joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af086
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4e212b
call fcn.004c2d9d
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4af0ab
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4af0f1
lea ecx, [ebp - 0x10]
call fcn.00403be0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a3094
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401ec0
mov eax, esi
call fcn.004c2e75
ret 8

Function at 0x4bee8a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50e5d4]
jne 0x4bee94
repz ret
jmp fcn.004c5d7f

Function at 0x4d1738
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004c637a
and dword [ebp - 4], 0
cmp dword [0x5180c8], 0
mov ebx, eax
jne 0x4d17e9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4d189a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ed9d4
push edi
call esi
test eax, eax
je 0x4d189a
push eax
call fcn.004c6308
mov dword [esp], 0x4ed9c4
push edi
mov dword [0x5180c8], eax
call esi
push eax
call fcn.004c6308
mov dword [esp], 0x4ed9b0
push edi
mov dword [0x5180cc], eax
call esi
push eax
call fcn.004c6308
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5180d0], eax
call esi
push eax
call fcn.004c6308
pop ecx
mov dword [0x5180d8], eax
test eax, eax
je 0x4d17e9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004c6308
pop ecx
mov dword [0x5180d4], eax
mov eax, dword [0x5180d4]
cmp eax, ebx
je 0x4d1841
cmp dword [0x5180d8], ebx
je 0x4d1841
push eax
call fcn.004c6383
push dword [0x5180d8]
mov esi, eax
call fcn.004c6383
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4d1841
test edi, edi
je 0x4d1841
call esi
test eax, eax
je 0x4d1838
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4d1838
test byte [ebp - 0xc], 1
jne 0x4d1841
or dword [ebp + 0x10], 0x200000
jmp 0x4d187a
mov eax, dword [0x5180cc]
cmp eax, ebx
je 0x4d187a
push eax
call fcn.004c6383
pop ecx
test eax, eax
je 0x4d187a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4d187a
mov eax, dword [0x5180d0]
cmp eax, ebx
je 0x4d187a
push eax
call fcn.004c6383
pop ecx
test eax, eax
je 0x4d187a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5180c8]
call fcn.004c6383
pop ecx
test eax, eax
je 0x4d189a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4d189c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4dfdd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4dfe09
call fcn.004c1c9e
mov dword [eax], esi
call fcn.004c1c8b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004bfc0d
add esp, 0x14
push 0x16
pop eax
jmp 0x4dfe5e
test dword [ebp + 0xc], 0xfffffff9
jne 0x4dfde5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4dfe36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c1cb1
pop ecx
call fcn.004c1c8b
mov eax, dword [eax]
jmp 0x4dfe5e
test al, 0x10
jne 0x4dfe5c
test al, 1
je 0x4dfe5c
test byte [ebp + 0xc], 2
je 0x4dfe5c
call fcn.004c1c9e
mov dword [eax], 5
call fcn.004c1c8b
mov dword [eax], 0xd
jmp 0x4dfe2d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x404a94
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404cc4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404b17
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404cc4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404b17
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ce0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404ba0
xor eax, eax
push ebp
push 0x404b99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004048dc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b7e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404d00
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b7e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ba0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404cba
cmp byte [ebp - 0xd], 0
jne 0x404be7
cmp byte [ebp - 0x12], 0
je 0x404cba
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404c00
dec ebx
cmp byte [ebx], 0x2e
je 0x404c0f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404bff
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404cba
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404c4c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404cba
cmp byte [ebp - 0xd], 0
je 0x404cba
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404cba
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4053b6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403bf0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004028d8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4053a0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053bd
lea eax, [ebp - 0x10]
call fcn.00403980
ret

Function at 0x4095ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4095e5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a70
jmp 0x4095ee
mov eax, ebx
mov edx, esi
call fcn.004039d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4095f8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409619
mov al, byte [esp]
jmp 0x40961b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409ca0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409b18
mov eax, dword [0x413528]
cmp byte [eax], 0
je 0x409d1c
mov eax, dword [0x413444]
call fcn.00402854
call fcn.0040271c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406f60
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409d64
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409d52
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413420]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.004048a0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40aa00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aa64
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403bf0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406b20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aa6b
lea eax, [ebp - 0xc]
call fcn.00403980
ret

Function at 0x41267c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004123f8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403e1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4126da
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4134b4]
mov dl, 1
mov eax, dword [0x41231c]
call fcn.00409e60
call fcn.00403358
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4011b5
pop dword [ebp - 0x50]
mov eax, 0x1e44725a
add eax, 0xe1fb9f5b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x62c2e09d
add dword [ebp - 0x60], 0xeb8f64ae
mov dword [ebp - 0x5c], 0xdd60fb86
add dword [ebp - 0x5c], 0x54d250bf
mov dword [ebp - 0x58], 0x1d22c178
add dword [ebp - 0x58], 0x2f2982b6
mov dword [ebp - 0x54], 0x34d0216f
add dword [ebp - 0x54], 0xcb2fde91
lea eax, [ebp - 0x60]
push eax
mov eax, 0x5126c84e
sub eax, 0x50e5f7fa
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x188f8e2b
add dword [ebp - 0x60], 0x5be2db2b
mov dword [ebp - 0x5c], 0xc8d5a903
add dword [ebp - 0x5c], 0x7896b872
mov dword [ebp - 0x58], 0x8cc38493
add dword [ebp - 0x58], 0xd6abe7d9
mov dword [ebp - 0x54], 0xe513cceb
add dword [ebp - 0x54], 0x1aec3315
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x890ece4f
sub eax, 0x88cdfe03
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5f7
push 0
call eax
mov ecx, 0x714d9228
sub ecx, 0x714d42d5
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x50]
mov edx, 0x6a0722f8
add edx, 0xadf4756e
sub dword [ebp - 0x4c], 0xc01cb634
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0xaf9acdb3
sub esi, edx
xor dword [ebp - 0x20], 0xcd094393
mov dword [edi], esi
mov dword [ebp - 0x3c], 0x665ca104
add edi, 0x6dc70a98
add edi, 0x9238f56c
add ebx, 0x7611c508
sub ebx, 0x7611c504
loop 0x4012d1
add eax, 0x1301f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4a1954
Capabilities:
Encode data using xor

Disassembly:
jg 0x4a19bf
or eax, 0x9a7716e4
push 0x5b7bc56d
out dx, eax
dec edx
mov dh, 0x3f
mov esp, 0x635e53b9
in al, 0x2c
push eax
jnp 0x4a19df
mov ecx, 0x7a160f66
jne 0x4a1976
invalid
inc esp
sbb eax, 0xcf7f4d96
or edi, edi
stosd dword es:[edi], eax
sub al, 0x81
inc ebx
pushfd
out 0x7b, eax
xchg ebx, eax
invalid
mov ecx, 0xf87893ca
test eax, 0xf7dc6863
inc ebx
add dword [ecx - 0x3ad34f33], edi
sub al, 0xc5
cmp eax, 0x6dc1af0d
xor al, 0x51
ja 0x4a19a6
out 0xec, al
in al, dx
mov ecx, 0x66757289
dec esp
xchg ebp, eax
xlatb
sub eax, 0xca805a2c
add byte [esi], al
in al, dx
pushal
jbe 0x4a19e2
push eax
jnp 0x4a1a4f
aaa
inc ebx
mov dword [eax], esi
loopne 0x4a19b5
jae 0x4a19ff
std
pop ecx
jmp [eax - 0x381f8357]
out dx, al
invalid
invalid
wait
les esp, [eax - 0x4bd7787]
inc edx
sub dword [eax + edx*8 + 0x60], eax
inc esp
shl byte [eax + 7], 1
pop es
or ah, byte [ebp - 8]
pop esp
sub eax, 0xa56af470
ror dword [esi - 0xf00c3dd], 0x7b
push ss
or esi, dword [ecx + 0x2d]
inc esp
xor dword [esi + 0x3b], edi
mov fs, word [ebx]
cmp al, 0xff
invalid
sub eax, 0x3b7e3144
jno 0x4a1a5d
dec eax
sti
xchg esi, eax
mov ebx, 0x7df0ebe1
cmp edi, 0x771129f2
push cs
wait
cmp bh, dh
add ebx, dword [edx + 0x31]
mov dh, 0x93
loope 0x4a1a66
je 0x4a1a09
and byte [eax], cl
bound ebx, qword [ebp + 0xae442db]
jbe 0x4a1a46
fcomi st(7)
jbe 0x4a1a52
fisttp dword [ebp - 0x5b8e8f4a]
adc byte [0x4622478c], dh
mov word [ebp - 0x79f04b74], fs
cmp dword [ecx - 0x96], 0x17af7bf0
xor ah, byte [ebx - 0x62]
dec eax
invalid
Function at 0x403a00
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x440ea7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], 0
call fcn.0043fabe
mov ebx, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], ebx
call fcn.0043fabe
lea eax, [esp + 0x18]
mov byte [esp + 0x2c], 2
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov edx, dword [0x34bdcf4]
mov ecx, dword [eax]
push edx
lea eax, [esp + 0x10]
push 0x44f214
push eax
mov dword [esp + 0x2c], ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x18]
push 0xc
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0043fac4
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0xc]
mov ecx, ebx
xor eax, eax
mov dl, byte [eax + esi]
cmp dl, 0x30
mov byte [esp + 0x18], dl
je 0x403aba
mov edx, dword [esp + 0x18]
and edx, 0xff
imul ecx, edx
inc eax
cmp eax, 0xc
jl 0x403aa1
cmp ecx, 0x3e8
jae 0x403ad0
add ecx, 0x1b7a
jmp 0x403aeb
cmp ecx, 0x2710
jb 0x403aeb
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
mov ecx, edx
cmp ecx, 0x2710
jae 0x403ad8
cmp ecx, 0x3e8
jae 0x403afb
add ecx, 0x1b7a
jmp 0x403b0d
cmp ecx, 0x2710
jb 0x403b0d
shr ecx, 1
cmp ecx, 0x2710
jae 0x403b03
push ecx
lea eax, [esp + 0x18]
push 0x44f180
push eax
call sub.MFC42.DLL_CString::Format
push 8
call sub.MFC42.DLL_operatornew
mov esi, eax
push 7
push esi
push str.0623
mov byte [esi], 0xfa
mov byte [esi + 1], 0xa
mov byte [esi + 2], 2
mov byte [esi + 3], 0xc
mov byte [esi + 4], 0xc
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 7], bl
call fcn.00410690
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 2]
mov dl, byte [esi + 1]
push esi
lea edi, [ecx + edx + 1]
call sub.MFC42.DLL_operatordelete
add esp, 0x20
lea ecx, [esp + 0x10]
call fcn.0043fabe
cmp edi, 0xa
mov byte [esp + 0x2c], 4
push edi
jge 0x403b86
lea eax, [esp + 0x14]
push 0x44f208
push eax
jmp 0x403b90
lea ecx, [esp + 0x14]
push 0x44f180
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x40b350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441fdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], ebx
call fcn.0043fabe
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x38], 1
mov dword [esp + 0x14], ebx
mov ecx, dword [eax + 0x20]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], ecx
push eax
mov ecx, 0x45cff0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], 0x40b440
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 5
call fcn.0043fc26
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov esi, eax
cmp esi, ebx
je 0x40b3f8
push 0x104
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x40d040
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea eax, [ebp + 2]
push eax
call sub.MFC42.DLL_operatornew
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp], dl
mov ecx, 7
lea edi, [esp + 0x10]
mov byte [ebx + ebp + 1], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x24], 0x414
mov dword [esp + 0x2a], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x2e], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 4
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
push ebx
neg esi
sbb esi, esi
inc esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40f280
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442748
push eax
mov dword fs:[0], esp
sub esp, 0x2b8
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x40f2d2
lea ecx, [esp + 0x2d4]
mov dword [esp + 0x2cc], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x40f44d
mov edi, 1
push 6
push edi
push 2
call sub.WSOCK32.dll_socket
push 0x7e2
mov esi, eax
mov word [esp + 0x24], 2
mov dword [esp + 0x28], 0x100007f
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0xc]
or ebp, 0xffffffff
push ecx
push 0x8004667e
push esi
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 4
mov dword [esp + 0x18], edi
call sub.WSOCK32.dll_ioctlsocket
lea edx, [esp + 0x20]
push 0x10
push edx
push esi
call sub.WSOCK32.dll_connect
cmp eax, ebp
jne 0x40f3af
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x30d40
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], edi
call sub.WSOCK32.dll_select
test eax, eax
jle 0x40f38a
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x1007
push 0xffff
push esi
call sub.WSOCK32.dll_getsockopt
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f3af
push esi
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp + 0x2d4]
mov dword [esp + 0x2cc], ebp
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x40f44d
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0
push edx
push 0x8004667e
push esi
call sub.WSOCK32.dll_ioctlsocket
lea eax, [esp + 0x20]
push 0x10
push eax
push esi
call sub.WSOCK32.dll_connect
mov ecx, dword [esp + 0x2d4]
xor eax, eax
mov edx, dword [ecx - 8]
test edx, edx
jbe 0x40f401
mov edi, ecx
sub edi, 0x45d150
mov dl, byte [edi + eax + 0x45d150]
mov byte [eax + 0x45d150], dl
mov edx, dword [ecx - 8]
inc eax
cmp eax, edx
jb 0x40f3ec
push 0
push 0x16c
push 0x45d150
push esi
mov byte [eax + 0x45d150], 0
call sub.WSOCK32.dll_send
push esi
mov edi, eax
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
cmp edi, 0x16c
mov dword [esp + 0x2cc], ebp
lea ecx, [esp + 0x2d4]
je 0x40f446
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x40f44d
call sub.MFC42.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c4
ret

Function at 0x410690
Capabilities:
Execute command

Disassembly:
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x10]
mov edx, dword [0x45d148]
push eax
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push edx
call fcn.0043da50
test eax, eax
je 0x4106de
mov eax, dword [0x45d148]
push eax
call fcn.0043d3e0
push 8
mov byte [0x44fa4d], 1
call fcn.00417d70
push str.shutdown__s__t_0
call dword [sym.imp.MSVCRT.dll_system]
add esp, 8
ret
mov byte [0x44fa4d], 0
ret