joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401eb0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [0x4c6c54], 0
je 0x401ee6
push 0
mov eax, dword [0x4c6c54]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4c6c54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c6c54], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f50
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [0x4c6c54], 0
je 0x401f91
push 0
mov eax, dword [0x4c6c54]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4c6c54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c6c54], 0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0x401e10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c6c54], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004055c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x4c]
mov dword [ebp - 0x18], ecx
push 0x499530
mov eax, dword [ebp - 0x10]
add eax, 0x290
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00402040
add esp, 0xc
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x78], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x6c]
push edx
call fcn.00402040
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 2
push str..exe
mov ecx, dword [ebp - 0x80]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00402040
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
call fcn.00402ac0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00402ac0
push str.luh.exe
lea ecx, [ebp - 0x20]
call fcn.00405a60
mov byte [ebp - 4], 6
push 0x499518
lea ecx, [ebp - 0x20]
call fcn.00405650
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00405620
push 0x499518
lea ecx, [ebp - 0x20]
call fcn.00405650
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00405620
lea ecx, [ebp - 0x20]
call fcn.004056b0
push eax
call fcn.00401130
add esp, 4
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x405565
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40554f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405563
push 0x10
push str.TerminateProcess_window
push str.TerminateProcess_window_error
mov ecx, dword [ebp - 0x10]
call fcn.0046ba06
jmp 0x405579
push 0x10
push str.OpenProcess_window
push str.OpenProcess_window_error
mov ecx, dword [ebp - 0x10]
call fcn.0046ba06
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00402ac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405ca7
xor eax, eax
jmp 0x405d27
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405cbe
xor eax, eax
jmp 0x405d27
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x405d0a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x405d0a
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x405ce1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x405d16
xor eax, eax
jmp 0x405d27
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
test ecx, ecx
jne 0x405d24
xor eax, eax
jmp 0x405d27
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a7a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
push ebx
push esi
push edi
mov word [ebp - 0x194], 2
lea eax, [ebp - 0x190]
push eax
mov cx, word [ebp - 0x194]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x100
push 0
push 0x4c6d30
call fcn.0043b730
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40acb0
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
je 0x40ad03
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
jne 0x40ad3a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x40ad3a
push str.hSocket::InitSocket___:_socket_AF_INET__SOCK_STREAM__IPPROTO_TCP__error__r_n
call fcn.0040a6e0
add esp, 4
xor al, al
jmp 0x40adac
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0x8004667e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x40ad81
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
push str.hSocket::InitSocket___:_ioctlsocket_m_skSocket__FIONBIO___u_long_FAR__ulArg__error__r_n
call fcn.0040a6e0
add esp, 4
xor al, al
jmp 0x40adac
mov ecx, dword [ebp - 4]
add ecx, 0x188
call fcn.0040aa80
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.0040aa80
mov eax, dword [ebp - 4]
mov dword [eax + 0x174], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40adc0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043b730
add esp, 0xc
mov word [ebp - 0x14], 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40ae1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40ae17
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x40ae1e
xor al, al
jmp 0x40aeda
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp - 0x20]
push eax
push 1
push 6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40aed8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x2733
je 0x40ae91
cmp dword [ebp - 0x68], 0x2736
je 0x40aeac
cmp dword [ebp - 0x68], 0x274c
je 0x40ae95
jmp 0x40aebb
mov al, 1
jmp 0x40aeda
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.hSocket::Connect___TimeOut:_Connect_To_:__s:_d_r_n
call fcn.0040a6e0
add esp, 0xc
jmp 0x40aecc
push str.hSocket::Connect___Error_:_Socket_No_Init..._r_n
call fcn.0040a6e0
add esp, 4
jmp 0x40aecc
mov eax, dword [ebp - 0x24]
push eax
push str.hSocket::Connect___Error_:_WSAGetLastError_____d_r_n
call fcn.0040a6e0
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.0040aef0
xor al, al
jmp 0x40aeda
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40af60
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
jne 0x40af89
xor al, al
jmp 0x40afde
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043b730
add esp, 0xc
mov word [ebp - 0x14], 2
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
mov ax, word [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40afdc
mov ecx, dword [ebp - 4]
call fcn.0040aef0
xor al, al
jmp 0x40afde
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b0f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x154
push ecx
call fcn.0043d550
add esp, 8
mov eax, dword [ebp - 4]
add eax, 0x154
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b250
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40048
call fcn.0043ce30
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40008], 0xffffffff
cmp dword [ebp + 8], 0
jle 0x40b2c7
cmp dword [ebp - 0x40008], 0xffffffff
jne 0x40b2c7
push 0
push 0x40000
lea eax, [ebp - 0x40004]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x40008], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x40008]
mov dword [eax + 0x1a0], ecx
cmp dword [ebp - 0x40008], 0xffffffff
jne 0x40b2c5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
sub eax, 0x64
mov dword [ebp + 8], eax
jmp 0x40b26d
cmp dword [ebp + 8], 0
jg 0x40b2de
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], 5
xor al, al
jmp 0x40b2fc
lea eax, [ebp - 0x40004]
push eax
mov ecx, dword [ebp - 0x40008]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x188
call fcn.00416440
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b310
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.004164a0
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
jle 0x40b447
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jle 0x40b349
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004684a3
add esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x40b417
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.00416500
movzx edx, al
test edx, edx
je 0x40b404
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x1cc], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x40b3ca
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.00416680
mov byte [ebp - 9], 1
jmp 0x40b402
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40b3f1
cmp dword [ebp - 0x14], 0
jle 0x40b3ef
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.00416680
jmp 0x40b402
mov eax, dword [ebp - 8]
push eax
push str.hSocket::Send__d__:_socket_send_data_error__r_n
call fcn.0040a6e0
add esp, 8
jmp 0x40b415
mov eax, dword [ebp - 8]
push eax
push str.hSocket::Send__d__:_Get_send_buffer_error__r_n
call fcn.0040a6e0
add esp, 8
jmp 0x40b428
mov eax, dword [ebp - 8]
push eax
push str.hSocket::Send__d__error_:_memory_not_enough__r_n
call fcn.0040a6e0
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x40b447
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.004684a8
add esp, 4
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d260
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebx
push esi
push edi
mov byte [ebp - 0xd], 0
mov al, byte [0x4996b4]
mov byte [ebp - 0x110], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 3
mov ecx, dword [ebp + 0xc]
call fcn.0040acb0
push 0
call fcn.0043da35
add esp, 4
push eax
call fcn.0043da06
add esp, 4
mov eax, dword [ebp - 0x118]
sub eax, 1
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jle 0x40d31e
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x40d31e
call fcn.0043da13
cdq
mov ecx, 0x2710
idiv ecx
add edx, 0x1388
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040af60
mov byte [ebp - 0xd], al
jmp 0x40d2d1
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x40d460
mov ecx, dword [ebp + 0xc]
call fcn.0040aff0
movzx eax, al
test eax, eax
je 0x40d460
mov eax, dword [ebp - 0x114]
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x114]
and eax, 0x800000ff
jns 0x40d369
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x120], eax
push 0x499f64
push 0x499f60
mov ecx, dword [ebp + 8]
call fcn.0040b0f0
push eax
call fcn.00414ea0
add esp, 0xc
push eax
lea ecx, [ebp - 0x13c]
call fcn.00402190
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x13c]
call fcn.004086d0
push eax
push str.PORT__s__d__d_r_n
lea edx, [ebp - 0x110]
push edx
call fcn.0043d4bb
add esp, 0x14
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.0043bad0
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040b4a0
push eax
call dword [sym.imp.WS2_32.dll_send]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040fc50
mov ecx, dword [ebp + 0xc]
call fcn.0040b1f0
movzx eax, al
test eax, eax
je 0x40d432
mov byte [ebp - 0x17e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004086b0
mov al, byte [ebp - 0x17e]
jmp 0x40d46f
push str.InitFtpPortSocket___:_port_socket.SetAsyncEvent___error__r_n
call fcn.0040a6e0
add esp, 4
mov byte [ebp - 0x17d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004086b0
mov al, byte [ebp - 0x17d]
jmp 0x40d46f
push str.InitFtpPortSocket___error__r_n
call fcn.0040a6e0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415190
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043cd82
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4151cd
mov eax, dword [ebp + 8]
push eax
call fcn.00415020
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043cd82
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ce20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x50
call fcn.004086d0
push eax
call fcn.0041d530
add esp, 4
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
je 0x41cf06
mov ecx, dword [ebp - 4]
call fcn.0041cfa0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.0043bad0
add esp, 4
add eax, 1
push eax
call fcn.004684a3
add esp, 4
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0043d550
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
call fcn.0041d350
add esp, 4
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00453f10
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x41cee2
mov ecx, dword [ebp - 4]
call fcn.00418f30
push eax
mov ecx, dword [ebp - 4]
call fcn.00418f50
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00454270
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
call fcn.00453f50
add esp, 4
mov byte [ebp - 9], 1
cmp dword [ebp - 0x14], 0
je 0x41cf01
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.004684a8
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x41cf8e
push str..pak
mov ecx, dword [ebp - 4]
add ecx, 0x50
call fcn.0041a110
test eax, eax
jne 0x41cf8e
mov ecx, dword [ebp - 4]
call fcn.0041cfa0
push eax
call fcn.00415020
add esp, 4
push 0x80
mov ecx, dword [ebp - 4]
call fcn.0041cfa0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x49991c
mov ecx, dword [ebp - 4]
call fcn.0041cfa0
push eax
call fcn.0043cd82
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41cf8e
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 4]
call fcn.00418f30
push eax
mov ecx, dword [ebp - 4]
call fcn.00418f50
push eax
call fcn.0043d46f
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043c86c
add esp, 4
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422d90
Capabilities:
Get hostname
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x422da3
xor eax, eax
jmp 0x422e0a
mov dword [ebp - 8], 0xff
cmp dword [ebp + 8], 0
je 0x422dc1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xff
mov eax, dword [ebp + 8]
add eax, 0xff
je 0x422de9
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xff
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x200], 0x20
mov eax, dword [ebp + 8]
add eax, 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423560
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x423576
xor eax, eax
jmp 0x42363a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x49b3d8
mov eax, dword [ebp + 8]
push eax
call fcn.0043cd82
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4235a1
xor eax, eax
jmp 0x42363a
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0xa]
push eax
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x12]
push eax
movzx ecx, word [ebp - 0x16]
push ecx
movzx edx, word [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_information.__date__d._d._d__d:_d:_02d_n
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043e995
add esp, 0x24
mov eax, dword [ebp - 8]
push eax
call fcn.00423060
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00423120
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004231a0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00423290
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00423540
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.0043c86c
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4238b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4238c5
cmp dword [ebp + 0xc], 0
jne 0x4238cf
mov eax, 0x80070057
jmp 0x423990
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42398b
mov eax, dword [ebp - 8]
push eax
call fcn.00468473
add esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x42390e
mov eax, 0x8007000e
jmp 0x423990
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x423979
mov dword [ebp - 0x10], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x499530
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x423979
cmp dword [ebp - 0x10], 0
je 0x423979
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.0046849e
add esp, 4
xor eax, eax
jmp 0x423990
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.0046849e
add esp, 4
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret