joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dd10
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cf3c
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42dd80
mov dword [ebp - 0x47c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x47c]
jmp 0x42df51
lea ecx, [ebp - 0x268]
call fcn.00401fd0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.005505ad
add esp, 8
push 0x5898bc
lea ecx, [ebp - 0x474]
push ecx
call fcn.0055057c
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 0x5898c0
lea eax, [ebp - 0x268]
push eax
call fcn.00403430
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x42df18
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x48c]
call fcn.0042dc30
test eax, eax
je 0x42de1a
jmp 0x42deef
lea eax, [ebp - 0x238]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
mov esi, eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0054f4b0
add esp, 4
lea edx, [esi + eax*2]
push edx
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
mov eax, dword [ebp - 0x264]
and eax, 0x10
je 0x42de9f
push ecx
mov ecx, esp
mov dword [ebp - 0x480], esp
lea edx, [ebp - 0x268]
push edx
call fcn.004025c0
mov dword [ebp - 0x490], eax
mov ecx, dword [ebp - 0x48c]
call fcn.0042dd10
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
jne 0x42de9d
jmp 0x42df0b
jmp 0x42deef
mov eax, dword [ebp - 0x264]
and eax, 1
je 0x42ded7
mov byte [ebp - 0x481], 1
lea ecx, [ebp - 0x481]
push ecx
lea edx, [ebp - 0x268]
push edx
mov ecx, dword [ebp - 0x48c]
call fcn.004326c0
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42deef
jmp 0x42df0b
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42ddff
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x488], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 4
Function at 0x42e910
Capabilities:
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00550890
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1028], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x42e9f6
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1028]
call fcn.00430950
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
je 0x42e9f4
cmp dword [ebp - 4], 0
je 0x42e9f4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1020], 0
push 0xfff
push 0
lea ecx, [ebp - 0x101f]
push ecx
call fcn.0054cf20
add esp, 0xc
mov edx, 1
test edx, edx
je 0x42e9f4
push 0
lea eax, [ebp - 0x1024]
push eax
push 0xfff
lea ecx, [ebp - 0x1020]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42e9e7
jmp 0x42e9f4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42e9b9
jmp 0x42ea07
push str.Error_on_CreatePipe__._Launch_File_failed
mov eax, dword [ebp + 0x14]
push eax
call fcn.00403430
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 0x14

Function at 0x42ed60
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 1
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 1
jne 0x42eda2
cmp dword [0x5e3ebc], 6
jb 0x42eda2
cmp dword [0x5e3ec0], 0
jb 0x42eda2
mov dword [ebp - 4], 0
jmp 0x42ee0b
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 5
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42ee0b
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x42ee01
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 4
Function at 0x42f310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 7
mov eax, dword [ebp + 0x14]
push eax
call fcn.0044a493
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0054cf20
add esp, 0xc
lea ecx, [ebp + 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42f388
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403c60
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
jmp 0x42f3a1
push 0x5897c3
mov ecx, dword [ebp + 8]
call fcn.00403c60
mov edx, dword [ebp - 0x10]
or edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42fab0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.004018f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa1
jne 0x42faf4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x589e30
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
jmp 0x42fb9c
cmp dword [ebp - 4], 0xce
jne 0x42fb19
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Exceeds_Range:_t_t_t__s
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
jmp 0x42fb9c
cmp dword [ebp - 4], 3
jne 0x42fb38
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Path_Not_Found:_t_t__s
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
jmp 0x42fb9c
cmp dword [ebp - 4], 0
jne 0x42fb57
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Folder_Created:_t_t__s
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
jmp 0x42fb9c
cmp dword [ebp - 4], 0xb7
je 0x42fb66
cmp dword [ebp - 4], 0x50
jne 0x42fb7f
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Folder_exists:_t_t__s
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
jmp 0x42fb9c
cmp dword [ebp - 4], 3
jne 0x42fb9c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Folder_Path_not_found:_t_t__s
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403430
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x42fca0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d2cb
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
lea ecx, [ebp - 0x268]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.005505ad
add esp, 8
push 0x589fbc
lea edx, [ebp - 0x474]
push edx
call fcn.0055057c
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
push 0x589fc0
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.0055057c
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x42fe89
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x480]
call fcn.0042dc30
test eax, eax
je 0x42fda7
jmp 0x42fe60
lea eax, [ebp - 0x238]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
mov esi, eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0054f4b0
add esp, 4
lea edx, [esi + eax*2]
push edx
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
mov eax, dword [ebp - 0x264]
and eax, 0x10
je 0x42fe12
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
mov ecx, dword [ebp - 0x480]
call fcn.0042fca0
test eax, eax
jne 0x42fe10
jmp 0x42fe7c
jmp 0x42fe60
mov ecx, dword [ebp - 0x264]
and ecx, 1
je 0x42fe48
push 0x80
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005509d0
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42fe60
jmp 0x42fe7c
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42fd8c
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x47c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00402000
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 4
Function at 0x42fed0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d2fe
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
lea ecx, [ebp - 0x268]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.005505ad
add esp, 8
push 0x589fc8
lea edx, [ebp - 0x474]
push edx
call fcn.0055057c
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
push 0x589fcc
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.0055057c
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x4300c6
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x480]
call fcn.0042dc30
test eax, eax
je 0x42ffd7
jmp 0x43009d
lea eax, [ebp - 0x238]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
mov esi, eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0054f4b0
add esp, 4
lea edx, [esi + eax*2]
push edx
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
mov eax, dword [ebp - 0x264]
and eax, 0x10
je 0x430042
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
mov ecx, dword [ebp - 0x480]
call fcn.0042fca0
test eax, eax
jne 0x430040
jmp 0x4300b9
jmp 0x43009d
mov ecx, dword [ebp - 0x264]
and ecx, 1
je 0x430078
push 0x80
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005509d0
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43009d
lea edx, [ebp - 0x268]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00455523
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42ffbc
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x47c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00402000
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 8
Function at 0x430380
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d3d4
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
lea ecx, [ebp - 0x268]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.005505ad
add esp, 8
push 0x589fe4
lea edx, [ebp - 0x474]
push edx
call fcn.0055057c
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
push 0x589fe8
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.0055057c
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x10]
call fcn.00404670
mov byte [ebp - 4], 1
cmp dword [ebp - 0x478], 0xffffffff
je 0x430588
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x498]
call fcn.0042dc30
test eax, eax
je 0x430497
jmp 0x43055f
lea ecx, [ebp - 0x238]
push ecx
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
mov esi, eax
lea edx, [ebp - 0x474]
push edx
call fcn.0054f4b0
add esp, 4
lea eax, [esi + eax*2]
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
mov ecx, dword [ebp - 0x264]
and ecx, 0x10
je 0x4304fc
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
mov ecx, dword [ebp - 0x498]
call fcn.00430380
jmp 0x43055f
lea ecx, [ebp - 0x48c]
call fcn.00462491
mov byte [ebp - 4], 2
push 0
push 0x8000
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
lea ecx, [ebp - 0x48c]
call fcn.004629c0
test eax, eax
je 0x430550
lea ecx, [ebp - 0x48c]
call fcn.0046237d
mov ecx, dword [ebp - 0x498]
add eax, dword [ecx + 8]
adc edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x498]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48c]
call fcn.004625c1
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43047c
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x498]
mov eax, dword [edx + 8]
mov dword [ebp - 0x494], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x490], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00402000
mov eax, dword [ebp - 0x494]
mov edx, dword [ebp - 0x490]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 4
Function at 0x4305f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d40f
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x484], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 1
jne 0x430639
mov dword [0x5e3ef8], 0
lea ecx, [ebp - 0x268]
call fcn.00401fd0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.005505ad
add esp, 8
push 0x589ff0
lea ecx, [ebp - 0x474]
push ecx
call fcn.0055057c
add esp, 8
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
push 0x589ff4
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
push eax
call fcn.0055057c
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
lea edx, [ebp - 0x264]
push edx
lea ecx, [ebp - 0x268]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x4307e0
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x5e3e60
call fcn.0042dc30
test eax, eax
je 0x430714
jmp 0x4307ac
lea ecx, [ebp - 0x238]
push ecx
push 0x400
lea ecx, [ebp - 0x268]
call fcn.00402020
mov esi, eax
lea edx, [ebp - 0x474]
push edx
call fcn.0054f4b0
add esp, 4
lea eax, [esi + eax*2 - 2]
push eax
call fcn.005505ad
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x268]
call fcn.00401cf0
mov ecx, dword [ebp - 0x264]
and ecx, 0x10
je 0x4307a0
lea edx, [ebp - 0x268]
push edx
mov ecx, 0x5e3e60
call fcn.004312c0
mov eax, dword [0x5e3ef8]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x47c], esp
lea edx, [ebp - 0x268]
push edx
call fcn.004025c0
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0x484]
call fcn.004305f0
jmp 0x4307ac
mov dword [0x5e3ef8], 1
jmp 0x4307d1
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4307d1
cmp dword [0x5e3ef8], 0
je 0x4306fa
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4307ea
mov dword [0x5e3ef8], 0
mov eax, dword [0x5e3ef8]
mov dword [ebp - 0x480], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x480]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret 8
Function at 0x430950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0054cf20
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x38], 0x140
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp dword [0x5e3ebc], 6
jb 0x4309b6
cmp dword [0x5e3ec0], 0
jb 0x4309b6
push str.msiexec.exe
mov ecx, dword [ebp + 8]
call fcn.00401ad0
test eax, eax
je 0x4309fc
cmp dword [0x5e3ebc], 5
jne 0x430a03
cmp dword [0x5e3ec0], 0
jb 0x430a03
push 0
mov ecx, 0x5e3e60
call fcn.0042ed60
test eax, eax
jne 0x430a03
push 0x58a01c
mov ecx, 0x5e3f58
call fcn.00401ad0
test eax, eax
jne 0x430a03
push 0x58a020
mov ecx, dword [ebp + 8]
call fcn.00401ad0
test eax, eax
jne 0x430a03
mov dword [ebp - 0x30], str.runas
mov ecx, dword [ebp + 8]
call fcn.004018f0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
call fcn.004018f0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x10], 1
jne 0x430a45
mov dword [ebp + 0x10], 0xffffffff
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4315d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d599
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp + 8]
call fcn.0041a8b0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 8]
call fcn.004030d0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp + 8]
call fcn.00403d00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402000
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.00401f20
movzx ecx, al
test ecx, ecx
jne 0x43177d
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
add edx, 3
push edx
push 0x58a0ac
lea ecx, [ebp + 8]
call fcn.00401eb0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x43170f
mov eax, dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp + 8]
call fcn.004030d0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403d00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00402000
push 0
lea ecx, [ebp - 0x18]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43170d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43170d
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x24]
jmp 0x431796
jmp 0x43176c
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00403d00
push 0
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x431764
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x431764
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x28]
jmp 0x431796
lea ecx, [ebp + 8]
call fcn.00401d70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
jmp 0x43164a
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4