joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dfa0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x42e008
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
add ecx, 2
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x210]
mov ax, word [edx]
mov word [ebp - 0x21a], ax
add dword [ebp - 0x210], 2
cmp word [ebp - 0x21a], 0
jne 0x42dfd1
mov ecx, dword [ebp - 0x210]
sub ecx, dword [ebp - 0x228]
sar ecx, 1
mov dword [ebp - 0x22c], ecx
jne 0x42e00f
xor eax, eax
jmp 0x42e14f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e02b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x42e035
mov eax, 1
jmp 0x42e14f
mov cx, word [0x546440]
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.0050eb70
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
mov cx, word [eax]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0x218]
cmp cx, word [edx]
jne 0x42e0ff
cmp word [ebp - 0x21c], 0
je 0x42e0f3
mov eax, dword [ebp - 0x214]
mov cx, word [eax + 2]
mov word [ebp - 0x21e], cx
mov edx, dword [ebp - 0x218]
cmp cx, word [edx + 2]
jne 0x42e0ff
add dword [ebp - 0x214], 4
add dword [ebp - 0x218], 4
cmp word [ebp - 0x21e], 0
jne 0x42e099
mov dword [ebp - 0x224], 0
jmp 0x42e10a
sbb eax, eax
or eax, 1
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x230], ecx
cmp dword [ebp - 0x230], 0
jne 0x42e123
xor eax, eax
jmp 0x42e14f
lea edx, [ebp - 0x20c]
push edx
call fcn.0042dfa0
add esp, 4
test eax, eax
je 0x42e146
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x42e14f
xor eax, eax
jmp 0x42e14f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret
Function at 0x42e160
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 8]
push eax
push 0x5581fc
push 1
push 0
push 0x55826c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x42e19b
xor al, al
jmp 0x42e22d
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x798
call fcn.00482f38
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x24]
call eax
lea ecx, [ebp - 0xc]
push ecx
push 0x55821c
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x42e1fb
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
xor al, al
jmp 0x42e22d
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x18]
call edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret 8
Function at 0x42e920
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c168
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
push 4
lea ecx, [ebp - 0x14]
call fcn.0040b430
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.0041fab0
push 4
lea ecx, [ebp - 0x18]
call fcn.0040b430
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x4c]
call fcn.0041fb90
jmp 0x42e987
lea ecx, [ebp - 0x14]
call fcn.0040f8a0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004188b0
movzx ecx, al
test ecx, ecx
je 0x42ea41
lea ecx, [ebp - 0x14]
call fcn.0040f840
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x798
call fcn.00482f38
push eax
lea ecx, [ebp - 0x30]
call fcn.00407920
mov dword [ebp - 4], 0
push 0x5477f0
lea ecx, [ebp - 0x30]
call fcn.0040b750
mov edx, dword [ebp - 0x54]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040b660
lea ecx, [ebp - 0x30]
call fcn.0040bae0
push eax
call fcn.005177fd
add esp, 4
cmp eax, 0xffffffff
jne 0x42ea2d
push 0x5477f4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004217b0
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.0040bae0
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bae0
push eax
call fcn.00517646
add esp, 8
lea ecx, [ebp - 0x48]
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407e30
jmp 0x42e97f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret 4

Function at 0x42ea60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xf023f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ea9b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret
Function at 0x42eb60
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x26c], ecx
mov ecx, 0x17
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42ebd8
push 0
push 0x5477d4
lea ecx, [ebp - 0x268]
push ecx
push str.DisplayIcon
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLagoFast
push reloc.WS2_32.dll_bind
call fcn.004300a0
add esp, 0x18
push 1
lea edx, [ebp - 0x268]
push edx
push 0x546460
lea eax, [ebp - 0x60]
push eax
push reloc.WS2_32.dll_bind
call fcn.00431550
add esp, 0x14
jmp 0x42ebee
push 0x546460
lea ecx, [ebp - 0x60]
push ecx
push reloc.WS2_32.dll_bind
call fcn.0042ea60
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp + 8], 0
jne 0x42ec46
xor eax, eax
jmp 0x42ed20
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xffffffff
jne 0x42ec65
xor eax, eax
jmp 0x42ed20
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42ed11
mov byte [ebp - 0x231], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00517060
add esp, 8
test eax, eax
jne 0x42ecaf
mov byte [ebp - 0x231], 1
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
jne 0x42ecf1
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x238]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x42ecf1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00517060
add esp, 8
test eax, eax
jne 0x42ecef
mov byte [ebp - 0x231], 1
jmp 0x42ecaf
movzx eax, byte [ebp - 0x231]
test eax, eax
je 0x42ed11
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x42ed20
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d4e68
mov esp, ebp
pop ebp
ret 4
Function at 0x4300a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c320
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x4c
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4300fc
jmp 0x43015a
cmp dword [ebp + 0x1c], 0
jne 0x430117
mov dword [ebp - 0x3c], 1
push 0x582c50
lea eax, [ebp - 0x3c]
push eax
call fcn.0050ccad
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
push 0xf003f
push 0
push 0x54643c
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x430156
mov dword [ebp - 0x40], 1
push 0x582c50
lea edx, [ebp - 0x40]
push edx
call fcn.0050ccad
xor eax, eax
jne 0x4300dd
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43018f
mov dword [ebp - 0x44], 2
push 0x582c50
lea eax, [ebp - 0x44]
push eax
call fcn.0050ccad
cmp dword [ebp + 0x1c], 0
jne 0x4301aa
mov dword [ebp - 0x48], 3
push 0x582c50
lea ecx, [ebp - 0x48]
push ecx
call fcn.0050ccad
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 2
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x2c]
mov dx, word [ecx]
mov word [ebp - 0x32], dx
add dword [ebp - 0x2c], 2
cmp word [ebp - 0x32], 0
jne 0x4301b9
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x4c]
sar eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x54], 3
push 0x582c50
lea edx, [ebp - 0x54]
push edx
call fcn.0050ccad
mov eax, dword [ebp - 0x58]
and eax, 1
je 0x43024f
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx]
mov word [ebp - 0x26], dx
mov eax, dword [ebp - 0x30]
mov cx, word [ebp - 0x26]
mov word [eax], cx
mov edx, dword [ebp - 0x38]
add edx, 2
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x30]
add eax, 2
mov dword [ebp - 0x30], eax
cmp word [ebp - 0x26], 0
jne 0x430222
mov ecx, dword [ebp - 0x58]
and ecx, 2
je 0x430261
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x430270
ret
Function at 0x4306a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4306c0
xor al, al
jmp 0x4306ea
mov ecx, dword [ebp - 4]
and ecx, 2
jne 0x4306e8
mov edx, dword [ebp - 4]
or edx, 2
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4306e2
xor al, al
jmp 0x4306ea
mov al, 1
jmp 0x4306ea
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x431550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c5b0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4315a5
jmp 0x431603
cmp dword [ebp + 0x18], 0
jne 0x4315c0
mov dword [ebp - 0x28], 0
push 0x582c50
lea eax, [ebp - 0x28]
push eax
call fcn.0050ccad
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0xf003f
push 0
push 0x54643c
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4315ff
mov dword [ebp - 0x2c], 0
push 0x582c50
lea edx, [ebp - 0x2c]
push edx
call fcn.0050ccad
xor eax, eax
jne 0x431586
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 2
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x20]
mov cx, word [eax]
mov word [ebp - 0x22], cx
add dword [ebp - 0x20], 2
cmp word [ebp - 0x22], 0
jne 0x431612
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x30]
sar edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x38], 1
push 0x582c50
lea edx, [ebp - 0x38]
push edx
call fcn.0050ccad
cmp dword [ebp - 0x3c], 0
je 0x431675
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x431684
ret
Function at 0x4316b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c5e0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x20
mov eax, dword [0x58d224]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431705
jmp 0x431763
cmp dword [ebp + 0x18], 0
jne 0x431720
mov dword [ebp - 0x24], 0
push 0x582c50
lea eax, [ebp - 0x24]
push eax
call fcn.0050ccad
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0xf003f
push 0
push 0x54643c
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43175f
mov dword [ebp - 0x28], 0
push 0x582c50
lea edx, [ebp - 0x28]
push edx
call fcn.0050ccad
xor eax, eax
jne 0x4316e6
mov dword [ebp - 0x18], 1
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x2c], 1
push 0x582c50
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0050ccad
cmp dword [ebp - 0x30], 0
je 0x4317a7
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4317b6
ret
Function at 0x43e2b8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x43e2c6
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x43e311
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x43e31f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x43e382
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43e3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43e3a8
xor al, al
jmp 0x43e3bc
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x43fe38
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x53d588
call fcn.004d5b53
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43fe58
mov al, 1
jmp 0x43fe9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43fe69
xor al, al
jmp 0x43fe9f
lea ecx, [ebp - 0x44]
call fcn.0043ffa2
lea ecx, [ebp - 0x1c]
call fcn.0043f55d
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0044003a
test al, al
je 0x43fe94
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.004d5223
pop ecx
mov al, bl
call fcn.004d5b1c
ret

Function at 0x43fefc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x440551
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret
Function at 0x440a40
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x198
mov eax, dword [0x58d224]
xor eax, esp
mov dword [esp + 0x194], eax
cmp dword [0x592410], 0
jne 0x440aea
mov dword [0x592410], 1
mov dword [fcn.00517b8b], 0x517b8b
mov dword [fcn.00511c7d], 0x511c7d
mov dword [fcn.00517611], 0x517611
mov dword [0x58d0bc], 0x526e6d
mov dword [fcn.00517b80], 0x517b80
call fcn.00448540
test eax, eax
je 0x440afa
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x440afa
mov eax, dword [esp + 4]
cmp al, 2
jne 0x440b11
shr eax, 8
cmp al, 2
jne 0x440b11
call fcn.00446710
test eax, eax
jne 0x440afa
call fcn.00446b00
test eax, eax
jne 0x440afa
mov dword [0x592414], 3
call fcn.00453ae0
lea eax, [esp]
push eax
call fcn.00449af0
add esp, 4
test eax, eax
je 0x440b2e
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004d4e68
add esp, 0x198
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004d4e68
add esp, 0x198
ret
mov ecx, dword [esp + 0x194]
mov eax, dword [esp]
xor ecx, esp
call fcn.004d4e68
add esp, 0x198
ret

Function at 0x440de0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x58d224]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x592410]
mov ecx, eax
inc eax
mov dword [0x592410], eax
test ecx, ecx
je 0x440e1c
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004d4e68
add esp, 0x194
ret
cmp byte [esp + 0x19c], 0
je 0x440e58
mov dword [fcn.00517b8b], 0x517b8b
mov dword [fcn.00511c7d], 0x511c7d
mov dword [fcn.00517611], 0x517611
mov dword [0x58d0bc], 0x526e6d
mov dword [fcn.00517b80], 0x517b80
push ebx
mov ebx, dword [esp + 0x19c]
test bl, 1
je 0x440e6e
call fcn.00448540
test eax, eax
je 0x440ea8
test bl, 2
je 0x440e9f
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x440ea8
mov eax, dword [esp + 4]
cmp al, 2
jne 0x440ec3
shr eax, 8
cmp al, 2
jne 0x440ec3
call fcn.00446710
test eax, eax
jne 0x440ea8
call fcn.00446b00
test eax, eax
je 0x440ecb
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004d4e68
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x440ea8
mov eax, dword [0x592450]
test bl, 4
mov ecx, 1
mov dword [0x592414], ebx
cmovne eax, ecx
mov dword [0x592450], eax
call fcn.00453ae0
mov ecx, dword [esp + 0x194]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.004d4e68
add esp, 0x194
ret
Function at 0x4517d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x58d224]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov edi, dword [esp + 0x114]
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x11c]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.00453e40
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x451815
sub esi, ecx
mov ecx, dword [edi + 0x198]
test ecx, ecx
je 0x451849
cmp byte [edi + 0x4778], al
jne 0x451849
lea edx, [esp + 8]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x451834
mov byte [edi + 0x4778], 1
cmp byte [edi + 0x3c8], 0
je 0x451883
mov byte [esp + esi + 8], 0xa
inc esi
cmp esi, 0x102
jae 0x4518db
mov eax, dword [edi + 0x208]
mov byte [esp + esi + 8], 0
test eax, eax
je 0x45189a
push dword [edi + 0x194]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004d4e68
add esp, 0x108
ret
push dword [edi + 0x190]
push 1
push 2
push 0x54d7d8
call fcn.00516ef5
push dword [edi + 0x190]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.00516ef5
mov ecx, dword [esp + 0x12c]
add esp, 0x20
pop edi
pop esi
xor ecx, esp
call fcn.004d4e68
add esp, 0x108
ret
call fcn.004d57a4
int3

Function at 0x4518f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x58d224]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x4519b9
cmp byte [edi + 0x3c8], 0
je 0x4519b9
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.00453e40
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x451950
mov eax, dword [edi + 0x208]
sub esi, ecx
test eax, eax
je 0x45198e
push dword [edi + 0x194]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004d4e68
add esp, 0x808
ret
push dword [edi + 0x190]
push 1
push 2
push 0x54d7d8
call fcn.00516ef5
push dword [edi + 0x190]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.00516ef5
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004d4e68
add esp, 0x808
ret