joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4297e2
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebx + 4]
and dword [ebp - 4], 0
push esi
push edi
mov esi, 0x43b720
test ecx, ecx
je 0x429800
mov eax, dword [ecx]
jmp 0x429809
mov eax, dword [ebx + 8]
test eax, eax
je 0x42980e
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x429811
mov dword [ebp - 8], esi
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x42981f
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
jmp 0x429822
mov dword [ebp - 0xc], esi
lea esi, [ecx + 0x2c]
test ecx, ecx
jne 0x429852
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x14]
lea esi, [edx + 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x42985d
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x42986c
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x1c]
jmp 0x429835
mov eax, dword [ebx + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [esi]
push 0x44a6f6
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push 1
call fcn.0040bfb2
mov edi, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push edi
call fcn.00434c1c
test eax, eax
je 0x4298f2
test byte [ebp - 4], 1
je 0x4298f2
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4298f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4298c1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x4298cc
mov edi, 0x80004005
push edi
push 0x510
push 0x44a4cc
call fcn.004315c0
push dword [ebp + 8]
push 0x44a682
push edi
call fcn.00430a6a
add esp, 0xc
jmp 0x429981
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], fcn.00428ed2
mov dword [ebp - 0x18], ebx
mov eax, dword [esi]
push 0x62
pop ecx
cmp cx, word [eax]
jne 0x42994f
push 0x69
pop ecx
cmp cx, word [eax + 2]
jne 0x42994f
push 0x74
pop ecx
cmp cx, word [eax + 4]
jne 0x42994f
push 0x73
pop ecx
cmp cx, word [eax + 6]
jne 0x42994f
movzx ecx, word [eax + 8]
push 0x3a
pop edx
cmp dx, cx
je 0x429942
push 0x73
pop edx
cmp dx, cx
jne 0x42994f
push 0x3a
pop ecx
cmp cx, word [eax + 0xa]
jne 0x42994f
push edi
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.0042e558
jmp 0x429968
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push dword [ebx]
call fcn.0042ddae
mov edi, eax
test edi, edi
jns 0x429981
push dword [ebp + 8]
push dword [esi]
push 0x44a6c6
push edi
call fcn.00430a6a
add esp, 0x10
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x42d012
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [esp + 0xc]
or dword [esi + 0x3c], 0xffffffff
push edi
xor ebx, ebx
push ebx
push dword [esp + 0x18]
lea eax, [esi + 0x1c]
push eax
call fcn.0042fb1a
mov edi, eax
cmp edi, ebx
jge 0x42d03f
push 0x44bbda
jmp 0x42d127
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x42d089
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d067
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d072
mov edi, 0x80004005
push edi
push 0x7b
push 0x44b7ae
call fcn.004315c0
push 0x44bbb2
jmp 0x42d127
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x42d0ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d0ab
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d0b6
mov edi, 0x80004005
push edi
push 0x7e
push 0x44b7ae
call fcn.004315c0
push 0x44bb86
jmp 0x42d127
push ebx
push ebx
push esi
push 0x42cdca
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x42d117
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d0f5
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d100
mov edi, 0x80004005
push edi
push 0x82
push 0x44b7ae
call fcn.004315c0
push 0x44bb62
jmp 0x42d127
call fcn.0042c478
mov edi, eax
cmp edi, ebx
jge 0x42d12f
push 0x44bb3a
push edi
call fcn.00430a6a
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x42d1c0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0041de32
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42d1fd
push dword [ebp + 8]
push 0x44bd1a
push eax
call fcn.00430a6a
add esp, 0xc
jmp 0x42d2b1
mov eax, dword [ebp + 0xc]
push ebx
push 0x80
push 4
push ebx
push 4
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x42d263
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d234
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d242
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd3
push 0x44bcda
call fcn.004315c0
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x44bcb8
push dword [ebp - 4]
jmp 0x42d1f0
push ebx
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d2ba
add edi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
je 0x42d28c
cmp edi, 8
jb 0x42d263
cmp edi, 8
je 0x42d296
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [eax], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x42d2b1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d2ce
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d2dc
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xda
push 0x44bcda
call fcn.004315c0
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x44bc98
push dword [ebp - 4]
call fcn.00430a6a
add esp, 0xc
jmp 0x42d2a2
Function at 0x42d306
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push dword [ebp + 0xc]
call fcn.0043504c
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42d33c
push 0x44bc70
push eax
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x42d4a9
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42d422
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x42d4a8
xor edi, edi
mov dword [ebp - 0xc], ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp + 0x1c]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42d460
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], ebx
je 0x42d396
cmp edi, eax
jb 0x42d368
add dword [esi], edi
adc dword [esi + 4], ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x42d3ea
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], ebx
call fcn.0043504c
cmp eax, ebx
jge 0x42d3c5
push 0x44bc70
push eax
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x42d3ea
push ebx
lea eax, [ebp - 0x10]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [esi + edi*8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x42d3ea
cmp edi, 8
jb 0x42d3c5
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x42d414
cmp dword [eax], ebx
je 0x42d414
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.0041ef76
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d49b
cmp dword [ebp - 8], ebx
jne 0x42d33d
jmp 0x42d4a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d436
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d444
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1b0
push 0x44bcda
call fcn.004315c0
push 0x44bd94
push dword [ebp - 4]
jmp 0x42d4a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d474
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d482
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1bc
push 0x44bcda
call fcn.004315c0
push 0x44bd70
jmp 0x42d45b
push 0x44bd52
push eax
call fcn.00430a6a
pop ecx
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x20
Function at 0x42d89e
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x42d8ce
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x42d8db
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00436e18
mov esi, eax
xor edx, edx
cmp esi, edx
jl 0x42da0a
mov edi, dword [ebp + 0x24]
cmp edi, edx
je 0x42d903
mov ecx, edi
cmp word [edi], dx
jne 0x42d906
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0x20]
cmp esi, edx
je 0x42d914
mov eax, esi
cmp word [esi], dx
jne 0x42d917
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x42da19
test esi, esi
je 0x42d97e
cmp word [esi], 0
je 0x42d97e
test edi, edi
je 0x42d97e
cmp word [edi], 0
je 0x42d97e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push ebx
call esi
test eax, eax
je 0x42d97e
push dword [ebp + 0x24]
call edi
push eax
push dword [ebp + 0x24]
push 0x2c
push ebx
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push ebx
call fcn.0042d4b2
mov esi, eax
test esi, esi
js 0x42da54
push dword [ebp + 0x30]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042d6de
mov esi, eax
test esi, esi
js 0x42da60
cmp dword [ebp - 8], 0
jne 0x42d8b8
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov ecx, edi
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00436be2
cmp dword [ebp - 4], 0
je 0x42d9f6
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x42da01
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x2c
push 0x44bf34
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x42d9de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42da2d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42da38
mov esi, 0x80004005
push esi
push 0x216
push 0x44bcda
call fcn.004315c0
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bf16
jmp 0x42da6a
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bef4
jmp 0x42da6a
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bed0
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x42d9de
Function at 0x42ddae
Capabilities:
Create http request
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push ebx
push dword [edi]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0042fb1a
mov esi, eax
cmp esi, ebx
jge 0x42de05
push 0x44c0f6
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x42df5f
push ebx
push ebx
push ebx
push ebx
push 0x44c0ec
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x42de51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42de2f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42de3a
mov esi, 0x80004005
push esi
push 0x96
push 0x44bcda
call fcn.004315c0
push 0x44c0cc
jmp 0x42ddf8
lea eax, [ebp - 0xc]
push eax
push 0x78
push 0x44c0ac
push 0x403128
call fcn.00436e7a
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jbe 0x42dea3
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 6
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 5
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042da78
mov esi, eax
cmp esi, ebx
jge 0x42dede
push dword [ebp - 8]
push 0x44c082
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x42df5f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x24]
lea esi, [ebp - 0x1c]
call fcn.0042d1c0
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [edi + 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042db38
mov esi, eax
cmp esi, ebx
jge 0x42df3d
push dword [ebp - 8]
push 0x44c066
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x42df50
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x42df50
cmp word [eax], bx
je 0x42df50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0xffffffff
je 0x42df5f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x42df6c
push dword [ebp - 0x14]
call fcn.0042eb62
cmp dword [ebp - 4], ebx
je 0x42df7a
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], ebx
je 0x42df87
push dword [ebp - 8]
call fcn.0042eb62
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x42e8bc
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00408720
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jne 0x42e8f2
mov eax, 0x43b720
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x43f28e
push eax
call fcn.0043007e
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x42e972
mov ax, word [ebp + 0x10]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42e967
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42e94a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42e955
mov edi, 0x80004005
push edi
push 0xa9
push 0x44c576
call fcn.004315c0
jmp 0x42e972
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x42e985
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x42e992
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x42e99f
push dword [ebp - 4]
call fcn.0042eb62
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x430150
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x44fc58], 0xffffffff
mov dword [ebp + 8], eax
jne 0x43018c
push ebx
push edi
push 0x450b74
call fcn.0042fd7c
mov ebx, eax
test ebx, ebx
js 0x4301e4
xor ebx, ebx
jmp 0x4301e4
test eax, eax
je 0x4301e4
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [0x44fc58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4301ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4301c4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x4301d4
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jb 0x430190
jmp 0x4301e4
push ebx
push 0x310
push 0x44c63e
call fcn.004315c0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x430742
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
mov edi, dword [0x44fc60]
mov eax, 0x104
push eax
mov dword [ebp - 0x80], eax
xor ebx, ebx
lea eax, [ebp + 0x198]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x4307a4
push esi
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x198]
push eax
call fcn.00434e7e
test eax, eax
jns 0x4307c2
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4307dd
lea eax, [ebp - 0x70]
mov byte [eax], bl
inc eax
dec esi
jne 0x4307d7
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.00436fb6
push dword [ebp - 0x74]
xor esi, esi
push 0x44c77c
inc esi
push esi
call fcn.004306ba
mov eax, dword [ebp - 0x7c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x78]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp + 0x198]
push eax
push 0x44c75e
push esi
call fcn.004306ba
lea eax, [ebp - 0x70]
push eax
push 0x44c74e
push esi
call fcn.004306ba
mov eax, dword [0x44fc5c]
add esp, 0x34
sub eax, ebx
je 0x43085c
dec eax
je 0x430854
dec eax
je 0x43084c
dec eax
jne 0x430862
mov edi, dword [0x44fc6c]
jmp 0x430862
mov edi, dword [0x44fc68]
jmp 0x430862
mov edi, dword [0x44fc64]
jmp 0x430862
mov edi, dword [0x44fc70]
push edi
push 0x44c732
push esi
call fcn.004306ba
add esp, 0xc
cmp dword [ebp - 0x74], ebx
pop edi
pop esi
pop ebx
je 0x430881
push dword [ebp - 0x74]
call fcn.0042eb62
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
xor eax, eax
call fcn.00408498
add ebp, 0x3a4
leave
ret
Function at 0x431162
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x431227
cmp word [eax], bx
je 0x431227
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042fb1a
mov esi, eax
cmp esi, ebx
jl 0x4312aa
lea eax, [ebp - 4]
push eax
call fcn.0043110a
mov esi, eax
cmp esi, ebx
jl 0x4312aa
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jb 0x43129e
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.0043007e
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4312aa
push dword [ebp - 8]
push dword [ebp - 4]
push 0x44c7e8
push ebx
call fcn.0043007e
mov esi, eax
add esp, 0x10
test esi, esi
js 0x4312aa
xor esi, esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43129e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43127f
inc edi
mov esi, 0x800700b7
cmp edi, dword [ebp + 0x10]
jbe 0x4311bf
jmp 0x4312aa
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.0042ea4e
mov esi, eax
cmp esi, ebx
jl 0x4312aa
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4311b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x431262
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x43126d
mov esi, 0x80004005
push esi
push 0x2d2
push 0x44c7b4
call fcn.004315c0
jmp 0x4312aa
cmp eax, 3
jne 0x43128e
push esi
push dword [ebx]
call fcn.00435838
jmp 0x43129c
cmp eax, esi
jle 0x43129c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4312aa
push ebx
call fcn.0043110a
mov esi, eax
cmp dword [ebp - 8], 0
je 0x4312b8
push dword [ebp - 8]
call fcn.0042eb62
cmp dword [ebp - 4], 0
je 0x4312c6
push dword [ebp - 4]
call fcn.0042eb62
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4312d0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, dword [esp + 0xc]
push 0x104
push esi
call fcn.0042ea4e
test eax, eax
js 0x431302
push dword [esi]
push 0
push 0
push dword [esp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x431302
push esi
call fcn.0043110a
pop esi
ret 8
Function at 0x4316a4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00408720
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43173c
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x431713
push 1
push 0x44c7f2
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00431656
mov edi, eax
test edi, edi
js 0x43175b
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00431616
mov edi, eax
test edi, edi
js 0x43175b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x43175b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x431750
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x43175b
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
leave
ret 8