joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40430c
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x40449d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
movzx eax, bx
cmp eax, 0xffffffff
je 0x404482
cmp eax, 0xffff
je 0x404482
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
movzx eax, si
inc eax
je 0x4043ab
movzx eax, si
cmp eax, 0xffff
jne 0x4043b9
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x404482
test edi, edi
je 0x404410
mov eax, dword [0x4080d8]
push eax
mov ecx, pe_overlay
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
mov edi, eax
test edi, edi
jne 0x4043ff
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404482
push 0
push 0
push 0
movzx eax, bx
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x404415
mov edi, 0x8200
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push 0x4094bc
movzx eax, bx
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x404447
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push 0x4094bc
movzx eax, si
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x404469
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404482
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4044a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x4044b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x40456f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
call fcn.00402ec8
push 0
lea eax, [ebp - 8]
push eax
push 0xff
push 0x4094bc
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x404559
cmp dword [ebp - 8], 0
je 0x404559
mov si, word [ebp - 8]
test si, si
jbe 0x40453c
mov word [ebp - 0xa], 1
mov ebx, 0x4094bc
cmp byte [ebx], 0
je 0x40453c
lea eax, [ebp - 0x10]
mov dl, byte [ebx]
xor dl, byte [0x4080a8]
call fcn.00402fdc
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00403040
inc word [ebp - 0xa]
inc ebx
dec si
jne 0x404513
push 1
push 0
mov eax, dword [ebp - 8]
neg eax
movzx edx, word [ebp - 0xa]
add eax, edx
push eax
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_SetFilePointer_1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404576
lea eax, [ebp - 0x10]
call fcn.00402ec8
ret
Function at 0x4049dc
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x404b52
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
movzx esi, bx
cmp esi, 0xffffffff
je 0x404a40
cmp esi, 0xffff
jne 0x404a4b
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
mov eax, dword [0x4080d8]
push eax
mov ecx, pe_overlay
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
test eax, eax
jne 0x404a71
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
push 0
push 0
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
movzx eax, si
cmp eax, 0xffffffff
je 0x404aad
cmp eax, 0xffff
jne 0x404ab8
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
push 0
lea eax, [ebp - 0x10]
push eax
push pe_overlay
push 0x4094bc
movzx edi, bx
push edi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x404af1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x4094bc
movzx eax, si
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x404b10
push edi
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404b37
cmp dword [ebp - 0x10], 0
je 0x404b1e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x404ab8
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b59
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x404c24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0
push 0
push 0
movzx esi, bx
push esi
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
call fcn.00402ec8
mov eax, dword [0x4080d4]
push eax
mov ecx, 0x300
xor edx, edx
mov eax, ebx
call fcn.004041f4
test eax, eax
je 0x404c77
mov dword [edi], 0xffffffff
mov eax, dword [0x4080d8]
push eax
mov ecx, pe_overlay
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
test eax, eax
jne 0x404c9c
mov eax, dword [ebp + 8]
call fcn.00402ec8
jmp 0x404cb4
push 0
push 0
sub eax, 5
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.004044b0
push 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0x4094bc
push esi
call sub.kernel32.dll_ReadFile_1
mov al, byte [0x4094bc]
cmp al, byte [0x4080a8]
jne 0x404cdd
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404cf4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004031ec
xor eax, eax
push ebp
push 0x404da3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x10]
mov dl, byte [0x4080a8]
call fcn.00402fdc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403040
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_lstrlenA_1
mov ebx, eax
test bl, bl
jbe 0x404d82
mov byte [ebp - 5], 1
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
xor al, byte [0x4080a8]
mov byte [ebp - 6], al
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 6]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x404d85
inc byte [ebp - 5]
dec bl
jne 0x404d50
or edi, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404daa
lea eax, [ebp - 0x10]
call fcn.00402ec8
lea eax, [ebp - 4]
call fcn.00402ec8
ret
Function at 0x4051a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
mov eax, dword [ebp + 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x405267
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0x405278
push 0
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x405244
mov eax, dword [ebp + 8]
call fcn.004031fc
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
push eax
push esi
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405238
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x405244
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40526e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
lea eax, [ebp + 8]
call fcn.00402ec8
ret
Function at 0x405780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor ebx, ebx
movzx eax, bx
push eax
call sub.user32.dll_GetAsyncKeyState
inc ebx
cmp bx, 0x100
jne 0x405783
pop ebx
ret

Function at 0x405798
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x405874
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402ec8
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405851
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.004032c4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405832
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x405851
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 0x10]
call fcn.004032c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00402f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40587b
lea eax, [ebp - 0x10]
call fcn.00402ec8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x405884
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
xor eax, eax
push ebp
push 0x405a62
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push dword [ebp - 4]
push dword [0x4080c4]
push dword [0x4080c8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004030f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x405963
xor ebx, ebx
jmp 0x40595f
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403028
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.00403084
mov eax, dword [ebp - 0x14c]
or edx, 0xffffffff
call fcn.004053f0
test eax, eax
je 0x40593a
inc dword [0x4194c4]
cmp dword [0x4194c4], 5
jne 0x40594b
or edi, 0xffffffff
jmp 0x405a37
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40595f
or ebx, 0xffffffff
test ebx, ebx
je 0x4058f8
push dword [ebp - 4]
push dword [0x4080c4]
push dword [0x4080cc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004030f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x405a37
xor ebx, ebx
jmp 0x405a2f
cmp dword [ebp - 0x148], 0x10
jne 0x405a1b
push 0x405a74
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x405a1b
push 0x405a78
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x405a1b
push dword [ebp - 4]
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403028
push dword [ebp - 0x14c]
push 0x405a84
lea eax, [ebp - 8]
mov edx, 3
call fcn.004030f8
mov eax, dword [ebp - 8]
call fcn.00405884
test eax, eax
je 0x405a1b
or edi, 0xffffffff
jmp 0x405a37
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x405a2f
or ebx, 0xffffffff
test ebx, ebx
je 0x4059a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a69
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00402eec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x405a88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
xor eax, eax
push ebp
push 0x405bbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x405bcc
push 0
push dword [0x4080e0]
push dword [0x4080ec]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00402fdc
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030f8
mov eax, dword [ebp - 0xc]
call fcn.004031fc
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x405b98
mov eax, dword [ebp - 4]
call fcn.004031fc
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
push eax
push esi
push 1
push 0
mov eax, dword [0x4080f0]
call fcn.004031fc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x405b81
push 4
push 0x4080b4
push 4
push 0
mov eax, dword [0x4080f4]
call fcn.004031fc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x405b81
push 4
push 0x4080b8
push 4
push 0
mov eax, dword [0x4080f8]
call fcn.004031fc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405b8c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x405b98
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bc2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00402eec
lea eax, [ebp - 4]
call fcn.00402ec8
ret

Function at 0x405bd0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x405c4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov bl, 1
lea eax, [ebp - 8]
mov edx, ebx
add dl, 0x40
call fcn.00402fdc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x4080d0]
call fcn.00403084
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_GetDriveTypeA
dec eax
jle 0x405c29
mov eax, dword [ebp - 4]
call fcn.00405a88
test eax, eax
je 0x405c29
or esi, 0xffffffff
inc ebx
cmp bl, 0x1b
jne 0x405beb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c51
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x405c5c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x405cdf
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
xor eax, eax
mov dword [0x4194c4], eax
mov bl, 3
lea eax, [ebp - 8]
mov edx, ebx
add dl, 0x40
call fcn.00402fdc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x4080d0]
call fcn.00403084
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x405cbc
mov eax, dword [ebp - 4]
call fcn.00405884
test eax, eax
jne 0x405cc4
inc ebx
cmp bl, 0x1b
jne 0x405c7f
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ce6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret

Function at 0x405cf0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
add esp, 0xfffffd68
mov ebx, edx
mov dword [esp], eax
xor esi, esi
lea eax, [esp + 8]
push eax
mov dl, 1
mov al, 1
call fcn.00403fac
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x405db3
push pe_nt_image_headers32
lea eax, [esp + 0x19a]
push eax
call sub.wsock32.dll_gethostname
inc eax
jne 0x405d37
call sub.wsock32.dll_WSACleanup
jmp 0x405db3
mov eax, ebx
lea edx, [esp + 0x196]
mov ecx, pe_nt_image_headers32
call fcn.00403028
lea eax, [esp + 0x196]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403fc0
test ebx, ebx
je 0x405da4
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
push dword [esp + 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [esp]
call fcn.00402fec
jmp 0x405dab
call sub.wsock32.dll_WSACleanup
jmp 0x405db3
call sub.wsock32.dll_WSACleanup
or esi, 0xffffffff
mov eax, esi
add esp, 0x298
pop esi
pop ebx
ret
Function at 0x405de8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x405df0
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x405f53
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetLocalTime
push 0x405f6c
push dword [0x4194c8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00402fec
push dword [ebp - 0x18]
push 0x405f78
push dword [0x408128]
push 0x405f78
push dword [0x4194d4]
lea eax, [ebp - 0x1c]
mov dl, byte [0x4080b0]
call fcn.00402fdc
push dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0xc]
call fcn.00405dc0
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov dl, byte [0x4080b0]
call fcn.00402fdc
push dword [ebp - 0x24]
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0xa]
call fcn.00405dc0
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov dl, byte [0x4080b0]
call fcn.00402fdc
push dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 8]
call fcn.00405dc0
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0xc
call fcn.004030f8
push 0
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
lea eax, [ebp - 0x18]
call fcn.0040527c
lea eax, [ebp - 0x18]
mov edx, dword [0x408100]
call fcn.00403040
mov eax, dword [ebp - 0x18]
call fcn.004031fc
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x405f30
xor ebx, ebx
mov esi, dword [0x4194c8]
cmp esi, dword [0x4194d0]
jne 0x405f03
mov eax, dword [0x4194cc]
mov dword [0x4194c8], eax
jmp 0x405f30
push esi
call sub.wsock32.dll_htonl
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x4194c8], eax
inc dword [0x4194c8]
mov eax, dword [0x4194c8]
push eax
call sub.wsock32.dll_htonl
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x4194c8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f5a
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.00402eec
lea eax, [ebp - 4]
call fcn.00402ec8
ret
Function at 0x405ff8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
xor eax, eax
push ebp
push 0x406121
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x4194e4]
cmp al, byte [0x408144]
jbe 0x406069
mov al, byte [0x408144]
mov byte [0x4194e4], al
push 0xcc0020
push 0x10
push 0
mov eax, dword [0x4194dc]
push eax
xor eax, eax
mov al, byte [0x408144]
shl eax, 4
push eax
movzx eax, word [0x4194e0]
mov ecx, 3
cdq
idiv ecx
push eax
push 0
push 0
mov eax, dword [0x4194dc]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 4]
call fcn.004031fc
mov ebx, eax
push ebx
call sub.kernel32.dll_lstrlenA_1
push eax
push ebx
xor eax, eax
mov al, byte [0x4194e4]
dec eax
shl eax, 4
push eax
push 0
mov eax, dword [0x4194dc]
push eax
call sub.gdi32.dll_TextOutA
mov eax, dword [0x408170]
mov edx, dword [0x408108]
call fcn.00403148
jne 0x406100
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_lstrlenA_1
mov ebx, eax
test bx, bx
jbe 0x4060e8
mov si, 1
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
call fcn.00403208
movzx edx, si
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x4194e8]
push eax
call sub.kernel32.dll_WriteFile_1
inc esi
dec bx
jne 0x4060bf
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x406138
mov eax, dword [0x4194e8]
push eax
call sub.kernel32.dll_WriteFile_1
inc byte [0x4194e4]
call fcn.00405fb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406128
lea eax, [ebp - 4]
call fcn.00402ec8
ret
Function at 0x10007430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101331f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101be8d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
push edi
push 0x101447f0
push 3
call fcn.10029b00
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dl, byte [esp + 0x2c]
mov dword [esi + 0x6c], ecx
mov cx, word [esp + 0x34]
mov dword [esi + 0x68], eax
mov ax, word [esp + 0x30]
mov word [esi + 0x74], cx
mov ecx, dword [esp + 0x40]
mov byte [esi + 0x70], dl
mov dx, word [esp + 0x38]
mov word [esi + 0x72], ax
mov ax, word [esp + 0x3c]
push ecx
lea ecx, [esi + 0x80]
mov dword [esp + 0x20], edi
mov dword [esi], vtable.PoDoFo::PdfFontMetricsBase14.0
mov word [esi + 0x76], dx
mov word [esi + 0x78], ax
call fcn.10006950
fldz
movzx edx, byte [esi + 0x70]
fst qword [esi + 0xd8]
movsx ebx, word [esi + 0x74]
fst qword [esi + 0xe0]
fstp qword [esi + 0xe8]
mov dword [esi + 0xa8], edi
movsx edi, word [esi + 0x72]
mov ecx, edi
imul ecx, ecx, 0x3e8
mov byte [esi + 0xa0], dl
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
imul ecx, ecx, 0x3e8
mov dword [esp + 0x2c], eax
mov eax, 0x10624dd3
imul ecx
fild dword [esp + 0x2c]
fstp qword [esi + 0xb8]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ebx
cdq
xor eax, edx
mov dword [esp + 0x2c], ecx
sub eax, edx
add eax, edi
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebx
fstp qword [esi + 0xc8]
mov dword [esi + 0xa4], 0x1f4
fild dword [esp + 0x2c]
mov dword [esi + 0xf8], 0x3e8
fld qword [0x101a53c8]
fdiv st(1), st(0)
fxch st(1)
fstp qword [esi + 0xd0]
fild dword [esp + 0x30]
fdiv st(1)
fst qword [esi + 0xb0]
fild dword [esp + 0x34]
fdivrp st(2)
fxch st(1)
fstp qword [esi + 0xc0]
fmul qword [0x10144788]
fstp qword [esi + 0xf0]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x20