joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f3b3
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1048
call fcn.0041f360
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1060]
xor edi, edi
mov ebx, edi
call fcn.004868e0
mov esi, dword [esp + 0x105c]
mov ebp, eax
push 0x487818
push str.TYPE
push esi
mov dword [esp + 0x1c], ebp
call fcn.0042fad7
test eax, eax
je 0x42f51f
push 0x4877e8
push esi
call fcn.0042f9d6
test eax, eax
je 0x42f51f
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0042fbf5
test eax, eax
je 0x42f51f
push ebp
push str.RETR
push esi
call fcn.0042fad7
test eax, eax
je 0x42f50a
push str.125_150
push esi
call fcn.0042f9d6
test eax, eax
je 0x42f50a
cmp dword [esi + 0x1c], edi
jne 0x42f45b
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0042fb9f
test eax, eax
je 0x42f50a
lea eax, [esp + 0x20]
xor ebx, ebx
push eax
inc ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.0042fd7b
test eax, eax
je 0x42f50a
push edi
push pe_nt_image_headers32
push 2
push edi
push ebx
push 0xc0000000
push dword [esp + 0x107c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
test ebp, ebp
je 0x42f506
push 0x1000
lea eax, [esp + 0x5c]
mov dword [esi + 0x28], edi
push eax
lea eax, [esp + 0x28]
mov dword [esi + 0x2c], edi
push eax
mov dword [esi + 0x30], edi
call fcn.0042f9ea
mov dword [esp + 0x18], eax
test eax, eax
je 0x42f4fd
mov ebx, eax
cmp dword [esi + 0x30], edi
jne 0x42f4f9
push edi
lea eax, [esp + 0x20]
push eax
push ebx
lea eax, [esp + 0x64]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
cdq
add dword [esi + 0x28], eax
lea eax, [esp + 0x58]
push 0x1000
adc dword [esi + 0x2c], edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0042f9ea
mov ebx, eax
test ebx, ebx
jne 0x42f4be
mov ebx, dword [esp + 0x14]
push ebp
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0042fd59
test ebx, ebx
je 0x42f51f
push esi
call fcn.0042faa8
push ebp
call fcn.004868d0
or dword [esi + 0x2c], 0xffffffff
test edi, edi
je 0x42f536
mov dword [esi + 0x28], 0xfffffffd
jmp 0x42f53d
mov dword [esi + 0x28], 0xfffffffe
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1048
ret
Function at 0x42f591
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x42f63a
cmp dword [ebp + 0xc], esi
je 0x42f63a
push edi
push dword [ebp + 8]
push dword [0x4ab3e8]
call fcn.0043c71a
mov edi, eax
test edi, edi
je 0x42f639
or dword [edi + 0x28], 0xffffffff
or dword [edi + 0x2c], 0xffffffff
cmp dword [ebp + 0x14], esi
je 0x42f628
push 0xc
push esi
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov dword [eax], edi
add eax, 4
push eax
call fcn.0043d0e0
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
lea eax, [edi + 8]
push eax
call fcn.0043d0e0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push 0x42f7cf
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42f61f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
jmp 0x42f639
push edi
call fcn.0042f56b
pop ecx
jmp 0x42f639
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0042f657
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x42f657
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.0041f360
push ebx
push ebp
push esi
push edi
push dword [esp + 0x105c]
xor edi, edi
mov dword [esp + 0x18], edi
call fcn.004868e0
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push bind
push dword [esp + 0x1070]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [esp + 0x1054]
mov ebx, eax
test ebx, ebx
je 0x42f7a4
push 0x487818
push str.TYPE
push esi
call fcn.0042fad7
test eax, eax
je 0x42f79d
push 0x4877e8
push esi
call fcn.0042f9d6
test eax, eax
je 0x42f79d
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0042fbf5
test eax, eax
je 0x42f79d
push ebp
push str.STOR
push esi
call fcn.0042fad7
test eax, eax
je 0x42f785
push str.125_150
push esi
call fcn.0042f9d6
test eax, eax
je 0x42f785
cmp dword [esi + 0x1c], edi
jne 0x42f71c
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0042fb9f
test eax, eax
je 0x42f785
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 1
push eax
push esi
call fcn.0042fd7b
test eax, eax
je 0x42f785
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
push edi
lea eax, [esp + 0x14]
push eax
push 0x1000
lea eax, [esp + 0x5c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], edi
jle 0x42f782
push dword [esp + 0x10]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0042fb14
test eax, eax
je 0x42f785
mov eax, dword [esp + 0x10]
cdq
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
cmp dword [esi + 0x30], edi
je 0x42f73c
jmp 0x42f785
xor edi, edi
inc edi
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0042fd59
cmp dword [esp + 0x14], 0
je 0x42f79d
push esi
call fcn.0042faa8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.004868d0
or dword [esi + 0x2c], 0xffffffff
test edi, edi
je 0x42f7bb
mov dword [esi + 0x28], 0xfffffffd
jmp 0x42f7c2
mov dword [esi + 0x28], 0xfffffffe
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1040
ret
Function at 0x42fbf5
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi + 0x1c], ebx
je 0x42fcd6
push 0x487778
push str.PASV
push esi
call fcn.0042fad7
push 0x400
lea eax, [ebp - 0x428]
push eax
push 0x487850
push esi
call fcn.0042fa00
test eax, eax
je 0x42fd4e
lea esi, [ebp - 0x425]
cmp byte [ebp - 0x425], bl
je 0x42fd4e
mov al, byte [esi]
cmp al, 0x30
jl 0x42fc7c
cmp al, 0x39
jg 0x42fc7c
mov ecx, esi
cmp al, 0x39
jg 0x42fc69
inc esi
mov al, byte [esi]
cmp al, 0x30
jge 0x42fc5e
push ecx
mov byte [esi], bl
call sub.MSVCRT.dll_atoi
mov dword [ebp + edi*4 - 0x18], eax
inc edi
pop ecx
cmp edi, 6
je 0x42fc8a
inc esi
cmp byte [esi], bl
jne 0x42fc52
cmp edi, 6
jne 0x42fd4e
push dword [ebp - 0xc]
lea eax, [ebp - 0xc28]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x487854
push eax
call fcn.00486a70
mov eax, dword [ebp - 8]
add esp, 0x18
shl eax, 8
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc28]
push eax
call fcn.0043042a
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x42fd4e
mov dword [ecx + 0x20], 5
jmp 0x42fd4b
push ebx
push 0xffffffffffffffff
call fcn.004309fd
mov dword [esi + 8], eax
test eax, eax
je 0x42fd4e
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0x10
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x26]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
movzx eax, cl
push eax
sar ecx, 8
lea eax, [ebp - 0x428]
and ecx, 0xff
push ecx
push str.127_0_0_1__d__d
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
push str.PORT
push esi
call fcn.0042fad7
push 0x4877e8
push esi
call fcn.0042f9d6
test eax, eax
je 0x42fd4e
xor ebx, ebx
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42fe7e
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push fcn.0042fdcd
push 0x10
push 0x2c
call fcn.0043c7c3
push 0
push 0
push 8
mov dword [0x4aaba0], eax
call fcn.0043c68a
cmp word [0x4aab98], 0
mov dword [0x4ab3f0], eax
jne 0x42ff63
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x42fed6
mov word [0x4aab98], di
jmp 0x42fede
xor eax, eax
mov word [0x4aab98], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4aabb4], eax
test eax, eax
je 0x42ff62
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4878ac
push eax
call esi
push 0x4878b8
push dword [0x4aabb4]
mov dword [0x4aaba4], eax
call esi
push str.getnameinfo
push dword [0x4aabb4]
mov dword [0x4aaba8], eax
call esi
push str.WSAStringToAddressA
push dword [0x4aabb4]
mov dword [0x4aabac], eax
call esi
cmp dword [0x4aaba4], 0
mov dword [0x4aabb0], eax
pop esi
je 0x42ff62
cmp dword [0x4aaba8], 0
je 0x42ff62
cmp dword [0x4aabac], 0
je 0x42ff62
test eax, eax
je 0x42ff62
mov dword [0x4aab9c], edi
pop edi
add esp, 0x190
ret
Function at 0x430461
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x430487
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
jmp 0x4304c4
cmp dword [esi + 0x2c], ebx
je 0x4304c4
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x430497
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x4304c4
push dword [esi + 0x2c]
push ebx
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x430520
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x840
push ebx
push ebp
push esi
push edi
push dword [0x4ab3f0]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.0043c683
mov ebp, dword [esp + 0x854]
xor edi, edi
inc edi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp word [ebp + 0x20], di
jne 0x43058f
push esi
push esi
push dword [ebp]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x4306f1
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.0043ce6a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
jmp 0x4306f1
cmp word [ebp + 0x22], si
je 0x4305c3
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push eax
lea eax, [esp + 0x38]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4305ef
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
jle 0x4306f1
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x430633
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x430618
push dword [esp + 0x1c]
lea eax, [esp + 0x38]
jmp 0x430620
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x430639
mov esi, dword [esi]
test esi, esi
jne 0x430606
jmp 0x430643
lea ebx, [esi + 8]
test esi, esi
jne 0x430682
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.0043ce6a
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
mov dword [ebx + 0x24], ebp
mov al, byte [ebp + 0x22]
mov byte [ebx + 0x20], al
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x430678
push 7
pop ecx
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x430684
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x430672
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x4306b2
push edi
push eax
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x54]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4306e5
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x50]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x840
ret
Function at 0x430861
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
push edi
push dword [esp + 0x14]
xor edi, edi
push dword [0x4aaba0]
call fcn.0043c742
mov ebx, eax
test ebx, ebx
je 0x4309f4
cmp dword [esp + 0x18], 0xffff
push ebp
push esi
ja 0x4309db
mov ebp, dword [esp + 0x24]
push 2
pop ecx
push 0x17
pop eax
test ebp, 0x10000000
je 0x4308ae
mov dword [esp + 0x24], eax
and ebp, 0xefffffff
jmp 0x4308b4
mov eax, ecx
mov dword [esp + 0x24], ecx
test ebp, ebp
jne 0x4308b9
inc ebp
push edi
push ebp
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x4309db
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jle 0x4309d0
push 0x17
pop eax
cmp dword [esp + 0x24], eax
je 0x4308ff
push 2
pop eax
push dword [esp + 0x20]
mov word [ebx + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 6], ax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43095b
cmp word [eax], di
je 0x43095b
push eax
call fcn.004868e0
cmp dword [esp + 0x24], 0x17
mov ecx, eax
mov dword [esp + 0x20], ecx
jne 0x430942
lea eax, [ebx + 0xc]
push eax
push ecx
push 0x17
call fcn.0042ff6a
add esp, 0xc
jmp 0x43094c
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 8], eax
push dword [esp + 0x20]
call fcn.004868d0
mov eax, dword [esp + 0x24]
jmp 0x43097b
mov eax, dword [esp + 0x24]
cmp eax, 0x17
jne 0x430978
mov esi, 0x487884
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
xor edi, edi
jmp 0x430980
mov dword [ebx + 8], edi
cmp eax, 0x17
jne 0x430984
push 0x1c
jmp 0x430986
push 0x10
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x4309d0
cmp ebp, 1
jne 0x4309a7
push 0x64
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x4309d0
xor eax, eax
mov dword [ebx], esi
cmp dword [esp + 0x24], 0x17
mov word [ebx + 0x20], bp
sete al
mov word [ebx + 0x22], ax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x4309c9
mov dword [ebx + 0x24], ebx
jmp 0x4309cc
mov dword [ebx + 0x24], eax
mov edi, ebx
jmp 0x4309d7
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
jne 0x4309f2
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x4309e6
mov ebx, eax
push ebx
push dword [0x4aaba0]
call fcn.0043c6e0
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
pop ecx
ret 0x10
Function at 0x430a0f
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x430a32
lea eax, [ebp + 0xc]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x430a79
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x430a72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x430a76
cmp eax, 0x2746
je 0x430a76
cmp eax, 0x2749
je 0x430a76
cmp eax, 0x274a
je 0x430a76
xor esi, esi
jmp 0x430a79
test esi, esi
jne 0x430a79
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x430b5b
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x430b84
test byte [esp + 8], 2
je 0x430b78
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x430b86
xor eax, eax
ret 8

Function at 0x430c3b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x430cb3
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x430c94
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x430c91
cmp ecx, 0x5c
je 0x430c91
cmp ecx, 0x2f
jne 0x430c9e
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x430c7e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x430cb5
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x430cbb
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x430cdb
cmp dword [esp + 8], 0
je 0x430cdb
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x430cdd
xor eax, eax
ret 8
Function at 0x430fd7
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x43111f
xor ecx, ecx
cmp word [eax], cx
je 0x43111f
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x431030
cmp eax, 3
jne 0x43106a
cmp word [esp + 0xa], 0x3a
jne 0x43106a
cmp eax, 2
jne 0x43104e
lea eax, [esp + 8]
push 0x4878e8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43111f
push 0xfffffffffffffffe
pop edi
jmp 0x43111f
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x43107f
cmp ax, bx
jne 0x431089
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x431072
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4310c8
test byte [esp + 0x21c], 0x10
je 0x4310af
push 0xfffffffffffffffe
pop edi
jmp 0x4310bf
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x43111d
cmp word [esp + 0x10], bp
jne 0x4310d6
cmp word [esp + 0x12], bp
je 0x4310f5
cmp word [esp + 0x10], bx
jne 0x4310e4
cmp word [esp + 0x12], bx
je 0x4310f5
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x43111d
cmp word [esp + 0x12], ax
jne 0x43111d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x43110a
test al, 0x10
je 0x43111d
jmp 0x43111a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43111d
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x431232
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x4aabcc]
push esi
test eax, eax
jne 0x431257
push fcn.0043135f
push 0x10
push 0x258
call fcn.0043c7c3
mov dword [0x4aabcc], eax
push dword [esp + 0xc]
push eax
call fcn.0043c742
mov esi, eax
test esi, esi
je 0x431358
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x431279
mov edi, 0x487048
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x431289
xor eax, eax
cmp word [ebx], ax
jne 0x43128e
mov ebx, 0x4878ec
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x43133f
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x4312ef
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x4312f3
push 0x4878e8
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x4312f3
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x431317
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x43132d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43132b
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x431356
cmp dword [esp + 0x14], 0xffffffff
je 0x43134a
mov esi, dword [esp + 0x14]
push esi
push dword [0x4aabcc]
call fcn.0043c6e0
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x431690
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4316cc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x431cb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x4ab3f4]
call fcn.0043c71a
mov esi, eax
test esi, esi
je 0x431d2f
cmp dword [esi + 4], 0
je 0x431d00
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004327b0
test eax, eax
je 0x431cf4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x431d3a
cmp dword [esp + 8], 0
je 0x431d3a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4
Function at 0x432080
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x432188
cmp word [edx], 0
je 0x432188
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4320ae
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x43210d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x4320e0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4320c0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004326a0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4320e0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.004329e0
mov edi, eax
test edi, edi
je 0x432103
cmp dword [esi + 4], 0
je 0x43215b
push dword [esp + 0x14]
push edi
push esi
call fcn.004326a0
push edi
push 0
push dword [0x4a96f8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x4a96f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc