joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d6c4
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
xchg edx, eax
cld
inc ecx
rcl dword [esi], 0x15
pop ss
cmp byte [ebx], bh
out dx, eax
or ebx, edx
mov byte [edx + 6], dl
test al, 0x98
pop edi
test eax, 0x8c06187e
out dx, eax
hlt
jno 0x58d722
dec edx
push ebp
fbld tbyte [esi + edi*4 - 0x1d]
adc edi, ecx
mov dl, 0xf5
mov dl, byte [eax]
mov esi, 0x8b5e90cf
lodsb al, byte [esi]
pop edi
js 0x58d668
and dword [edi - 0x3a7060cf], esp
mov dword [edx], edx
jp 0x58d6b0
pop es
pop es
push ebx
mov byte [0xb5602d41], al
mov bl, 0x7d
aam 0x31
salc
mov ch, 0xb3
jge 0x58d6a2
xor esi, edx
dec ebp
cli
jg 0x58d6ca
test eax, esi
mov edi, 0xe798b569
sub byte [ebx], 0xd5
mov cl, 0x68
rcl dword [edi + edi*8 - 0x2700718d]
push esp
cmp byte [eax], 0x25
xchg ebx, eax
fcmove st(0), st(2)
iretd
dec eax
mov esp, es
dec edx
sub al, 0xae
int1
add dword [esi], esp
mov ebx, 0x3f849256
das
ftst
push ebp
clc
cmp al, byte [ecx - 0x69]
sti
inc ebp
and ebx, dword [edi - 0xcc8e1f3]
sub ah, dl
insb byte es:[edi], dx
ror byte [ecx - 0x7fee3f32], 0x1e
aaa
lds ebx, [edi + edi]
push ebp
iretd

Function at 0x59fa08
Capabilities:
Encode data using xor

Disassembly:
inc esi
scasb al, byte es:[edi]
jecxz 0x59f9f8
rol byte [ebx + 0xc9812], 0xd0
outsd dx, dword [esi]
invalid

Function at 0x5cf8d8
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
invalid
sahf
mov cl, 0xc3
out dx, eax
loopne 0x5cf8f6
movsd dword es:[edi], dword [esi]
inc ecx
sub byte [esi - 0x8b759a1], dl
add dword [ebp - 0x79dc0539], eax
adc eax, dword [ecx]
push edx
xor dh, byte [esi]
fidivr dword [eax - 0x1edf3090]
pop ss
mov ch, 1
and edx, dword [edi - 1]
jae 0x5cf860
xor esp, dword [ebx]
mov ecx, 0xc754a962
inc esp
wait
ja 0x5cf94e
inc ecx
mov dh, 0x50
xchg byte [ebx], dh
out 0xa6, eax
xor ch, ch
jno 0x5cf919
and byte [eax + 0x61fb26f1], ch
mov ch, 0x33
add eax, 0x9d579033
test byte [esp + edx*4], al
xor eax, esi
jo 0x5cf8f2
in eax, 0x2a
xchg dword [edx], edx
inc edx
ret 0x971e
xor eax, 0x162228e2
push ebp
salc
salc
and esp, dword [edi]
xor al, 0x12
xchg ecx, eax
stosb byte es:[edi], al
imul esi, dword [esi + 0x37], 0x40
xchg esp, eax
jecxz 0x5cf921
clc
mov bl, 0x87
jb 0x5cf8b9
push edi
sbb dl, byte [edi - 0x6999b78a]
add al, 0x50
cmp eax, 0x7da23397
invalid
invalid

Function at 0x5d15bc
Capabilities:
Encode data using xor

Disassembly:
ja 0x5d1632
invalid
mov eax, 0xc3ffb6cb
dec edi
cmp eax, 0xb059a3f7
and dword [edx + 0x58f68d64], ebp
daa
rcl edi, 0xc7
xchg edi, eax
fdivr qword [ebx]
cld
salc
adc eax, 0x9f4f978
ret 0x625d
jne 0x5d15e7
mov bl, 3
cmp ah, byte [edx - 0x3f913f0]
in al, dx
push es
cld
push edi
imul eax, dword [edx], 0xebc2c582
xor eax, 0xb3a73d36
push eax
cmp cl, byte [esi + 0x653969d]
outsd dx, dword [esi]
loop 0x5d1639
xchg byte [ecx + 0x187ac91a], dh
xor eax, 0x417728fc
lodsd eax, dword [esi]
xor dh, byte [edx + 0x20]
and al, 0xca
sub al, 0x59
cli
and al, bh
retf 0x385

Function at 0x5d8014
Capabilities:
Encode data using xor

Disassembly:
jae 0x5d802a
add dword [0xf524f63a], 0xffffff96
invalid
dec ebx
invalid
Function at 0x5dadf8
Capabilities:
Encode data using xor

Disassembly:
imul dword [ebp - 0x7a]
ljmp 0xb277
jle 0x5dada4
cmp dword [edx - 0x7d19b82f], 0xffffff96
jb 0x5dae72
mov bh, 0x46
push edi
out dx, al
xchg edi, eax
mov dword [0xd219d12], eax
imul esp, dword [esi + 0x479b4d75], 0x87b3792a
outsb dx, byte [esi]
or al, 0xf5
enter 0xffffffffffffc5d9, 0xffffffffffffffb9
inc ebp
Function at 0x418db0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 0x48]
cmp eax, 0xffffffff
je 0x418eba
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x30
mov edx, dword [ecx + 0x2c]
test dl, 0x10
je 0x418eb0
and edx, 1
jne 0x418e28
lea edx, [esp + 0x28]
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x418e80
xor edi, edi
mov eax, dword [esp + 0x28]
add dword [ebx + 0x50], eax
adc dword [ebx + 0x54], edi
add esp, 0x30
pop ebx
pop esi
pop edi
ret 8
lea edx, [esp + 0x2c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 0x28], eax
cmp eax, 0xffffffff
je 0x418e90
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x54], edx
jmp 0x418dd5
lea eax, [ebx + 0x30]
mov dword [esp], eax
call fcn.004420e0
jmp 0x418e0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418e65
lea eax, [ebx + 0x30]
mov dword [esp], eax
call fcn.004420e0
jmp 0x418e65
mov eax, 0xffffffff
jmp 0x418e19
mov eax, 0xffffffff
ret 8
Function at 0x43bec0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5a9120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
add esp, 0x1c
ret
Function at 0x440130
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x18
mov edx, dword [ecx + 8]
test edx, edx
je 0x440190
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x44017d
mov edx, dword [ebx + 0x1c]
mov dword [esp], edx
test al, 0x10
jne 0x440170
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
je 0x44017d
add esp, 0x18
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
jne 0x440168
add ebx, 4
mov dword [esp], ebx
call fcn.0043f260
lea esi, [esi]
nop
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x15b
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
mov eax, dword [ebx + 8]
test eax, eax
jne 0x44013d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x9f
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
jmp 0x44013d

Function at 0x4401f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x440270
mov eax, dword [ebx + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp], eax
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x4402d0
mov eax, dword [ebx + 8]
test eax, eax
je 0x440310
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x4402ef
test al, 0x10
jne 0x440300
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x4402ef
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x17e
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
mov edx, dword [ebx + 8]
test edx, edx
jne 0x4401fe
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x5e
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
jmp 0x4401fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x15
ja 0x4402ef
mov eax, 1
shl eax, cl
test eax, 0x20800c
jne 0x44023f
add ebx, 4
mov dword [esp], ebx
call fcn.0043f260
lea esi, [esi]
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x9f
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
jmp 0x440223
Function at 0x4410f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x18
mov eax, dword [ecx + 8]
test eax, eax
je 0x441120
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
sub esp, 4
mov eax, 1
cmp edx, 0xffffffff
je 0x441150
add esp, 0x18
pop ebx
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x5e
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
jmp 0x4410fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x15
ja 0x44116b
mov eax, 1
shl eax, cl
test eax, 0x20800c
jne 0x441180
add ebx, 4
mov dword [esp], ebx
call fcn.0043f260
lea esi, [esi]
lea esi, [esi]
xor eax, eax
jmp 0x441118

Function at 0x441db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0xd0
mov eax, dword [ecx + 8]
test eax, eax
je 0x441de0
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x441e10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x5e
mov dword [esp + 4], str._home_runner_.conan_data_poco_1.9.4_____build_ddb2b81308510e07b37be09e804e3aad8c61881f_src_Foundation_src_File_WIN32U.cpp
mov dword [esp], str.__path.empty__
call fcn.004087a0
jmp 0x441dc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebx + 4]
mov dword [esp], edx
mov ecx, eax
cmp eax, 0x15
ja 0x441e31
mov eax, 1
shl eax, cl
test eax, 0x20800c
jne 0x441e40
call fcn.0043f260
lea esi, [esi]
lea esi, [esi]
lea ecx, [ebp - 0x78]
call fcn.00446bd0
lea ecx, [ebp - 0x78]
sub esp, 4
call fcn.00447a10
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cmp eax, 0x18
jle 0x441f20
lea ecx, [ebp - 0x78]
call fcn.00446190
lea eax, [ebp - 0x78]
lea esi, [ebp - 0xc4]
mov dword [esp], eax
mov ecx, esi
call fcn.00445ba0
sub esp, 4
lea ecx, [ebp - 0xac]
mov dword [esp], esi
call fcn.0043eef0
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xbc]
sub esp, 4
cmp eax, edx
je 0x441eb6
mov esi, dword [ebp - 0xbc]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov dword [ebp - 0xac], fcn.0043edb0
lea ecx, [ebp - 0xac]
call fcn.00441db0
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x88]
mov dword [ebp - 0xac], vtable.ipeImplE.0
cmp eax, edx
je 0x441efb
mov edx, dword [ebp - 0x88]
mov dword [esp], eax
lea edx, [edx + edx + 2]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa0]
cmp eax, edx
je 0x441f20
mov esi, dword [ebp - 0xa0]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov ecx, ebx
call fcn.004401f0
lea ecx, [ebp - 0x78]
call fcn.004444f0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x443520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebx], eax
mov dword [ebp - 0x40], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov byte [ebx + 8], 0
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 8
mov esi, eax
test eax, eax
je 0x5242a0
cmp eax, 0x3ffffffe
ja 0x524357
add eax, eax
mov dword [esp], eax
call fcn.00513b80
mov dword [esp + 4], eax
mov edi, eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], esi
call eax
sub esp, 8
test eax, eax
je 0x4435f6
cmp esi, eax
jb 0x524298
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0043e1b0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4435c8
mov dword [esp], edi
call fcn.00513b50
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3fffffff
je 0x4435ea
mov dword [esp + 4], 1
mov ecx, ebx
mov dword [esp], 0x53cc97
call fcn.004f4db0
sub esp, 8
jmp 0x4435af
mov dword [esp], 0x53cc82
call fcn.00528c60
jmp 0x524298
mov dword [esp], edi
call fcn.00513b50
mov dword [esp], 0x24
lea esi, [ebp - 0x30]
call fcn.00513c50
mov dword [esp], str.Cannot_get_current_directory
mov ecx, esi
mov edi, eax
call fcn.00443480
push edx
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00412360
mov edx, dword [ebp - 0x30]
push eax
push eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x5242f0
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], edi
call fcn.005142c0
mov esi, eax
mov edx, dword [ebx]
cmp dword [ebp - 0x40], edx
je 0x524323
mov eax, dword [ebx + 8]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp], esi
call fcn.00461820
mov edx, dword [ebp - 0x30]
mov esi, eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x524349
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp], edi
call fcn.00513f00
jmp 0x52430a
call fcn.00527a00
mov dword [esp], edi
call fcn.00513b50
jmp 0x52430a
Function at 0x443610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 8]
mov dword [esp], 0xfffe
call fcn.00513b80
mov dword [esp + 4], 0x7fff
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
sub esp, 8
test eax, eax
je 0x5243d4
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
sub esp, 0xc
test eax, eax
je 0x524366
lea eax, [ebp - 0x30]
mov dword [esp], ebx
lea edi, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
call fcn.0043e1b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp byte [eax + edx - 1], 0x5c
je 0x4436be
cmp edx, 0x3fffffff
je 0x443702
mov dword [esp + 4], 1
mov ecx, dword [ebp - 0x3c]
mov dword [esp], 0x53cc97
call fcn.004f4db0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub esp, 8
lea ecx, [esi + 8]
mov dword [esi], ecx
cmp eax, edi
je 0x4436e8
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
mov dword [esp], ebx
call fcn.00513b50
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x14], eax
jmp 0x4436cf
mov dword [esp], 0x53cc82
call fcn.00528c60
mov esi, eax
jmp 0x524482
mov dword [esp], 0x24
call fcn.00513c50
mov dword [esp], str.Cannot_get_system_directory_long_path_name
mov edi, eax
lea eax, [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.00443480
push esi
mov eax, dword [ebp - 0x3c]
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push ecx
push ecx
cmp edx, eax
je 0x5243bc
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], edi
call fcn.005142c0
mov dword [esp], 0x24
call fcn.00513c50
mov dword [esp], str.Cannot_get_temporary_directory_path
mov edi, eax
lea eax, [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.00443480
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x30]
push eax
push eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x52442a
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], edi
call fcn.005142c0
mov esi, eax
jmp 0x52445a
mov dword [esp], edi
call fcn.00513f00
mov dword [esp], ebx
call fcn.00513b50
mov dword [esp], esi
call fcn.00461820
mov esi, eax
jmp 0x524452
mov edx, dword [ebp - 0x30]
cmp edx, edi
je 0x52445a
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
jmp 0x52445a
Function at 0x443f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 8]
mov dword [esp], 0xfffe
call fcn.00513b80
mov dword [esp], 0x7fff
mov dword [esp + 4], eax
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
test eax, eax
je 0x5246ca
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
sub esp, 0xc
test eax, eax
je 0x52465c
lea eax, [ebp - 0x30]
mov dword [esp], ebx
lea edi, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
call fcn.0043e1b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp byte [eax + edx - 1], 0x5c
je 0x44401e
cmp edx, 0x3fffffff
je 0x444062
mov dword [esp + 4], 1
mov ecx, dword [ebp - 0x3c]
mov dword [esp], 0x53cc97
call fcn.004f4db0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub esp, 8
lea ecx, [esi + 8]
mov dword [esi], ecx
cmp eax, edi
je 0x444048
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
mov dword [esp], ebx
call fcn.00513b50
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x14], eax
jmp 0x44402f
mov dword [esp], 0x53cc82
call fcn.00528c60
mov esi, eax
jmp 0x524778
mov dword [esp], 0x24
call fcn.00513c50
mov dword [esp], str.Cannot_get_temporary_directory_long_path_name
mov edi, eax
lea eax, [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.00443480
push esi
mov eax, dword [ebp - 0x3c]
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push ecx
push ecx
cmp edx, eax
je 0x5246b2
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], edi
call fcn.005142c0
mov dword [esp], 0x24
call fcn.00513c50
mov dword [esp], str.Cannot_get_temporary_directory_path
mov edi, eax
lea eax, [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.00443480
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x30]
push eax
push eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x524720
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], edi
call fcn.005142c0
mov esi, eax
jmp 0x524750
mov dword [esp], edi
call fcn.00513f00
mov dword [esp], ebx
call fcn.00513b50
mov dword [esp], esi
call fcn.00461820
mov esi, eax
jmp 0x524748
mov edx, dword [ebp - 0x30]
cmp edx, edi
je 0x524750
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
jmp 0x524750
Function at 0x44b8a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
call fcn.0043a0b0
lea eax, [ebp - 0x3c]
mov dword [ebx], 0x54c980
mov dword [esp + 8], eax
lea eax, [ebx + 0xc]
mov dword [esp + 4], eax
lea eax, [ebx + 8]
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [esp + 0xc], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x10
test eax, eax
je 0x525840
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x24
lea esi, [ebp - 0x30]
call fcn.00513c50
mov dword [esp], 0x53cf06
mov ecx, esi
mov edi, eax
call fcn.005257bc
push edx
mov ecx, edi
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00416c20
mov edx, dword [ebp - 0x30]
push eax
push eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x525890
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c7d0
mov dword [esp + 4], 0x546994
mov dword [esp], edi
call fcn.005142c0
mov esi, eax
mov ecx, ebx
call fcn.0043a070
mov dword [esp], esi
call fcn.00461820
mov edx, dword [ebp - 0x30]
mov esi, eax
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x5258d7
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp], edi
call fcn.00513f00
jmp 0x5258aa
Function at 0x44d100
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea eax, [ecx + 0x25c]
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xcc
mov esi, dword [ebp + 8]
mov dword [ecx], 0xffffffff
mov dword [ecx + 0x254], eax
mov dword [ecx + 0x258], 0
mov byte [ecx + 0x25c], 0
mov dword [ecx + 0x26c], 1
lea ecx, [ebp - 0x88]
mov dword [esp], esi
mov dword [ebp - 0xc0], eax
call fcn.00446bd0
sub esp, 4
lea ecx, [ebp - 0x88]
call fcn.00447a10
lea eax, [ebp - 0x88]
lea edi, [ebp - 0xb8]
mov dword [esp], eax
mov ecx, edi
call fcn.00445ba0
sub esp, 4
cmp dword [ebp - 0xb4], 0x3fffffff
je 0x44d2fa
mov dword [esp + 4], 1
mov ecx, edi
mov dword [esp], 0x53df3a
call fcn.004f4db0
sub esp, 8
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0x98]
mov dword [ebp - 0x9c], 0
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0xa0], edx
xor edx, edx
mov word [ebp - 0x98], dx
call fcn.00440340
mov eax, dword [ebp - 0xa0]
lea edi, [ebx + 4]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
sub esp, 8
cmp eax, 0xffffffff
je 0x44d2e5
lea eax, [ebx + 0x30]
lea esi, [ebx + 0x254]
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0xbc], eax
call fcn.0043e1b0
lea esi, [esi]
mov dword [esp], 0x53df20
mov ecx, esi
call fcn.004887f0
sub esp, 4
test eax, eax
jne 0x44d270
mov dword [ebx + 0x258], 0
mov eax, dword [ebx + 0x254]
mov byte [eax], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x44d218
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0043e1b0
jmp 0x44d218
mov dword [esp], 0x53df22
mov ecx, esi
call fcn.004887f0
sub esp, 4
test eax, eax
je 0x44d22d
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x98]
cmp eax, edx
je 0x44d2ab
mov edx, dword [ebp - 0x98]
mov dword [esp], eax
lea edx, [edx + edx + 2]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb0]
cmp eax, edx
je 0x44d2d0
mov edx, dword [ebp - 0xb0]
mov dword [esp], eax
add edx, 1
mov dword [esp + 4], edx
call fcn.00513b70
lea ecx, [ebp - 0x88]
call fcn.004444f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x44d285
mov dword [esp], esi
call fcn.004420e0
jmp 0x44d285
mov dword [esp], 0x53df25
call fcn.00528c60
mov esi, eax
jmp 0x525a73
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb0]
cmp edx, eax
jne 0x525ab9
lea ecx, [ebp - 0x88]
call fcn.004444f0
mov edx, dword [ebx + 0x254]
cmp dword [ebp - 0xc0], edx
je 0x525ab1
mov eax, dword [ebx + 0x25c]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp], esi
call fcn.00461820
mov eax, dword [ebp - 0xb0]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
jmp 0x525a83