi
push esi
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], esi
push eax
push 0x28
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], esi
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push edx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x46d663
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov al, 1
jmp 0x46d665
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46d66a
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x80
push ebx
push esi
xor esi, esi
push esi
push eax
push 3
push esi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46d6dd
push edi
xor eax, eax
mov dword [ebp - 0x10], 7
lea edi, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
test esi, esi
je 0x46d6dd
xor eax, eax
cmp byte [ebp - 0x14], al
setne al
jmp 0x46d6e2
mov eax, 0x80004005
pop esi
pop ebx
leave
ret

Function at 0x46dbbe
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp word [esi + eax*2 - 2], 0x22
je 0x46dc06
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46dc09
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x46dc06
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 8]
jmp 0x46dc09
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46de27
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
push esi
push edi
push eax
push 0x101
mov edi, edx
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x46dee6
push 0x100
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x46dee6
mov eax, dword [eax + 0xc]
xor ecx, ecx
cmp dword [eax], ecx
je 0x46de83
inc ecx
cmp dword [eax + ecx*4], 0
jne 0x46de7c
cmp esi, ecx
jle 0x46de96
push str.0.0.0.0
push edi
call fcn.00424983
pop ecx
pop ecx
jmp 0x46dede
push 4
push dword [eax + esi*4 - 4]
lea eax, [ebp - 4]
push eax
call fcn.00420e20
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0042d5f0
or edx, 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.0046ebd1
mov esi, eax
push esi
push edi
call fcn.00424983
push esi
call fcn.0041fe14
add esp, 0x14
call dword [sym.imp.WSOCK32.dll_WSACleanup]
jmp 0x46def3
push 0x49cc08
push edi
call fcn.00424983
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x46e199
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46e1ac
test al, 0x10
je 0x46e1ac
mov al, 1
ret
xor al, al
ret

Function at 0x46e1d6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov byte [0x4d139d], 0
mov ebx, edx
test edi, edi
je 0x46e228
mov byte [0x4d139e], 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 8], edi
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push 0x46e6b0
push ecx
push ecx
call fcn.0042d258
mov esi, eax
add esp, 0x18
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
test esi, esi
je 0x46e253
push 0xffffffffffffffff
push esi
mov byte [0x4d139e], 0
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x4d139d], 1
jne 0x46e261
or eax, 0xffffffff
jmp 0x46e263
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46e3fb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20450
call fcn.00441f50
push ebx
push esi
lea eax, [esp + 0x10458]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046dde0
pop ecx
lea eax, [esp + 0x458]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046dde0
pop ecx
lea ecx, [esp + 0x10458]
call fcn.0046e199
test al, al
je 0x46e4ba
lea ecx, [esp + 0x458]
call fcn.0046e199
xor esi, esi
test al, al
je 0x46e526
cmp byte [ebp + 8], 0
je 0x46e4ba
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x46e4c2
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call fcn.00425232
pop ecx
pop ecx
test eax, eax
je 0x46e65e
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x46e65e
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x254]
push eax
push esi
lea eax, [esp + 0x10464]
push esi
push eax
call fcn.0042d583
add esp, 0x14
lea eax, [esp + 0x458]
push 0x49cb68
push eax
call fcn.00429038
lea eax, [esp + 0x258]
push eax
lea eax, [esp + 0x464]
push eax
call fcn.00429038
add esp, 0x10
cmp word [esp + 0x48], si
je 0x46e526
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x45c]
push eax
call fcn.00429038
pop ecx
pop ecx
lea eax, [esp + 0x458]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb3
lea eax, [esp + 0x10458]
push eax
lea ecx, [esp + 0x3c]
call fcn.00409cb3
lea edx, [esp + 8]
lea ecx, [esp + 0x38]
call fcn.0046e12c
lea ecx, [esp + 0x38]
mov bl, al
call fcn.0040988f
lea ecx, [esp + 8]
call fcn.0040988f
test bl, bl
je 0x46e5c4
push 1
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x1045c]
call fcn.0046cf00
pop ecx
test al, al
je 0x46e4ba
lea eax, [esp + 0x10458]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb3
mov dl, 1
lea ecx, [esp + 8]
call fcn.0046e85d
mov bl, al
lea ecx, [esp + 8]
neg bl
sbb bl, bl
call fcn.0040988f
add bl, 1
je 0x46e65e
jmp 0x46e4ba
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call fcn.00425232
pop ecx
pop ecx
test eax, eax
je 0x46e4ba
lea eax, [esp + 0x10458]
push eax
call fcn.00424963
pop ecx
xor ecx, ecx
mov word [esp + eax*2 + 0x1045a], cx
lea eax, [esp + 0x458]
push eax
call fcn.00424963
pop ecx
xor ecx, ecx
mov dword [esp + 0x2e], esi
mov dword [esp + 0x32], esi
mov word [esp + eax*2 + 0x45a], cx
lea eax, [esp + 0x10458]
mov ecx, 0x614
mov dword [esp + 0x20], eax
mov word [esp + 0x28], cx
lea eax, [esp + 0x458]
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2e], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46e4ba
mov al, 1
jmp 0x46e4bc