joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4305da
Capabilities:
Get common file path

Disassembly:
push edi
xor edi, edi
call fcn.004304fb
test al, al
je 0x4306cb
push esi
mov eax, 0x950
call fcn.0042b055
mov esi, eax
test esi, esi
je 0x4306c5
push dword [esp + 0xc]
lea eax, [esi + 0x53e]
push eax
xor eax, eax
call fcn.0043293a
test al, al
je 0x4306bf
lea eax, [esi + 0x746]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
setne al
test al, al
je 0x4306bf
mov ecx, accept
mov dword [esi + 0x14], ecx
lea eax, [esi + 0x10]
mov dword [eax], ecx
xor ecx, ecx
inc ecx
push 0xc
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
push 0x409890
lea ecx, [esi + 0x132]
push ecx
call fcn.0042b0c1
push 2
push 0x40987c
lea ecx, [esi + 0x232]
push ecx
call fcn.0042b0c1
push esi
push eax
push 0x4303e5
push 0x4303ad
push 0x430361
push fcn.00430338
push 0x4302f0
push 0x4302b8
push fcn.00430283
push fcn.004300f7
push fcn.004300e4
lea eax, [esi + 4]
push 0x430466
push eax
call dword [0x437238]
add esp, 0x34
mov dword [esi], eax
test eax, eax
je 0x4306bf
mov edi, esi
jmp 0x4306ca
push esi
call fcn.0042b085
call fcn.004305b9
pop esi
mov eax, edi
pop edi
ret 4

Function at 0x4308d1
Capabilities:
Create thread

Disassembly:
cmp byte [esi], 0x40
jb 0x4308e5
push 0x9b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x430913
cmp dword [esp + 8], 0
je 0x430911
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4308e1
movzx ecx, byte [esi]
mov dword [esi + ecx*4 + 4], eax
inc byte [esi]
mov al, 1
ret 0xc

Function at 0x430939
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430972
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 4]
call fcn.00430a61
mov ebx, eax
jmp 0x430975
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x4309e6
test bl, 1
jne 0x4309e6
cmp dword [ebp + 8], 1
je 0x43098b
cmp dword [ebp + 8], 2
jne 0x4309e6
test ebx, ebx
jne 0x430996
xor eax, eax
mov word [edi], ax
jmp 0x4309e2
shr ebx, 1
lea eax, [ebx - 1]
cmp word [edi + eax*2], 0
jne 0x4309a5
dec ebx
jmp 0x4309b3
inc eax
cmp dword [ebp + 0x10], eax
jbe 0x4309e6
xor ecx, ecx
mov word [edi + eax*2], cx
mov ebx, eax
cmp eax, 2
jbe 0x4309e2
cmp dword [ebp + 8], 2
jne 0x4309e2
push edi
call fcn.0042b441
mov esi, eax
test esi, esi
je 0x4309d9
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4309dc
or ebx, 0xffffffff
push esi
call fcn.0042b085
mov eax, ebx
jmp 0x4309e9
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 0xc
Function at 0x430a94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov eax, reloc.WS2_32.dll_accept
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x430ae1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x430ad8
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret 0x14

Function at 0x430ae8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x430b5c
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x430b24
mov dword [ebp - 8], edi
jmp 0x430b5c
push ebx
add eax, 4
call fcn.0042b055
mov ebx, eax
cmp ebx, edi
je 0x430b5b
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x430b55
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x430b5b
push ebx
call fcn.0042b085
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x430be6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
movzx ecx, cl
push edi
movzx eax, al
push ecx
call fcn.0042c7a9
mov esi, eax
mov dword [ebp - 0xc], esi
call fcn.0042c75d
mov ebx, 0x4098d0
test eax, 0x100
je 0x430c1d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x4098e4
jmp 0x430c27
mov dword [ebp - 0x1c], 0x4098e4
mov dword [ebp - 0x18], ebx
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp esi, edi
jbe 0x430cd5
mov eax, dword [ebp + 8]
and eax, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 2
jne 0x430c6c
call fcn.0042c75d
test eax, 0x100
je 0x430c5e
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x4098e4
jmp 0x430c68
mov dword [ebp - 0x1c], 0x4098e4
mov dword [ebp - 0x18], ebx
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esi, dword [ebp + eax*4 - 0x1c]
xor eax, eax
cmp esi, ebx
setne al
dec eax
and eax, 0xd
add eax, 6
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
je 0x430cae
mov eax, edi
sub eax, dword [ebp - 8]
cmp eax, 1
jbe 0x430cae
call fcn.0042c75d
mov ecx, eax
mov eax, 0x101
and ecx, eax
cmp ecx, eax
jne 0x430cae
push 0x20
pop eax
mov dword [ebp - 8], edi
jmp 0x430cbe
mov eax, dword [ebp - 0x14]
dec eax
push 0
call fcn.0042c7a9
movsx ax, byte [eax + esi]
mov ecx, dword [ebp + 0xc]
mov word [ecx + edi*2], ax
inc edi
inc dword [ebp - 4]
cmp edi, dword [ebp - 0xc]
jb 0x430c40
mov esi, dword [ebp - 0xc]
test byte [ebp + 8], 4
je 0x430cf4
test esi, esi
je 0x430cf4
mov edi, dword [ebp + 0xc]
lea eax, [edi + esi*2 - 2]
cmp word [eax], 0x20
jne 0x430cf7
sub eax, 2
dec esi
jne 0x430ce6
jmp 0x430cf7
mov edi, dword [ebp + 0xc]
xor eax, eax
test byte [ebp + 8], 2
mov word [edi + esi*2], ax
je 0x430d10
movzx eax, word [edi]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov word [edi], ax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x430d49
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
mov al, byte [ebp + 0x18]
mov cl, 4
call fcn.00430be6
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push dword [ebp + 0x10]
call fcn.0043293a
test al, al
je 0x430da2
cmp dword [ebp + 0x14], 0
je 0x430d94
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
test eax, eax
je 0x430da2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430daf
inc esi
cmp esi, 0x64
jb 0x430d55
xor al, al
pop esi
leave
ret 0x14
mov al, 1
jmp 0x430daa
Function at 0x430e3c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2d4
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push 0x24
push ebx
mov byte [ebp + 0x73], bl
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x430eda
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x260]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
jmp 0x430ea3
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x430eda
lea eax, [ebp - 0x260]
push eax
call esi
push 0x64
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x260]
push eax
call edi
test eax, eax
je 0x430e7c
cmp word [ebp - 0x44], 0x7b
jne 0x430eda
push dword [ebp + 0x7c]
xor eax, eax
mov word [ebp + 8], ax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x430eda
mov byte [ebp + 0x73], 1
jmp 0x430ee5
push 0x10
push ebx
push dword [ebp + 0x7c]
call fcn.0042b138
mov al, byte [ebp + 0x73]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4
Function at 0x430f9f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x431134
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x240], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x43112b
cmp dword [ebp - 0x238], ebx
jbe 0x43110d
push dword [ebp - 0x238]
push ebx
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x43110d
mov edi, 0x208
push edi
lea ecx, [ebp - 0x650]
push ecx
push eax
call fcn.0042d93f
cmp al, 1
jne 0x431102
lea eax, [ebp - 0x650]
push eax
call fcn.0042bded
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x43106c
push edi
lea eax, [ebp - 0x448]
push eax
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x650]
push eax
call fcn.0042d82d
test al, al
je 0x43106c
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x448]
call fcn.0042c58d
test al, al
jne 0x43106e
xor ebx, ebx
cmp dword [ebp + 0x10], 0
je 0x4310a5
push edi
lea eax, [ebp - 0x448]
push eax
push 3
lea eax, [ebp - 0x650]
push eax
call fcn.0042d82d
test al, al
je 0x4310a5
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x448]
call fcn.0042c58d
test al, al
je 0x4310a5
xor edi, edi
inc edi
jmp 0x4310a7
xor edi, edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4310c3
test esi, esi
je 0x4310c3
lea edx, [esi + 2]
call fcn.0042c58d
test al, al
je 0x4310c3
xor eax, eax
inc eax
jmp 0x4310c5
xor eax, eax
cmp dword [ebp + 0x14], 1
jne 0x4310e7
cmp dword [ebp + 0xc], 0
je 0x4310d5
test ebx, ebx
je 0x431102
cmp dword [ebp + 0x10], 0
je 0x4310df
test edi, edi
je 0x431102
cmp dword [ebp + 8], 0
je 0x4310f9
jmp 0x4310f5
cmp dword [ebp + 0x14], 0
jne 0x431102
test ebx, ebx
jne 0x4310f9
test edi, edi
jne 0x4310f9
test eax, eax
je 0x431102
mov eax, dword [ebp - 0x238]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x43112b
cmp dword [ebp - 4], ebx
je 0x430fe7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x431523
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov eax, esi
mov byte [ebp - 2], 0
call fcn.004312c3
push 0
push 1
mov edi, eax
lea eax, [ebp - 1]
push eax
push esi
or ebx, 0xffffffff
push ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x431556
xor al, al
jmp 0x4315cc
cmp byte [ebp - 1], 0xe9
jne 0x43157f
cmp edi, 0x1e
jb 0x4315c9
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1e
push esi
push ebx
call edi
test eax, eax
je 0x4315c9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffb
jmp 0x4315a6
cmp byte [ebp - 1], 0x68
jne 0x4315c9
cmp edi, 0x1e
jb 0x4315c9
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1e
push esi
push ebx
call edi
test eax, eax
je 0x4315c9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffa
push 0
push eax
push dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4315bc
mov byte [ebp - 2], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x1e
push esi
push ebx
call edi
mov al, byte [ebp - 2]
pop edi
pop ebx
leave
ret 8

Function at 0x4316c7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x50]
push ebx
push edi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x4316f4
xor eax, eax
jmp 0x4317c5
push 0x40
push 0x3000
push ebx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
test eax, eax
je 0x4317c2
push ebx
push edi
call fcn.0042b0d8
mov ebx, eax
xor ecx, ecx
cmp ebx, ecx
je 0x4317ab
cmp dword [esi + 0xa4], ecx
jbe 0x43179f
mov eax, dword [esi + 0xa0]
cmp eax, ecx
jbe 0x43179f
mov esi, dword [esi + 0x34]
mov edx, dword [ebp - 8]
sub edi, esi
sub edx, esi
mov dword [ebp - 0x10], edi
add eax, ebx
jmp 0x431784
mov esi, dword [eax + 4]
cmp esi, 8
jb 0x43177f
add esi, 0xfffffff8
shr esi, 1
mov dword [ebp - 0xc], ecx
je 0x43177f
mov ecx, dword [ebp - 0xc]
movzx ecx, word [eax + ecx*2 + 8]
test cx, cx
je 0x431777
and ecx, 0xfff
add ecx, dword [eax]
mov edi, edx
sub edi, dword [ebp - 0x10]
add dword [ecx + ebx], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jb 0x43175a
add eax, dword [eax + 4]
xor ecx, ecx
cmp dword [eax], ecx
jne 0x431748
push ecx
push dword [ebp - 0x14]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne byte [ebp - 1]
push ebx
call fcn.0042b085
cmp byte [ebp - 1], 0
jne 0x4317c2
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4319b0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push 0x3c
pop edx
push edx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call fcn.0042b138
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x3c], edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x4319f0
xor al, al
jmp 0x431a9c
push 0x10
push ebx
push esi
call fcn.0042b138
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.0042b4e3
mov dword [esi], eax
cmp eax, ebx
je 0x4319e9
jmp 0x431a1a
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x2f
jne 0x431a1f
dec dword [ebp - 0xc]
inc dword [ebp - 0x10]
cmp dword [ebp - 0xc], ebx
ja 0x431a0c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push edi
lea edi, [eax + ecx + 1]
lea eax, [edi + 1]
call fcn.0042b055
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x431a44
push dword [esi]
call fcn.0042b085
xor al, al
jmp 0x431a9b
push dword [ebp - 0xc]
inc eax
push dword [ebp - 0x10]
push eax
call fcn.0042b0c1
push dword [ebp - 4]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [eax + ecx + 1]
push eax
call fcn.0042b0c1
mov eax, dword [esi + 4]
mov byte [eax], 0x2f
mov byte [eax + edi], bl
mov eax, dword [ebp - 0xc]
inc eax
mov dword [esi + 8], eax
mov ax, word [ebp - 0x24]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x30]
sub eax, 3
je 0x431a95
dec eax
je 0x431a8f
mov byte [esi + 0xe], bl
jmp 0x431a99
mov byte [esi + 0xe], 2
jmp 0x431a99
mov byte [esi + 0xe], 1
mov al, 1
pop edi
pop ebx
leave
ret 4

Function at 0x43217c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4321d9
cmp dword [ebp + 0xc], ebx
je 0x4321c3
cmp dword [ebp + 0x10], ebx
je 0x4321c3
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4321c5
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp bl, 1
je 0x4321d9
push dword [ebp + 8]
call fcn.004323be
pop esi
mov al, bl
pop ebx
pop ebp
ret 0xc

Function at 0x4321e1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0
push 0
push 3
push 0
push 1
push accept
push dword [ebp + 8]
mov dword [ebp - 4], 0x1fe
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
je 0x43222f
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
cmovne ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x432237
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
and al, 2
movzx eax, al
xor edi, edi
push edi
push edi
neg eax
push 3
sbb eax, eax
push edi
and eax, 6
or eax, 1
push eax
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4322d8
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4322cf
cmp dword [ebp - 4], edi
jne 0x4322cf
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x43228e
mov dword [esi], edi
mov al, 1
jmp 0x4322da
push 4
push 0x3000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
cmp eax, edi
je 0x4322cf
push edi
lea ecx, [ebp + 8]
push ecx
push dword [esi + 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4322c1
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 4]
je 0x43228a
push 0x8000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
leave
ret 4

Function at 0x4323be
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
ret 4

Function at 0x4323df
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0xf5
ja 0x43242b
cmp dword [ebp + 8], 0
mov eax, 0x4099d8
je 0x432410
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x43242b
mov al, 1
jmp 0x43242d
xor al, al
leave
ret 8

Function at 0x432431
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
lea eax, [ebp - 0x208]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0xf5
ja 0x4324ae
xor esi, esi
push dword [ebp + 8]
call fcn.0042c75d
push eax
push 0x4099d8
push 0x4099e0
mov edx, 0x104
lea edi, [ebp - 0x410]
call fcn.0042bebe
add esp, 0x10
cmp eax, 0xffffffff
je 0x4324ae
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0xc]
mov eax, edi
call fcn.0043293a
test al, al
je 0x4324a8
push 0
push 0
push dword [ebp + 0xc]
call fcn.0043217c
test al, al
jne 0x4324b6
inc esi
cmp esi, 0x64
jb 0x432458
xor al, al
pop edi
pop esi
leave
ret 8
mov al, 1
jmp 0x4324b0
Function at 0x4324ba
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
lea eax, [ebp - 0x208]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0xf5
ja 0x432533
xor esi, esi
call fcn.0042c75d
push eax
push 0x4099d8
push 0x4099f4
mov edx, 0x104
lea edi, [ebp - 0x410]
call fcn.0042bebe
add esp, 0xc
cmp eax, 0xffffffff
je 0x432533
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
mov eax, edi
call fcn.0043293a
test al, al
je 0x43252d
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43253b
inc esi
cmp esi, 0x64
jb 0x4324e1
xor al, al
pop edi
pop esi
leave
ret 4
mov al, 1
jmp 0x432535

Function at 0x4326bc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
xor bl, bl
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
test esi, esi
jne 0x4326d5
mov esi, ebp
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4326e7
cmp eax, 0x2f
je 0x4326e7
test ax, ax
jne 0x432713
mov edi, eax
xor eax, eax
push ebp
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x432707
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x432709
test al, 0x10
je 0x43271a
test di, di
je 0x432718
mov word [esi], di
add esi, 2
jmp 0x4326d5
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4

Function at 0x432723
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x458
push esi
push edi
mov edi, ecx
push edi
lea eax, [esp + 0xc]
push eax
mov eax, 0x409a04
call fcn.0043293a
test al, al
je 0x4327c0
lea eax, [esp + 0x210]
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4327c0
lea eax, [esp + 0x23c]
call fcn.0043253f
test al, al
jne 0x4327a6
push edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x244]
call fcn.0043293a
test al, al
je 0x4327a6
test byte [esp + 0x210], 0x10
je 0x43279c
lea ecx, [esp + 8]
call fcn.00432723
jmp 0x4327a6
lea eax, [esp + 8]
push eax
call fcn.004323be
lea eax, [esp + 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x432761
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4327de
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
push ecx
lea eax, [esp + 0x26c]
push eax
mov eax, 0x409a04
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call fcn.0043293a
test al, al
je 0x432931
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x432931
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x432855
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x432927
lea eax, [esp + 0x44]
call fcn.0043253f
test al, al
jne 0x432910
mov eax, dword [esp + 0x18]
and eax, 0x10
je 0x432874
test bl, 2
jne 0x43287d
cmp eax, esi
jne 0x4328bd
test bl, 4
je 0x4328bd
cmp dword [ebp + 8], esi
jbe 0x4328bd
mov eax, dword [esp + 0x14]
push dword [eax + esi*4]
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x4328a0
inc esi
cmp esi, dword [ebp + 8]
jb 0x432882
jmp 0x4328bd
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
call dword [ebp + 0x10]
test al, al
je 0x432927
cmp dword [ebp + 0x20], 0
je 0x4328bd
push dword [ebp + 0x20]
call edi
test byte [esp + 0x18], 0x10
je 0x432910
test bl, 1
je 0x432910
push dword [esp + 0x10]
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x4c]
call fcn.0043293a
test al, al
je 0x432910
cmp dword [ebp + 0x1c], 0
je 0x4328ed
push dword [ebp + 0x1c]
call edi
push dword [ebp + 0x20]
mov edx, dword [esp + 0x18]
push dword [ebp + 0x1c]
lea ecx, [esp + 0x270]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.004327de
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x432839
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c