joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e2ad0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6030f4
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
xor eax, eax
movlpd qword [ebp - 0x64], xmm0
mov word [ebp - 0x26], ax
mov ax, word [ebx + 0xc]
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x36], xmm0
movlpd qword [ebp - 0x2e], xmm0
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], ax
movups xmmword [ebp - 0x7c], xmm0
call fcn.005d8c40
neg eax
sbb eax, eax
and eax, ecx
mov ecx, edx
mov dword [ebp - 0x88], eax
call fcn.005d8c40
neg eax
mov ecx, esi
sbb edi, edi
and edi, edx
call fcn.005d8c40
neg eax
movq qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 0
sbb eax, eax
and eax, esi
mov dword [ebp - 0x84], eax
call fcn.005dc5e0
test byte [ebx + 0x10], 2
mov dword [ebp - 4], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x80], 0
je 0x5e2bd3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005e17c0
test eax, eax
je 0x5e2bd3
lea ecx, [ebp - 0x6c]
call fcn.005e1920
mov dword [ebp - 0x80], eax
test edi, edi
je 0x5e2bf1
push 0
push edi
push 0x7d00
lea ecx, [ebp - 0x20]
call fcn.005db9a0
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x84]
push 0
push 0
push 0
push 0
push 0
push edi
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x80], 0
mov esi, eax
je 0x5e2c26
mov ecx, dword [ebp - 0x6c]
call fcn.005e1880
test esi, esi
je 0x5e2c36
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x5e2f10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6031ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 1
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005d9d20
push 0
push 0
push 0x62439c
push 0x624388
mov ecx, esi
call fcn.005da270
push 0
mov ecx, esi
call fcn.005dbc20
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x624284
mov ecx, esi
call fcn.005daa70
mov edi, eax
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
cmp edi, 2
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jle 0x5e2fc5
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5e301b
push 1
push ecx
mov ecx, esi
call fcn.005dc0b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.005dc260
lea ecx, [ebp - 0x1c]
call fcn.005dc3a0
cmp dword [ebp - 0x20], 0
je 0x5e30ed
test eax, eax
jne 0x5e314e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x6243cc
mov ecx, esi
call fcn.005da780
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
je 0x5e3125
mov ecx, ebx
call fcn.005dbeb0
test al, al
je 0x5e3052
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x624284
mov ecx, esi
call fcn.005daa70
cmp eax, 2
jle 0x5e3052
dec eax
mov ecx, esi
push eax
push 1
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.005d9d20
push 0
push 1
push 1
push 0
push 0x62438c
mov ecx, esi
call fcn.005daa70
test eax, eax
je 0x5e3095
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
mov ecx, esi
call fcn.005dc190
push eax
push 0x624388
mov ecx, esi
call fcn.005dc200
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005dad50
sub esp, 0xc
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
mov ecx, dword [ebp - 0x24]
push eax
call fcn.005da510
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.005dc430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x5e3108
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x6243cc
mov ecx, esi
call fcn.005da780
push 0
mov ecx, esi
call fcn.005e8620
test al, al
jne 0x5e301b
lea ecx, [ebp - 0x1c]
call fcn.005dc3a0
test eax, eax
jne 0x5e313c
mov ecx, esi
call fcn.005dc3a0
sub eax, 2
mov ecx, esi
push eax
push 0x624550
call fcn.005da210
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5e301b
xor bl, bl
jmp 0x5e30c5
Function at 0x5e3540
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603299
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x21], dl
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
cmp esi, eax
je 0x5e3677
test esi, esi
je 0x5e3677
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0x14
movlpd qword [ebp - 0x1c], xmm0
call fcn.0041e7cf
mov ebx, eax
mov dword [ebp - 0x18], 0x14
add esp, 4
mov dword [ebp - 0x1c], ebx
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push 0x14
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e365d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5e365d
push 0
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.005e3460
mov edi, eax
test edi, edi
jne 0x5e365f
cmp byte [ebp - 0x21], al
je 0x5e3641
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x5e365d
push eax
call fcn.0041e7cf
push ebx
mov edi, eax
call fcn.0041e1c3
add esp, 8
lea eax, [ebp - 0x14]
mov ebx, edi
push 0
push eax
push dword [ebp - 0x28]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e365d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5e365d
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x5e365d
mov edi, 0x20
jmp 0x5e365f
xor edi, edi
test ebx, ebx
je 0x5e366c
push ebx
call fcn.0041e1c3
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x5e3679
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret

Function at 0x5e3780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x5e37cd
test eax, eax
je 0x5e37cd
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5e37cd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
Function at 0x5e3f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60333d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [esi]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], ebx
cmp eax, 0xffffffff
je 0x5e4096
test eax, eax
je 0x5e4096
mov ecx, edi
mov dword [ebp - 0x14], 0
call fcn.005dc400
test ebx, ebx
jne 0x5e3fca
mov ecx, esi
call fcn.005e4750
mov ebx, eax
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
lea esi, [ebx + 2]
push esi
movlpd qword [ebp - 0x1c], xmm0
call fcn.0041e7cf
mov ebx, eax
mov dword [ebp - 0x18], esi
add esp, 4
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov ecx, eax
shr ecx, 1
mov dword [ebp - 4], 0
push edx
mov dword [ebp - 0x20], ecx
mov word [ebx + ecx*2], dx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5e4017
xor esi, esi
jmp 0x5e4082
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax + 1], 0
mov eax, dword [esi + 4]
test al, 0x20
je 0x5e4047
push 0
push ebx
mov ecx, edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.005dc260
jmp 0x5e4079
test al, 0x40
je 0x5e4058
push dword [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.005d9eb0
jmp 0x5e4079
test eax, 0x180
je 0x5e406c
push ecx
push 0
push ebx
mov ecx, edi
call fcn.005d9e30
jmp 0x5e4079
push 0
push ecx
push 0
push ebx
mov ecx, edi
call fcn.005d9f40
mov ecx, edi
call fcn.005dc3a0
mov esi, eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x5e4092
push ecx
call fcn.0041e1c3
add esp, 4
mov eax, esi
jmp 0x5e4098
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8

Function at 0x5e40c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x5e410d
test eax, eax
je 0x5e410d
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e410d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
Function at 0x5e45a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x5e45ea
test eax, eax
je 0x5e45ea
push 0
lea ecx, [ebp - 0xc]
mov byte [ebp - 5], 0xff
push ecx
push 1
lea ecx, [ebp - 5]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or al, 0xff
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret

Function at 0x5e4600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x5e464e
test eax, eax
je 0x5e464e
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0xffff
push ecx
push 2
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffff
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret

Function at 0x5e46f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x5e473c
test eax, eax
je 0x5e473c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5e473c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret

Function at 0x5e4860
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x5e48e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5e48e2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x5e489f
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x5e48e2
test bl, 2
je 0x5e48bb
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 5
push 1
push esi
call fcn.005d7810
push esi
call edi
test eax, eax
jne 0x5e48e2
test bl, 1
je 0x5e48d9
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x5e48f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, ecx
push esi
mov ebx, edx
call edi
test eax, eax
jne 0x5e4972
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5e4972
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 5
je 0x5e492f
and eax, 0xfffffffa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x5e4972
test bl, 2
je 0x5e494b
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 4
push 1
push esi
call fcn.005d7810
push esi
call edi
test eax, eax
jne 0x5e4972
test bl, 1
je 0x5e4969
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x5e4eb0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603495
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
push ecx
lea ecx, [ebp - 0x20]
call fcn.005dc520
push 0x260
lea eax, [ebp - 0x284]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
cmp esi, 0xffffffff
je 0x5e4f7b
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x30], 1
call fcn.004011a0
mov esi, dword [ebp - 0x34]
cmp esi, 0xffffffff
je 0x5e5085
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x284]
test cl, 0x10
jne 0x5e4f9c
add dword [edi], 1
adc dword [edi + 4], 0
push 0
push 0x1e
push dword [edi + 4]
push dword [edi]
call fcn.0042fcf0
or eax, edx
jne 0x5e4fb6
call fcn.005d8ff0
mov esi, dword [ebp - 0x34]
cmp esi, 0xffffffff
je 0x5e5085
lea eax, [ebp - 0x284]
push eax
push esi
call ebx
test eax, eax
je 0x5e5075
mov esi, dword [ebp - 0x34]
cmp esi, 0xffffffff
je 0x5e5085
nop dword [eax]
cmp word [ebp - 0x258], 0x2e
jne 0x5e5006
mov ax, word [ebp - 0x256]
test ax, ax
je 0x5e5046
cmp ax, 0x2e
jne 0x5e5006
cmp word [ebp - 0x254], 0
je 0x5e5046
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x284]
test eax, eax
je 0x5e4f90
test al, 1
je 0x5e5023
test ecx, 0x400
jne 0x5e5046
test al, 2
je 0x5e5032
test cl, 0x10
je 0x5e4f95
jmp 0x5e5046
test al, 4
je 0x5e4f90
test ecx, 0x10
jne 0x5e4f90
lea eax, [ebp - 0x284]
push eax
push esi
call ebx
test eax, eax
je 0x5e5059
mov esi, dword [ebp - 0x34]
jmp 0x5e4fe0
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
mov dword [ebp - 0x34], esi
cmp esi, esi
je 0x5e5085
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x5e5085
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x5e5180
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60350b
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
sub esp, 8
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
push ebx
call fcn.005dc520
push 0x260
lea eax, [ebp - 0x27c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x27c]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x2c], edx
cmp edx, 0xffffffff
je 0x5e524c
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x28], 1
call fcn.004011a0
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x5e5395
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x27c]
test cl, 0x10
je 0x5e52ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x250]
push eax
push 0x624284
push ebx
lea ecx, [ebp - 0x1c]
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, edi
mov ecx, eax
call fcn.005e5180
call fcn.005d8ff0
mov edx, dword [ebp - 0x2c]
jmp 0x5e52c3
mov eax, dword [ebp - 0x25c]
add dword [edi], eax
mov ecx, dword [ebp - 0x260]
adc dword [edi + 4], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
cmp edx, 0xffffffff
je 0x5e5395
lea eax, [ebp - 0x27c]
push eax
push edx
call esi
test eax, eax
je 0x5e5385
mov edx, dword [ebp - 0x2c]
cmp edx, 0xffffffff
je 0x5e5395
nop word [eax + eax]
cmp word [ebp - 0x250], 0x2e
jne 0x5e5316
mov ax, word [ebp - 0x24e]
test ax, ax
je 0x5e5356
cmp ax, 0x2e
jne 0x5e5316
cmp word [ebp - 0x24c], 0
je 0x5e5356
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x27c]
test eax, eax
je 0x5e5265
test al, 1
je 0x5e5333
test ecx, 0x400
jne 0x5e5356
test al, 2
je 0x5e5342
test cl, 0x10
je 0x5e52ac
jmp 0x5e5356
test al, 4
je 0x5e5265
test ecx, 0x10
jne 0x5e5265
lea eax, [ebp - 0x27c]
push eax
push edx
call esi
test eax, eax
je 0x5e5369
mov edx, dword [ebp - 0x2c]
jmp 0x5e52f0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_FindClose]
or edx, 0xffffffff
mov dword [ebp - 0x2c], edx
cmp edx, edx
je 0x5e5395
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x5e5395
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.005dc430
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x5e5760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603586
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.005e54a0
mov edi, eax
test edi, edi
je 0x5e58f0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.005db9a0
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._regsvr32.exe
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x34]
call fcn.005da780
cmp edi, 1
jne 0x5e585e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__u__i__n__
jmp 0x5e58a4
cmp edi, 2
jne 0x5e5882
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__u__
jmp 0x5e58a4
cmp edi, 3
jne 0x5e58ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__u__i__
lea ecx, [ebp - 0x28]
call fcn.005da780
push 2
push 5
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc190
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005e2a10
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x5e5910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6035ca
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x5e5aaa
call fcn.005e54a0
mov edi, eax
test edi, edi
je 0x5e5aaa
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.005db9a0
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._regsvr32.exe
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x34]
call fcn.005da780
cmp edi, 1
jne 0x5e5a16
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__i__n__
jmp 0x5e5a5c
cmp edi, 2
jne 0x5e5a3a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__
jmp 0x5e5a5c
cmp edi, 3
jne 0x5e5a64
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
push esi
push str.__s__i__
lea ecx, [ebp - 0x28]
call fcn.005da780
push 2
push 5
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc190
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.005e2a10
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
mov eax, esi
jmp 0x5e5aac
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret