joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x416600], 0
je 0x408ec8
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x41219c]
jmp 0x408fd4
cmp dword [ebp + 0x10], 0
je 0x408ee5
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
add eax, 1
imul eax, eax, 3
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp + 0x1c], 0
je 0x408f36
mov ecx, dword [ebp + 0x1c]
push ecx
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
push edx
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
mov eax, dword [ebp + 0x1c]
push eax
call dword [0x4121fc]
add eax, 1
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040bce0
add esp, 0x10
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x408fad
cmp dword [ebp - 8], 0
je 0x408f89
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040bd40
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x408fad
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0040bd40
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x408fbf
mov edx, dword [ebp - 8]
push edx
call fcn.0040dd7e
add esp, 4
cmp dword [ebp - 4], 0
je 0x408fd1
mov eax, dword [ebp - 4]
push eax
call fcn.0040dd7e
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x409290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], 0
cmp dword [0x416600], 0
je 0x4092c9
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x4121a4]
jmp 0x40933b
push 0x208
mov eax, dword [ebp + 0xc]
push eax
call dword [0x4121fc]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040bce0
add esp, 0x10
mov eax, dword [ebp + 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov esp, ebp
pop ebp
ret

Function at 0x409340
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [0x416600], 0
je 0x409366
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x412198]
jmp 0x4093dd
cmp dword [ebp + 0xc], 0
je 0x409388
mov edx, dword [ebp + 0xc]
push edx
call dword [0x4121fc]
add eax, 0xa
imul eax, eax, 3
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push eax
call dword [0x4121fc]
add eax, 0xa
imul eax, eax, 3
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x4121fc]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0040bce0
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x4093da
mov eax, dword [ebp - 8]
push eax
call fcn.0040dd7e
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4093f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x416600], 0
je 0x409412
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4121b0]
jmp 0x409449
push 0x208
mov edx, dword [ebp + 8]
push edx
call dword [0x4121fc]
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0040bce0
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x4094d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
call fcn.00408830
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
je 0x409508
cmp dword [ebp - 0x210], 2
jle 0x4095bf
cmp dword [ebp - 0x210], 4
jle 0x409508
jmp 0x4095bf
lea eax, [ebp - 0x20c]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x409560
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.00408ba0
add esp, 8
test eax, eax
je 0x409557
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0040b990
add esp, 8
test eax, eax
jne 0x409555
xor eax, eax
jmp 0x40962b
jmp 0x40955e
xor eax, eax
jmp 0x40962b
jmp 0x409567
xor eax, eax
jmp 0x40962b
lea edx, [ebp - 0x20c]
push edx
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4095b9
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
call fcn.00408ba0
add esp, 8
test eax, eax
je 0x4095b3
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.0040b990
add esp, 8
test eax, eax
jne 0x4095b1
xor eax, eax
jmp 0x40962b
jmp 0x4095b7
xor eax, eax
jmp 0x40962b
jmp 0x4095bd
xor eax, eax
jmp 0x40962b
jmp 0x409615
lea ecx, [ebp - 0x20c]
push ecx
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x409611
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.00408ba0
add esp, 8
test eax, eax
je 0x40960b
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.0040b990
add esp, 8
test eax, eax
jne 0x409609
xor eax, eax
jmp 0x40962b
jmp 0x40960f
xor eax, eax
jmp 0x40962b
jmp 0x409615
xor eax, eax
jmp 0x40962b
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x4121f4]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x409690
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
push 0x3f3
mov eax, dword [0x416618]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00408af0
add esp, 8
mov dword [0x418f24], 1
push 0x40f3cc
push 0x83a
call fcn.00402db0
add esp, 8
push eax
push 0x3fc
mov edx, dword [0x416618]
push edx
call fcn.00409170
add esp, 0xc
push 0x416e6c
push 0x41664c
call dword [0x4121f4]
push 0x417074
push 0x416854
call dword [0x4121f4]
mov dword [ebp - 8], 0
cmp dword [0x418f24], 1
jne 0x40973c
cmp dword [ebp - 8], 0xa
jge 0x40973c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x409717
mov dword [0x418f24], 0
cmp dword [0x41660c], 0
je 0x409766
mov ecx, dword [0x41660c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x41660c], 0
cmp dword [0x416610], 0
je 0x409786
mov edx, dword [0x416610]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x416610], 0
cmp dword [0x416624], 0
je 0x4097a7
push 0
mov eax, dword [0x416624]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x416624], 0
cmp dword [0x416628], 0
je 0x4097c4
mov dword [0x418f2c], 1
mov dword [0x416628], 0
cmp dword [0x416638], 0
je 0x4097e6
push 0
mov ecx, dword [0x416638]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x416638], 0
cmp dword [0x416634], 0
je 0x409808
push 0
mov edx, dword [0x416634]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x416634], 0
cmp dword [0x41662c], 0
je 0x409829
push 0
mov eax, dword [0x41662c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x41662c], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x1f4
mov edx, dword [0x41663c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409853
cmp dword [ebp - 0x10], 5
jl 0x409829
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
push 0x1f4
mov ecx, dword [0x416644]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409884
cmp dword [ebp - 0x10], 5
jl 0x40985a
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
push 0x1f4
mov eax, dword [0x416648]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4098b4
cmp dword [ebp - 0x10], 5
jl 0x40988b
call fcn.0040a390
push 0
call fcn.00406680
add esp, 4
mov ecx, dword [0x416618]
push ecx
call fcn.00409d50
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4098e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x3f3
mov eax, dword [0x416618]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00408af0
add esp, 8
push 0x40f3cc
push 0x83a
call fcn.00402db0
add esp, 8
push eax
push 0x3fc
mov edx, dword [0x416618]
push edx
call fcn.00409170
add esp, 0xc
push 0x416e6c
push 0x41664c
call dword [0x4121f4]
push 0x417074
push 0x416854
call dword [0x4121f4]
cmp dword [0x41660c], 0
je 0x40996c
mov eax, dword [0x41660c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x41660c], 0
cmp dword [0x416610], 0
je 0x40998c
mov ecx, dword [0x41660c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x41660c], 0
cmp dword [0x416610], 0
je 0x4099ac
mov edx, dword [0x416610]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x416610], 0
cmp dword [0x416628], 0
je 0x4099c9
mov dword [0x418f2c], 1
mov dword [0x416628], 0
cmp dword [0x41662c], 0
je 0x4099ea
push 0
mov eax, dword [0x41662c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x41662c], 0
cmp dword [0x416638], 0
je 0x409a0c
push 0
mov ecx, dword [0x416638]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x416638], 0
cmp dword [0x416634], 0
je 0x409a2e
push 0
mov edx, dword [0x416634]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x416634], 0
push 1
mov eax, dword [0x416640]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x409a4a
push 0
call fcn.00406680
add esp, 4
mov ecx, dword [0x416618]
push ecx
call fcn.00409d50
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x409c60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
cmp dword [0x416600], 0
je 0x409c82
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4121dc]
jmp 0x409ce2
push 0x104
mov edx, dword [ebp + 8]
push edx
call dword [0x4121fc]
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040bce0
add esp, 0x10
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [0x4121fc]
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0040bce0
add esp, 0x10
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esp, ebp
pop ebp
ret

Function at 0x409cf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x416600], 0
je 0x409d0e
mov eax, dword [ebp + 8]
push eax
call dword [0x4121c0]
jmp 0x409d41
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4121fc]
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0040bce0
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret
Function at 0x409e30
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push 0
push 0
push 0xf0
push 0x3fa
mov eax, dword [0x416618]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00408b10
add esp, 0x10
cmp eax, 1
jne 0x409f0d
push 0x200
lea ecx, [ebp - 0xc30]
push ecx
push 0x3eb
mov edx, dword [0x416618]
push edx
call fcn.00409220
add esp, 0x10
push 0x200
lea eax, [ebp - 0xa28]
push eax
push 0x3ea
mov ecx, dword [0x416618]
push ecx
call fcn.00409220
add esp, 0x10
push 0x40f360
lea edx, [ebp - 0x618]
push edx
call dword [0x4121f4]
lea eax, [ebp - 0xc30]
push eax
push 0x40f680
lea ecx, [ebp - 0xa28]
push ecx
lea edx, [ebp - 0x618]
push edx
call fcn.004071f0
add esp, 8
push eax
call fcn.004071f0
add esp, 8
push eax
call fcn.004071f0
add esp, 8
push 0
push 0x40f2f0
lea eax, [ebp - 0x618]
push eax
push 3
push 0x40f6f0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x416610], eax
jmp 0x409f25
push 0
push 0
push 0
push 0
push 0x40f6f0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x416610], eax
cmp dword [0x416610], 0
jne 0x409f30
jmp 0x409f89
push 0
push 0x80000000
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x416610]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0xc34], eax
cmp dword [ebp - 0xc34], 0
je 0x409f72
mov eax, dword [ebp - 0xc34]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0xc34], 0
mov ecx, dword [0x416610]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x416610], 0
mov esp, ebp
pop ebp
ret

Function at 0x40a670
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x416600], 0
je 0x40a693
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x41221c]
jmp 0x40a6e4
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040bd40
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040dd7e
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40a6f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x416600], 0
je 0x40a716
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x4121ac]
jmp 0x40a826
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x40a800
cmp dword [ebp - 4], 0
je 0x40a800
mov edx, dword [ebp + 8]
push edx
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
mov eax, dword [ebp + 8]
push eax
call dword [0x4121fc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040bce0
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call dword [0x4121fc]
add eax, 1
imul eax, eax, 3
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x4121fc]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040bce0
add esp, 0x10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040dd7e
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.0040dd7e
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x40a826
cmp dword [ebp - 8], 0
je 0x40a812
mov eax, dword [ebp - 8]
push eax
call fcn.0040dd7e
add esp, 4
cmp dword [ebp - 4], 0
je 0x40a824
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040dd7e
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [0x4121d8]
test eax, eax
jne 0x40a89c
push 0x104
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40a875
mov ax, 0x5c
jmp 0x40a8f5
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040bd40
add esp, 0xc
mov dx, word [ebp - 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathGetCharTypeW]
cmp eax, 8
jne 0x40a8b8
mov ax, word [ebp - 0x214]
jmp 0x40a8f5
lea eax, [ebp - 0x218]
push eax
call dword [0x4121fc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dx, word [ebp + ecx*2 - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathGetCharTypeW]
cmp eax, 8
je 0x40a8ea
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x40a8c8
mov ecx, dword [ebp - 4]
mov ax, word [ebp + ecx*2 - 0x218]
mov esp, ebp
pop ebp
ret
Function at 0x40ad80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x40ad96
mov eax, 1
jmp 0x40ae51
push 0x10
call fcn.0040dd6a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
push 0x1388
mov edx, dword [0x41663c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40adde
jmp 0x40adc6
mov eax, dword [0x41663c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x418f24], 0
jne 0x40ae4c
push 1
mov ecx, dword [0x416640]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ae26
mov edx, dword [0x416644]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040dd7e
add esp, 4
mov eax, 1
jmp 0x40ae51
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x40acb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40ae4c
xor eax, eax
jmp 0x40ae51
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40ca60
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e0
push 0
push 0
push 0x208
lea eax, [ebp - 0x3c8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0x400
push 0
call dword [0x4121e8]
test eax, eax
jne 0x40ca95
jmp 0x40cbdb
push str.ICMP.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jne 0x40cab4
jmp 0x40cbdb
lea edx, [ebp - 0x1b0]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0x3c8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jne 0x40cae7
jmp 0x40cbdb
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x3d0], eax
push str.IcmpCreateFile
mov ecx, dword [ebp - 0x3e0]
push ecx
call dword [0x4121d0]
mov dword [ebp - 0x3cc], eax
push str.IcmpCloseHandle
mov edx, dword [ebp - 0x3e0]
push edx
call dword [0x4121d0]
mov dword [ebp - 0x1b8], eax
push str.IcmpSendEcho
mov eax, dword [ebp - 0x3e0]
push eax
call dword [0x4121d0]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x3cc], 0
je 0x40cb5b
cmp dword [ebp - 0x1b8], 0
je 0x40cb5b
cmp dword [ebp - 0x1b4], 0
jne 0x40cb5d
jmp 0x40cbdb
call dword [ebp - 0x3cc]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 0x3dc], 0x1e
mov byte [ebp - 0x3db], 0
mov byte [ebp - 0x3da], 0
mov dword [ebp - 0x3d8], 0
mov byte [ebp - 0x3d9], 0
push 0x1388
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3dc]
push edx
push 0
push 0
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x3d4]
push edx
call dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x3d4]
push eax
call dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x3e0]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esp, ebp
pop ebp
ret
Function at 0x40ddda
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x40ddff
cmp al, 0x20
jle 0x40de11
inc esi
cmp byte [esi], 0x20
jg 0x40ddf3
jmp 0x40de11
cmp al, 0x22
je 0x40de10
inc esi
mov al, byte [esi]
test al, al
jne 0x40ddfb
cmp al, 0x22
jne 0x40de11
jmp 0x40de10
cmp al, 0x20
jg 0x40de17
inc esi
mov al, byte [esi]
test al, al
jne 0x40de0c
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040de85
push 0x411004
push section..data
call fcn.0040de6b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40de47
movzx eax, word [ebp - 0x14]
jmp 0x40de4a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040de9d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40df90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
dec eax
test ecx, ecx
je 0x40dfa7
mov dl, byte [esp + 0xc]
inc eax
xor byte [eax], dl
dec ecx
jne 0x40df9d
xor eax, eax
ret