joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431480
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.7ef37aa388e1a9a1f6cdcb5d3a5744d
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431527
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431527
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x431540
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x431527
test al, 1
jne 0x431505
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4314d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x431527
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.89dd6d79dfdbd77391555b170b6f75
call fcn.00439b50
add esp, 4
jmp 0x431527

Function at 0x4315d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43164e
cmp eax, 0x2a
jbe 0x431610
push eax
push str.7529e6896f31b7c14be185f5b4bb
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.e34df9397b07b6cb1c5d0bed1bc
call esi
test eax, eax
jne 0x431646
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
Function at 0x431660
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.5159ee09322559adc06b498ff5e71
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431707
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431707
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x431720
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x431707
test al, 1
jne 0x4316e5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4316b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x431707
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.daa36cbf72833e558f5b1b37a5bbfb
call fcn.00439b50
add esp, 4
jmp 0x431707

Function at 0x431810
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xc2
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431891
cmp eax, 0xf
jbe 0x431853
push eax
push str.0a5b190f810b06bb4f27324bf901e
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.2a892fc3887ff9f19
call esi
test eax, eax
jne 0x431889
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
Function at 0x431980
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.9b19d1e73b19b98fe7615c2b956deb
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431a27
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431a27
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x431a40
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x431a27
test al, 1
jne 0x431a05
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4319d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x431a27
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.88b9fdd7d005cac5f50f5b
call fcn.00439b50
add esp, 4
jmp 0x431a27

Function at 0x431a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xd9
idiv ecx
inc esi
sub dl, 9
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x431a86
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431b07
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x431b07
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret
Function at 0x431b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.33a307bb660173692adfd
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.15f17d6fbc0524f97067
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x431b98
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.72577da5a82b132323054f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x431b65
test eax, eax
jne 0x431baf
push edi
push str.c011a7a53d9f3173e119ab9fce_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.5e1fe54d921b8d0fbef__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x431bd0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.8111dcedbd213c8fec052abb842
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431c77
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431c77
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x431c90
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x431c77
test al, 1
jne 0x431c55
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x431c22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x431c77
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.cd8184033afba07d0
call fcn.00439b50
add esp, 4
jmp 0x431c77
Function at 0x431ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.90998bd5085d81691e393
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.9077b42388bdc175139b48a
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x431d18
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.c5910427dbbdcc4780af8dc93
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x431ce5
test eax, eax
jne 0x431d2f
push edi
push str.4589496fdaad880d34ff05d3_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.e2496c4197e92c9b4a6774c9a43__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x431e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44e702
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], ebx
mov byte [esi + 0x74], bl
lea eax, [esi + 0x90]
push eax
mov byte [esp + 0x18], 4
call fcn.0042b5e0
mov byte [esp + 0x14], 5
mov dword [esi + 0xac], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebx
call fcn.00430f00
mov ecx, eax
mov eax, 0x3046e825
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0xa9b
jle 0x431ef1
push 0xa9b
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00419d50
call fcn.00430f50
push esi
call fcn.00433f70
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x432040
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x44d718
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x3c
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x5c], 0
call fcn.00440440
mov eax, 0x2800
mov edi, 0x10
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], 0x3c
cmp dword [esp + 0x70], edi
jae 0x4320b2
lea eax, [esp + 0x5c]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x4320fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x70], edi
jb 0x4320e2
mov eax, dword [esp + 0x5c]
push eax
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
cmp dword [esp + 0x20], 0
jne 0x43212e
cmp dword [esp + 0x70], edi
jb 0x4320e2
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x432162
cmp dword [esp + 0x70], edi
jb 0x4320e2
mov edx, dword [esp + 0x5c]
push edx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov dx, word [esp + 0x24]
test dx, dx
jne 0x43218e
lea ecx, [esp + 0x58]
call fcn.004029a0
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x43216c
mov eax, ecx
sub eax, 1
je 0x4321b3
sub eax, 2
je 0x4321a7
sub eax, 1
jne 0x43216c
mov dword [esi + 0x94], 3
jmp 0x4321bd
mov dword [esi + 0x94], 1
mov eax, dword [esp + 0x10]
push ebx
mov dword [esi + 0x1c], ecx
push eax
mov ecx, esi
mov word [esi + 0x3c], dx
call fcn.00402f50
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esi + 0x20]
call fcn.00402f50
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea ecx, [esi + 0x40]
call fcn.00402f50
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esi + 0x5c]
call fcn.00402f50
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.00402f50
lea ecx, [esp + 0x58]
call fcn.004029a0
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
Function at 0x432f90
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x450670
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push esi
mov dword [esp + 0x2c], 1
call fcn.00433f70
xor ebx, ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x74]
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402be0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x64], 2
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x74]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402be0
push esi
mov byte [esp + 0x68], 1
call fcn.00432e30
xor edi, edi
mov edi, edi
cmp eax, 1
jne 0x43308a
push ebx
sub esp, 0x1c
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00402970
sub esp, 0x1c
mov byte [esp + 0x64], 3
lea edx, [esi + 0x38]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.00402970
push esi
mov byte [esp + 0x68], 1
call fcn.00432e30
inc edi
cmp edi, 0x14
jl 0x433020
lea ecx, [esp + 0x30]
call fcn.004029a0
lea ecx, [esp + 0x4c]
call fcn.004029a0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x38
cmp eax, ebx
jge 0x4330ba
lea ecx, [esp + 0x30]
call fcn.004029a0
lea ecx, [esp + 0x4c]
call fcn.004029a0
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x38
mov ecx, esi
call fcn.00433330
mov edi, eax
lea eax, [esp + 0x17]
mov byte [esp + 0x17], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4330d0
sub eax, edx
mov eax, 0
setne al
sub eax, 1
jne 0x4330f0
call fcn.00406e10
call fcn.004310c0
call fcn.00433150
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x43310a
sub eax, 2
je 0x43310a
sub eax, 4
jne 0x43311b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00431550
call fcn.00406ed0
lea ecx, [esp + 0x30]
call fcn.004029a0
lea ecx, [esp + 0x4c]
call fcn.004029a0
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x38
Function at 0x433330
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x45061b
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.004485b0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1030]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x433398
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.00419d50
call fcn.00430df0
test eax, eax
je 0x4333a6
call fcn.00431240
cmp dword [esi + 0xc0], 0
mov dword [esp + 0x18], 0
je 0x4334fe
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
or ebx, 0xffffffff
mov edx, dword [esi + 0xb0]
lea eax, [esp + 0x18]
push eax
push 0xff6
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x18]
test eax, eax
ja 0x4334b7
cmp dword [esi + 0xb4], 0
je 0x433549
call fcn.00433150
call fcn.00436780
mov dword [esp + 0x1038], ebx
mov eax, dword [esi + 0xbc]
lea ecx, [eax + 1]
mov dword [esi + 0xbc], ecx
cmp eax, 0xa
ja 0x43350d
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406590
test eax, eax
je 0x433449
call fcn.004313d0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov edx, dword [esi + 0x8c]
push edx
sub esp, 0x1c
lea eax, [esi + 0x1c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00402970
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push esi
mov dword [esp + 0x1078], 2
call fcn.00402970
push esi
mov dword [esp + 0x1078], ebx
call fcn.00432e30
mov edi, eax
call fcn.00436780
sub eax, 1
jne 0x43349f
call fcn.00431480
call fcn.00401350
test edi, edi
jl 0x4334f1
lea edi, [esi + 0x70]
mov dword [esi + 0xb8], 0
call fcn.0042b2c0
jmp 0x4334f1
push eax
lea ecx, [esp + 0x28]
push ecx
lea eax, [esi + 0x70]
call fcn.00405840
call fcn.00436700
test eax, eax
je 0x4334d3
call fcn.0041ab40
mov edx, dword [esp + 0x18]
add dword [esi + 0xb8], edx
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xb8]
test eax, eax
je 0x4334f1
cmp ecx, eax
jae 0x433549
cmp dword [esi + 0xc0], 0
jne 0x4333c4
call fcn.00433150
push 0
call fcn.0043af41
add esp, 4
mov eax, dword [esi + 0xc4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [esp + 0x1030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.00439641
add esp, 0x1028
ret
mov dword [esi + 0xc4], 1
jmp 0x43350d
Function at 0x433560
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44dea8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push esi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
cmp dword [edi + 0xc4], 0
jne 0x4335bf
cmp dword [esp + 0x3c], 0x10
jb 0x4335b5
mov eax, dword [esp + 0x28]
push eax
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x4336de
mov eax, dword [esp + 0x28]
mov esi, 0x10
cmp dword [esp + 0x3c], esi
jae 0x4335d2
lea eax, [esp + 0x28]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
call fcn.00430df0
mov dword [esp + 0x1c], 0
cmp ebx, 0xffffffff
jne 0x43361c
cmp dword [esp + 0x3c], esi
jb 0x4335b5
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x4336de
mov dword [esp + 0xc], 0
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jle 0x433647
mov eax, 1
jmp 0x43364e
mov eax, esi
cdq
idiv esi
mov eax, edx
sub eax, 1
jne 0x43366a
call fcn.0041ab40
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00430ea0
test eax, eax
je 0x433678
call fcn.00431550
mov ecx, dword [edi + 0x84]
mov esi, 0x10
cmp dword [edi + 0x88], esi
jb 0x433690
mov eax, dword [edi + 0x74]
jmp 0x433693
lea eax, [edi + 0x74]
push 0
lea edx, [esp + 0x10]
push edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4336b0
cmp dword [esp + 0x3c], esi
jmp 0x4335a6
mov ecx, dword [esp + 0xc]
cmp ecx, dword [edi + 0x84]
je 0x4336cc
lea ecx, [esp + 0x24]
call fcn.004029a0
mov eax, 0x80004005
jmp 0x4336de
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x24]
call fcn.004029a0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00439641
add esp, 0x14
ret 0x1c
Function at 0x436700
Capabilities:
Set uefi variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x436718
sub eax, 2
je 0x436718
sub eax, 4
je 0x436718
xor eax, eax
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
ret

Function at 0x4367b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.0e49202fd8134cf96871
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x436857
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x436857
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x436870
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x436857
test al, 1
jne 0x436835
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x436802
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x436857
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.217f7f7b80614e838
call fcn.00439b50
add esp, 4
jmp 0x436857

Function at 0x4368f0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x48
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43696e
cmp eax, 0x7a
jbe 0x436930
push eax
push str.04f93b0925e3371ba383b
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.f6cf922b3f8d9deb20a3cae
call esi
test eax, eax
jne 0x436966
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret