joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4482d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push str.SeShutdownPrivilege
lea ecx, [ebp - 0x10]
mov esi, edx
call fcn.00446937
push ecx
lea ecx, [ebp - 0x10]
call fcn.0043bec3
test al, al
jne 0x4482fa
xor esi, esi
jmp 0x448347
cmp ebx, 0x20
je 0x448339
cmp ebx, 0x40
je 0x448335
test bl, 0xb
jne 0x448314
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x448345
xor ecx, ecx
test bl, 0x14
je 0x44831c
inc ecx
xor eax, eax
test bl, 2
je 0x448324
inc eax
push esi
push eax
push ecx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x448345
xor eax, eax
jmp 0x44833c
xor eax, eax
inc eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0043b8b0
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x448355
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x4483d3
jne 0x448368
push 0
jmp 0x4483cd
cmp esi, 0xf
jae 0x4483cc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4483cc
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild qword [ebp - 0x28]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fmul qword [0x4b2760]
call fcn.00471e16
cmp eax, esi
jb 0x448385
jmp 0x4483d3
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret

Function at 0x4484f4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 8]
push eax
push 0x1f4
push 2
push edi
push edi
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x44854f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x449e65
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x449e9f
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x449edc
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
leave
ret 0x10
test dword [ebp + 8], eax
je 0x449ec5
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x449e99
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x449f13
or eax, 0xffffffff
jmp 0x449e99
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x449eea
cmp eax, 0xffffffff
je 0x449eea
push 1
mov edx, esi
mov ecx, eax
call fcn.00449d25
pop ecx
jmp 0x449e97
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40000000
push 0x4b38f4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x449e95
test eax, eax
je 0x449e95
mov ecx, dword [esi]
push 1
lea edx, [ebp + 0x10]
call fcn.00449d25
pop ecx
mov ecx, esi
call fcn.00449cce
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x449e97

Function at 0x449f31
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x449f6a
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x449fa5
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
leave
ret 0x10
test al, 1
je 0x449f8f
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x449f64
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x449fdc
or eax, 0xffffffff
jmp 0x449f64
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x449fb3
cmp eax, 0xffffffff
je 0x449fb3
push 1
mov edx, esi
mov ecx, eax
call fcn.00449d25
pop ecx
jmp 0x449f62
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 1
push bind
push 0x4b38f4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x449f60
test eax, eax
je 0x449f60
mov ecx, dword [esi]
push 1
lea edx, [ebp + 0x10]
call fcn.00449d25
pop ecx
mov ecx, esi
call fcn.00449cce
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x449f62
Function at 0x44a1b7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f5
lea esi, [ebx + 0x34]
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0xffff
call fcn.0042010a
mov edi, eax
mov eax, 0xffff
push eax
mov dword [ebp - 8], edi
mov dword [ebx + 0x10], eax
call fcn.0042010a
pop ecx
pop ecx
push 0
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44a2c1
cmp dword [ebp - 4], 0
jbe 0x44a2be
lea esi, [ebx + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp dword [ebx + 0x10], eax
jae 0x44a283
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 4]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
jns 0x44a24b
fadd qword [0x4b6568]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x4b2750]
call fcn.00471e16
push eax
mov dword [ebx + 0x10], eax
call fcn.0042010a
push dword [ebx + 0xc]
mov dword [ebx + 8], eax
push edi
push dword [ebx + 8]
call fcn.0041faa0
push edi
call fcn.0042017e
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
add esp, 0x14
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 8]
push ecx
push edi
push eax
call fcn.0041faa0
mov eax, dword [ebp - 4]
add dword [ebx + 0xc], eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44a213
mov esi, dword [ebp - 0xc]
push edi
call fcn.0042017e
pop ecx
mov edi, 0x1f6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44a37f
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
jne 0x44a3a3
call fcn.0044a1a9
test al, al
je 0x44a3a3
mov ecx, dword [esi + 8]
call fcn.00449bd1
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.0044a2f6
cmp dword [esi + 0x24], 0
jne 0x44a3d0
mov ecx, esi
call fcn.0044a0ac
test al, al
je 0x44a3d0
call fcn.0044a0a2
test al, al
jne 0x44a3d0
mov ecx, dword [esi + 0x10]
call fcn.00449bd1
mov dword [esi + 0x24], eax
mov ecx, eax
pop esi
jmp fcn.0044a2f6
pop esi
ret

Function at 0x44a3d2
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x44a3e1
call fcn.0044a31d
mov ecx, dword [esi + 0x24]
pop esi
test ecx, ecx
jne fcn.0044a31d
ret

Function at 0x44bed4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4bf7e0]
jne 0x44bee1
call fcn.0044bfb8
mov eax, dword [0x4c34f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c34f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x44bf19
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4bf7e0]
jne 0x44bf2b
call fcn.0044bfb8
mov eax, dword [0x4c34f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c34f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x44bf6e
fadd qword [0x4b6568]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4b6538]
leave
ret

Function at 0x44bf7c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x4c34f8], ecx
mov edx, esi
mov ecx, 0x4c34f8
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
add ecx, 4
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ecx], eax
inc edx
cmp ecx, 0x4c3eb4
jl 0x44bf8d
mov dword [0x4bf7e0], esi
mov dword [0x4c34e4], esi
pop esi
ret

Function at 0x44bfb8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c34e4], 0
push ebx
push esi
push edi
mov esi, 0x4c34f8
jne 0x44bfd8
push 0
call fcn.004240da
pop ecx
mov ecx, eax
call fcn.0044bf7c
mov dword [0x4bf7e0], 0x270
mov dword [0x4c34f0], esi
mov edi, 0xe3
mov ebx, 0x9908b0df
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x44bff2
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x44c023
mov ecx, dword [0x4c34f8]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
xor eax, dword [esi]
and edx, ebx
shr eax, 1
xor eax, dword [esi - 0x38c]
pop edi
xor eax, edx
mov dword [esi], eax
pop esi
pop ebx
ret

Function at 0x44c4d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x44c4f9
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041faa0
add esp, 0xc
jmp 0x44c50c
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.004244ae
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.EA06
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], 0
call fcn.00424560
pop ecx
neg eax
pop ecx
sbb eax, eax
neg eax
pop esi
leave
ret 4
Function at 0x44c5e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x464]
test eax, eax
je 0x44c5f6
cmp eax, ecx
jne 0x44c611
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x45c]
call fcn.004244ae
add esp, 0x10
and dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret

Function at 0x44c629
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x460]
mov esi, dword [edi + 0x458]
mov byte [esi + edx], al
inc dword [edi + 0x460]
mov eax, 0x10000
cmp dword [edi + 0x460], eax
jne 0x44c670
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x458]
call fcn.0042373e
add esp, 0x10
and dword [edi + 0x460], 0
pop edi
pop esi
pop ebp
ret 4

Function at 0x44c676
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x460]
test eax, eax
je 0x44c69e
push dword [esi + 0x20]
push eax
push 1
push dword [esi + 0x458]
call fcn.0042373e
add esp, 0x10
and dword [esi + 0x460], 0
pop esi
ret

Function at 0x44c846
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.0044c6a0
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.0044c6e4
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x44c88a
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.0044c81a
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x44c874
pop edi
pop esi
leave
ret 0xc
Function at 0x44d950
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa2c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x44daa9
push ebx
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push 0x4b3d30
push eax
call fcn.0042234b
lea eax, [ebp - 0x20c]
push eax
call fcn.004218fb
mov ebx, eax
add esp, 0x10
cmp word [ebp + ebx*2 - 0x20e], 0x5c
jne 0x44d9c4
cmp word [ebp + ebx*2 - 0x210], 0x3a
je 0x44d9c4
xor eax, eax
mov word [ebp + ebx*2 - 0x20e], ax
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44d9de
cmp byte [ebp + 0x10], al
je 0x44da9a
push edi
push 0x2200000
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44da91
push 0x618
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00421970
lea eax, [ebx + ebx]
mov word [ebp - 0x81a], ax
mov eax, dword [ebp - 0x81a]
add eax, 2
mov word [ebp - 0x818], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x814]
push eax
mov dword [ebp - 0x824], 0xa0000003
call fcn.00422c1d
mov eax, dword [ebp - 0x81a]
add esp, 0x18
add eax, 0xc
xor edx, edx
push edx
mov word [ebp - 0x820], ax
lea ecx, [ebp + 8]
push ecx
push edx
movzx eax, ax
push edx
add eax, 8
push eax
lea eax, [ebp - 0x824]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
test eax, eax
jne 0x44da9e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
jmp 0x44daa7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 0xc
Function at 0x452044
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4520df
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4520cd
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4520cd
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
or ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
not eax
and ecx, eax
push ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x452190
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45206e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0x452187
lea eax, [ebp - 0x258]
push eax
push 0x4b3a60
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45217e
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x45216c
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x45216c
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x45216c
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452044
test al, al
je 0x45219b
push 0x4b3a68
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45210e
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x452189
xor ebx, ebx
jmp 0x452180
Function at 0x45219f
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452225
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x452213
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x452213
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.00447606
pop ecx
test al, al
je 0x4522d6
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4521c9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0x4522cd
lea eax, [ebp - 0x258]
push eax
push 0x4b3a60
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4522c4
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x4522b2
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4522b2
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4522b2
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045219f
test al, al
je 0x4522e1
push 0x4b3a68
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452254
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x4522cf
xor ebx, ebx
jmp 0x4522c6
Function at 0x4524a9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040caee
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4b3a60
inc dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.004039e8
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x452608
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.0041e76d
cmp eax, 1
je 0x452603
cmp eax, 0xb
jne 0x45252e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45250e
lea eax, [ebp - 0x24c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4525e9
lea eax, [ebp - 0x24c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4525e9
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c935
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004039e8
test byte [ebp - 0x278], 0x10
je 0x4525c6
cmp byte [ebp + 0x18], 0
je 0x452595
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x4525e9
push 0x49dc88
lea ecx, [ebp - 0x10]
call fcn.004039e8
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.004524a9
mov bl, al
test bl, bl
je 0x452605
jmp 0x4525e9
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x25c]
xor eax, eax
or eax, dword [ebp - 0x258]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x4525e9
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45250e
jmp 0x452605
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x24]
call fcn.00405cd3
lea ecx, [ebp - 0x10]
call fcn.00405cd3
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18
Function at 0x454c23
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp dword [ebx + 0x74], 4
push edi
mov edi, ecx
mov esi, dword [edi + 0x54]
mov dword [ebp - 4], esi
jne 0x454c46
or esi, 0x800000
mov dword [ebp - 4], esi
movzx eax, word [ebx + 0x78]
push 0
push 0
push dword [ebx + 0x70]
push dword [ebx + 0x30]
push dword [ebx + 0x20]
push eax
push dword [ebx + 0x10]
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x454c7e
push eax
push 0xdeadbeef
push 0xb
mov ecx, edi
call fcn.004556a9
jmp 0x454d6d
xor ecx, ecx
push ecx
push esi
push ecx
push ecx
push ecx
push dword [ebx + 0x60]
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
jne 0x454ca3
push eax
push 0xdeadbeef
push 0xc
jmp 0x454d57
cmp byte [ebp + 0xc], 0
je 0x454cb2
push ebx
push esi
mov ecx, edi
call fcn.00455703
test dword [ebp - 4], 0x1000
je 0x454ce7
push 4
pop ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
push ebx
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x454d4f
push esi
call fcn.00454be4
cmp eax, 0xc8
jne 0x454d4f
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.0042224a
pop ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov ecx, edi
cmp byte [ebp + 0x10], bl
je 0x454d49
push esi
call fcn.0045550c
jmp 0x454d5e
push 1
push ebx
push ebx
jmp 0x454d59
push ebx
push 0xdeadbeef
push 0xd
mov ecx, edi
call fcn.004556a9
mov bl, al
test esi, esi
je 0x454d6b
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0xc