joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432fd0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bd5c
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x433009
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4330fc
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.00474730
add esp, 4
lea ecx, [ebp - 0xc0]
call fcn.0042d7d0
mov edx, 0x4b388c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.0042fe80
mov edx, str.http:__pdf.55.la_
mov ecx, eax
call fcn.0042fe80
mov edx, 0x4b385c
mov ecx, eax
call fcn.0042fe80
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0042d6c0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x433094
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, eax
push 1
push 0x4b38a0
call fcn.004391c0
mov eax, dword [ebp - 0xc4]
add esp, 8
cmp eax, 8
jb 0x4330c5
inc eax
lea ecx, [ebp - 0xd8]
push eax
push dword [ebp - 0xd8]
call fcn.0040aba0
push 5
push 0
push 0
push str.http:__pdf.55.la_
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x58]
call fcn.0042d6e0
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.004575cd
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4345f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0xcc8], 0
je 0x434639
mov ecx, dword [esi + 4]
mov edx, str.ck_W
push 1
push 0x4b22bc
call fcn.004391c0
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 4
push edi
push 0x10
call fcn.00459a9f
mov edi, eax
add esp, 4
mov dword [edi + 4], 0
lea ecx, [edi + 4]
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
test edi, edi
je 0x434688
push ebx
mov dword [edi], esi
call fcn.00410590
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x437110
push 0
push 0
call fcn.00476b26
add esp, 0x18
mov dword [esi + 0xcc8], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 4
Function at 0x435690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
push esi
mov esi, ecx
cmp eax, 4
ja case.default.0x43569f
jmp dword [eax*4 + 0x435708]
push 1
push 0
push 0
push str.https:__wpa.b.qq.com_cgi_wpa.php_ln1keyXzgwMDgwMjE3Nl80OTI5MTRfODAwODAyMTc2XzJf
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 4
call fcn.00434010
pop esi
pop ebp
ret 4
push 1
push 0
push 0
push str.http:__pdftoword.55.la_help
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 4
call fcn.0041dfb0
push 0
push ecx
push dword [esi + 4]
call fcn.0041ef40
pop esi
pop ebp
ret 4
push 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
pop esi
pop ebp
ret 4
Function at 0x436840
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c430
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4369b6
mov edi, dword [eax + 0x720]
mov esi, dword [edi]
cmp esi, edi
je 0x43699b
nop dword [eax]
cmp dword [esi + 0x1c], 8
lea ebx, [esi + 8]
jb 0x43689d
mov eax, dword [ebx]
jmp 0x43689f
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..inf
push eax
call fcn.0047b80b
add esp, 8
test eax, eax
sete al
test al, al
je 0x436991
push 1
push ecx
push 0x4ae80c
mov ecx, ebx
call fcn.00402bb0
inc eax
mov ecx, ebx
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00402a40
mov dword [ebp - 4], 0
cmp dword [ebx + 0x14], 8
jb 0x4368f0
mov eax, dword [ebx]
jmp 0x4368f2
mov eax, ebx
push eax
push 0x4aed34
push str.SpoolFileName
lea eax, [ebp - 0x4c]
push eax
call fcn.00436b20
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00403860
mov eax, dword [ebp - 0x38]
cmp eax, 8
jb 0x43692c
inc eax
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
call fcn.0040aba0
xor eax, eax
mov dword [ebp - 0x38], 7
cmp dword [ebp - 0x18], 8
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0x14], 8
jb 0x43695a
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x43697d
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.0040aba0
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov esi, dword [esi]
cmp esi, edi
jne 0x436890
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
mov ecx, dword [eax + 0xcbc]
mov eax, dword [ecx + 0x550]
add ecx, 0x550
call dword [eax + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 4
Function at 0x4369e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c470
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x436a19
mov eax, dword [esi]
jmp 0x436a1b
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x436a2d
xor al, al
jmp 0x436afe
push 1
push ecx
push 0x4ae80c
mov ecx, esi
call fcn.00402bb0
inc eax
mov ecx, esi
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00402a40
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x436a5c
mov eax, dword [esi]
jmp 0x436a5e
mov eax, esi
push eax
push 0x4aed34
push str.SpoolFileName
lea eax, [ebp - 0x74]
push eax
call fcn.00436b20
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00403860
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
cmp eax, 8
jb 0x436a9c
inc eax
lea ecx, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
call fcn.0040aba0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436ae5
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.0047c427
add esp, 8
test eax, eax
jne 0x436ad7
test dword [ebp - 0x56], 0x8000
je 0x436ae5
push 1
push esi
mov ecx, ebx
call fcn.004348b0
mov bl, 1
jmp 0x436ae7
xor bl, bl
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x436afc
inc ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.0040aba0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 4
Function at 0x436f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c52b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00474730
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._sPDFCreatorSpool
push eax
call fcn.0040e590
xorps xmm0, xmm0
mov dword [ebp - 0x424], 0
movq qword [ebp - 0x42c], xmm0
add esp, 0xc
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
push 0
push 0x4370e0
lea edx, [ebp - 0x42c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x420]
call fcn.00442020
mov edi, dword [ebp - 0x428]
add esp, 8
mov esi, dword [ebp - 0x42c]
cmp esi, edi
je 0x437083
push esi
mov ecx, ebx
call fcn.004369e0
add esi, 0x18
cmp esi, edi
jne 0x437068
mov edi, dword [ebp - 0x428]
mov esi, dword [ebp - 0x42c]
test esi, esi
je 0x4370c0
push dword [ebp - 0x430]
mov edx, edi
push ecx
mov ecx, esi
call fcn.00411080
mov ecx, dword [ebp - 0x424]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x42c]
add esp, 8
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.004109d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x43ff90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x3c0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43ffdd
push 6
push 1
push 2
mov dword [ebp - 0x21c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43ffee
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4b5090]
movq xmm0, qword [str.128.138.140.44]
mov dword [ebp - 0x108], eax
mov ax, word [0x4b5094]
mov word [ebp - 0x104], ax
mov al, byte [0x4b5096]
push 0xf5
mov byte [ebp - 0x102], al
lea eax, [ebp - 0x101]
push 0
push eax
movq qword [ebp - 0x110], xmm0
call fcn.00474730
add esp, 0xc
mov eax, 2
mov word [ebp - 0x22c], ax
push 0x25
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22a], ax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4400c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2743
je 0x4400a3
sub ecx, 9
je 0x4400a3
push eax
lea eax, [ebp - 0x218]
push str.WSAGetLastError__
push eax
call fcn.00441b10
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
push 2
push 4
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jle 0x43ffd1
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push dword [ebp - 0x21c]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x441b50
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d6cb
mov eax, dword fs:[0]
push eax
sub esp, 0xc90
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0xc98], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc94]
mov esi, dword [ebp + 0xc]
push 0x58
push 0
push eax
call fcn.00474730
push 0x800
lea eax, [ebp - 0xc24]
push 0
push eax
call fcn.00474730
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0xc24]
mov dword [ebp - 0xc78], eax
mov ecx, 0x80a00
mov eax, 0x80800
mov dword [ebp - 0xc90], esi
cmovne eax, ecx
mov dword [ebp - 0xc94], 0x58
push 0x208
mov dword [ebp - 0xc60], eax
lea eax, [ebp - 0x424]
push 0
push eax
mov dword [ebp - 0xc64], ebx
mov dword [ebp - 0xc88], edi
mov dword [ebp - 0xc74], 0x400
call fcn.00474730
add esp, 0x24
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x4aed34
lea eax, [ebp - 0xc24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x441da2
movzx eax, word [ebp - 0xc5c]
push eax
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx eax, word [ebp - 0xc5c]
mov ecx, 0x2f30
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call edi
cmp word [ebp + eax*2 - 0x21e], 0x5c
je 0x441cb0
push 0x4ae80c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
movzx eax, word [ebp - 0xc5c]
lea esi, [ebp - 0xc24]
cmp word [esi + eax*2], 0
lea esi, [esi + eax*2]
je 0x441da2
mov ebx, dword [ebp - 0xc98]
xor eax, eax
mov dword [ebp - 0xc28], 7
mov dword [ebp - 0xc2c], 0
mov word [ebp - 0xc3c], ax
cmp word [ebp - 0x21c], ax
jne 0x441cfb
xor ecx, ecx
jmp 0x441d13
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441d04
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc3c]
call fcn.0040a9c0
mov dword [ebp - 4], 0
cmp word [esi], 0
jne 0x441d37
xor eax, eax
jmp 0x441d4f
mov eax, esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441d40
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xc3c]
call fcn.00403730
lea eax, [ebp - 0xc3c]
mov ecx, ebx
push eax
call fcn.004104a0
push esi
call edi
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0xc28]
add esi, 2
cmp eax, 8
jb 0x441d98
inc eax
lea ecx, [ebp - 0xc3c]
push eax
push dword [ebp - 0xc3c]
call fcn.0040aba0
cmp word [esi], 0
jne 0x441cd1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x441dc0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x448
mov eax, dword [0x4cb070]
xor eax, esp
mov dword [esp + 0x444], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], 0
mov edi, ecx
mov esi, edx
push 0
push eax
mov dword [esp + 0x14], edi
call fcn.00474730
add esp, 0xc
lea eax, [esp + 0x10]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], 0x4b36f8
mov dword [esp + 0x24], 0x151
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
jne 0x441e5d
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], eax
mov word [edi], ax
cmp word [esp + 0x38], ax
je 0x441ebb
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441e50
jmp 0x441ed1
push 0x208
lea eax, [esp + 0x244]
push 0
push eax
call fcn.00474730
add esp, 0xc
lea eax, [esp + 0x240]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [esp + 0x38], ax
jne 0x441ebf
xor ecx, ecx
jmp 0x441ed5
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441ec6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call fcn.0040a9c0
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x441f00
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x44200c
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x441f23
sub edx, ecx
sar edx, 1
je 0x44200c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x441ffb
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x441ffb
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00474730
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x20c]
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x441fc6
test dx, dx
je 0x441fc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x441fc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x441fa0
xor eax, eax
jmp 0x441fcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x44200c
lea ecx, [ebp - 0x20c]
call fcn.00441f00
test al, al
je 0x44200c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
pop esi
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x442020
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d70b
mov eax, dword fs:[0]
push eax
sub esp, 0xc80
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0xc70], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xc74], ecx
push 0x4b51bc
push eax
call fcn.00410dd0
add esp, 0xc
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc6c], eax
cmp eax, 0xffffffff
je 0x442200
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0xc3c]
push eax
push dword [ebp - 0xc70]
lea eax, [ebp - 0xa18]
push str._s_s
push eax
call fcn.004422c0
mov eax, dword [ebp - 0xc68]
add esp, 0x10
test al, 0x10
je 0x442117
push 0x4ae524
lea eax, [ebp - 0xc3c]
push eax
call esi
test eax, eax
je 0x442109
push 0x4b51b4
lea eax, [ebp - 0xc3c]
push eax
call esi
test eax, eax
je 0x442109
push 0
push edi
mov edx, ebx
lea ecx, [ebp - 0xa18]
call fcn.00442020
add esp, 8
jmp 0x4421d9
mov eax, dword [ebp - 0xc68]
test al, 0x10
jne 0x4421d9
push dword [ebp - 0xc74]
lea eax, [ebp - 0xa18]
push eax
call edi
add esp, 8
test al, al
je 0x4421d9
xor eax, eax
mov dword [ebp - 0xc78], 7
mov dword [ebp - 0xc7c], 0
mov word [ebp - 0xc8c], ax
cmp word [ebp - 0xa18], ax
je 0x44216f
lea eax, [ebp - 0xa18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x442160
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xc8c]
call fcn.0040a9c0
lea eax, [ebp - 0xc8c]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.004107b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc78]
cmp eax, 8
jb 0x4421bc
inc eax
lea ecx, [ebp - 0xc8c]
push eax
push dword [ebp - 0xc8c]
call fcn.0040aba0
xor eax, eax
mov dword [ebp - 0xc78], 7
mov dword [ebp - 0xc7c], 0
mov word [ebp - 0xc8c], ax
lea eax, [ebp - 0xc68]
push eax
push dword [ebp - 0xc6c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4420a2
push dword [ebp - 0xc6c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x442570
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x224]
mov dword [ebp - 0x22c], ecx
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push closesocket
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x228], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x44275a
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 0x210]
test eax, eax
mov edx, 0x64
cmovne ecx, edx
xor edi, edi
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x442759
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 0
push 0
push eax
call fcn.00474730
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x218], 0
push 0
push eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0x104
call fcn.00474730
push edi
push str._04u
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00443490
add esp, 0x28
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x442735
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.NetCfgInstanceId
push dword [ebp - 0x220]
call ebx
test eax, eax
jne 0x44272d
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x20c]
push eax
call fcn.004012f0
push eax
call fcn.0047c70c
add esp, 8
test eax, eax
jne 0x44272d
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.Characteristics
push dword [ebp - 0x220]
call ebx
test eax, eax
je 0x442744
push dword [ebp - 0x220]
call esi
inc edi
cmp edi, dword [ebp - 0x210]
jb 0x442623
jmp 0x442758
mov eax, dword [ebp - 0x21c]
push dword [ebp - 0x220]
mov dword [ebp - 0x228], eax
call esi
pop ebx
pop edi
push dword [ebp - 0x224]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
pop esi
call fcn.00459a5d
mov esp, ebp
pop ebp
ret
Function at 0x4455e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4cb070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x44560e
mov eax, dword [esi]
jmp 0x445610
mov eax, esi
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0xc]
push eax
push edx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edx
push eax
push edx
push ecx
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x445644
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00459f39
mov ecx, dword [ebp - 0xc]
mov edi, eax
lea ecx, [ecx*2 + 2]
push ecx
push 0
push edi
call fcn.00474730
add esp, 0x10
test edi, edi
je 0x4456c3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x4456a0
push edi
mov ecx, esi
call fcn.0040c450
push edi
call fcn.00459f42
add esp, 4
xor eax, eax
test ebx, ebx
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459a5d
mov esp, ebp
pop ebp
ret 8