joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489fc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ax, word [esp + 4]
pop edi
add esp, 0x208
ret

Function at 0x48a000
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a0d3
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.0044d930
add esp, 8
test eax, eax
je 0x48a04c
mov byte [eax], 0
mov ebx, dword [esp + 0x114]
test ebx, ebx
je 0x48a0cc
mov esi, dword [esp + 0x118]
test esi, esi
je 0x48a0cc
lea edx, [esp + 0xc]
test edx, edx
je 0x48a0cc
mov eax, dword [esp + 0x11c]
mov edx, 0x7a
test eax, eax
je 0x48a095
push eax
lea eax, [esp + 0x10]
push eax
push 0x646284
push esi
push ebx
call fcn.0044dbc8
add esp, 0x14
xor edx, edx
mov esi, edx
jmp 0x48a0db
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x48a0c8
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x48a0db
mov esi, 0x57
jmp 0x48a0db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x68b8e0], esi
je 0x48a0ec
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x104
ret
Function at 0x48a2f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f67f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x667cb8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov dword [esp + 0x22c], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a419
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.0044d930
add esp, 8
cmp eax, ebx
je 0x48a383
mov byte [eax], bl
lea eax, [esp + 0x118]
test eax, eax
je 0x48a412
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x48a412
mov eax, dword [esp + 0x230]
mov edx, 0x7a
cmp eax, ebx
je 0x48a3d0
lea edx, [esp + 0x14]
push eax
push edx
push 0x646284
lea eax, [esp + 0x124]
push 0x104
push eax
call fcn.0044dbc8
add esp, 0x14
xor edx, edx
mov eax, edx
jmp 0x48a41f
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x48a40e
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x48a41f
mov eax, 0x57
jmp 0x48a41f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x68b8e0], eax
je 0x48a431
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48a442
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call fcn.005e1070
mov esi, dword [esp + 0x22c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005e0c5c
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], bl
call fcn.005e0ee7
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x48a540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a5fd
mov ebx, dword [esp + 0x114]
test ebx, ebx
je 0x48a5f6
mov esi, dword [esp + 0x118]
test esi, esi
je 0x48a5f6
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x48a5f6
mov eax, dword [esp + 0x11c]
mov edx, 0x7a
test eax, eax
je 0x48a5bf
lea edx, [esp + 0xc]
push eax
push edx
push 0x646284
push esi
push ebx
call fcn.0044dbc8
add esp, 0x14
xor edx, edx
mov esi, edx
jmp 0x48a605
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x48a5f2
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x48a605
mov esi, 0x57
jmp 0x48a605
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x68b8e0], esi
je 0x48a616
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x104
ret
Function at 0x48edd0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x30c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x66cc48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x48ef1f
cmp eax, 0x104
jae 0x48ef1f
push ebp
lea ecx, [esp + 8]
push esi
push ecx
call fcn.00489250
add esp, 4
test eax, eax
je 0x48ee92
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x110]
push 0x208
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00488e40
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 0x208
jge 0x48ee92
lea ecx, [esp + 0x110]
push esi
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0044d830
add esp, 0xc
mov byte [esp + esi + 0xc], 0
mov ebp, dword [esp + 0x31c]
test ebp, ebp
je 0x48ef10
mov edx, dword [esp + 0x320]
test edx, edx
je 0x48ef10
lea eax, [esp + 0xc]
test eax, eax
je 0x48ef10
mov eax, dword [esp + 0x324]
test eax, eax
je 0x48eedf
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x646284
push edx
push ebp
call fcn.0044dbc8
add esp, 0x14
mov eax, 1
pop esi
pop ebp
pop edi
add esp, 0x30c
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jbe 0x48ef10
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x30c
ret
xor eax, eax
pop edi
add esp, 0x30c
ret

Function at 0x490400
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x490421
push 0x57
mov dword [0x68b8e0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
test eax, eax
jne 0x490452
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x490452
test al, 0x10
jne 0x490452
test al, 1
je 0x49041c
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x4904c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x4904e1
push 0x57
mov dword [0x68b8e0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x490512
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x490512
test al, 0x10
jne 0x490512
test al, 1
je 0x4904dc
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x490af0
Capabilities:
Move file

Disassembly:
sub esp, 0x824
push ebx
push ebp
push esi
mov esi, dword [esp + 0x834]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x490cb4
mov edx, dword [esp + 0x83c]
mov ebp, dword [esp + 0x840]
cmp edx, ebx
jne 0x490b25
cmp ebp, ebx
je 0x490cb4
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bx
rep stosd dword es:[edi], eax
push edx
push esi
stosw word es:[edi], ax
push 0x64655c
lea eax, [esp + 0x430]
push 0x207
push eax
call fcn.0044cfbc
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x438]
add esp, 0x14
test ecx, ecx
jne 0x490b95
push 0x57
mov dword [0x68b8e0], 0x57
call edi
push 2
mov dword [0x68b8e0], 2
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
lea eax, [esp + 0x438]
push edx
push eax
mov dword [esp + 0x2c], ebx
call fcn.0049e620
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x490bc0
test al, 0x10
je 0x490bdb
push 2
mov dword [0x68b8e0], 2
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
push ebp
push esi
push 0x64655c
lea ecx, [esp + 0x20]
push 0x207
push ecx
stosw word es:[edi], ax
call fcn.0044cfbc
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [esp + 0x28]
add esp, 0x14
test edx, edx
jne 0x490c5a
push 0x57
mov dword [0x68b8e0], 0x57
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x424]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x490ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x68b8e0], eax
je 0x490cc6
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push ebx
lea ecx, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x2c], ebx
call fcn.0049e620
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x490c24
test al, 0x10
jne 0x490c24
push 0xb7
mov dword [0x68b8e0], 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x824
ret
push 0x57
mov dword [0x68b8e0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
Function at 0x492180
Capabilities:
Enumerate files on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x348
test edx, edx
jne 0x4921a9
push 0x57
mov dword [0x68b8e0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x348
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], 0
push 0x66ccbc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push 0x646284
lea eax, [esp + 0x158]
push 0x207
push eax
mov dword [0x68b8e0], 0
xor ebp, ebp
call fcn.0044dbc8
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebp
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x492278
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebp, 1
cmp byte [esp + 0x38], 0x2e
jne 0x492263
mov al, byte [esp + 0x39]
test al, al
je 0x492244
cmp al, 0x2e
jne 0x492263
mov al, byte [esp + 0x3a]
test al, al
jne 0x492263
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
jne 0x492229
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
push esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x68b8e0], eax
je 0x49228e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
Function at 0x4925d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x4925ec
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044d830
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.0044d970
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x492670
cmp byte [esp + 0x10], 0x5c
jne 0x492670
cmp byte [esp + 0x11], 0x5c
jne 0x492670
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.0044d970
add esp, 8
test eax, eax
je 0x4926ee
inc eax
push 0x5c
push eax
call fcn.0044d970
add esp, 8
mov esi, eax
test esi, esi
je 0x4926ee
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x4926b2
test bl, 1
je 0x4926a1
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x492724
cmp ebx, 0xffffffff
je 0x4926bb
test edi, edi
jne 0x4926ca
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x492724
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.0044d970
mov esi, eax
add esp, 8
test esi, esi
jne 0x492674
test ebp, ebp
je 0x492724
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x492719
test al, 0x10
jne 0x492724
test al, 1
je 0x49270c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x492724
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x492740
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x49275c
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044cef3
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0044dab0
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.0044cf30
add esp, 0x18
cmp eax, 2
jbe 0x4927e1
cmp word [esp + 0x10], di
jne 0x4927e1
cmp word [esp + 0x12], di
jne 0x4927e1
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0044dab0
add esp, 8
test eax, eax
je 0x492869
add eax, 2
push edi
push eax
call fcn.0044dab0
add esp, 8
mov esi, eax
test esi, esi
je 0x492869
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x492829
test bl, 1
je 0x492818
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x49289f
cmp ebx, 0xffffffff
je 0x492832
test edi, edi
jne 0x492841
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x49289f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.0044dab0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4927e9
test ebp, ebp
je 0x49289f
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x492894
test al, 0x10
jne 0x49289f
test al, 1
je 0x492887
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x49289f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x4928b0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4928e4
push 0x57
mov dword [0x68b8e0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49290b
test al, 0x10
jne 0x492a73
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x492a73
mov ecx, 0x81
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044d830
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.0044d970
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x49299a
cmp byte [esp + 0x10], 0x5c
jne 0x49299a
cmp byte [esp + 0x11], 0x5c
jne 0x49299a
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.0044d970
add esp, 8
test eax, eax
je 0x492a18
inc eax
push 0x5c
push eax
call fcn.0044d970
add esp, 8
mov esi, eax
test esi, esi
je 0x492a18
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x4929dc
test bl, 1
je 0x4929cb
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x492a50
cmp ebx, 0xffffffff
je 0x4929e5
test edi, edi
jne 0x4929f4
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x492a50
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.0044d970
mov esi, eax
add esp, 8
test esi, esi
jne 0x49299e
test ebp, ebp
je 0x492a50
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x492a41
test al, 0x10
jne 0x492a4c
test al, 1
je 0x492a36
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x492a50
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
jne 0x492a73
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x68b8e0], eax
je 0x492a66
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
mov eax, dword [esp + 0x220]
test eax, eax
je 0x492a86
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x492f90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x154
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
mov ebp, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x16c]
mov eax, 0x1f3
push esi
sub eax, ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x492fd9
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x154
ret
push edi
mov dword [esp + 0x10], 1
mov eax, dword [esi]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x493141
mov al, byte [esi + 0x2c]
lea edx, [esi + 0x2c]
cmp al, 0x2e
jne 0x493014
mov al, byte [esi + 0x2d]
test al, al
je 0x493169
cmp al, 0x2e
jne 0x493014
mov al, byte [esi + 0x2e]
test al, al
je 0x493169
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
inc ecx
cmp eax, ecx
jb 0x493169
add ebp, ebx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x174]
and ecx, 3
test dl, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x49308c
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push ebx
call dword [esp + 0x188]
mov edx, dword [esp + 0x174]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4930f8
test dl, 0x40
jne 0x4930f8
mov esi, dword [esp + 0x1c]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
mov byte [esi + ebp - 1], 0x5c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x170]
push ecx
push edx
lea edx, [esp + 0x30]
lea ecx, [esi + eax + 1]
push edx
push ecx
mov byte [esi + ebp], 0x2a
push ebx
mov byte [esi + ebp + 1], 0
call fcn.00492f90
mov edx, dword [esp + 0x18c]
add esp, 0x18
mov dword [esp + 0x10], eax
jmp 0x4930fc
mov esi, dword [esp + 0x1c]
test dl, 0x20
je 0x493129
mov eax, dword [esp + 0x10]
test eax, eax
je 0x493129
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push ebx
mov byte [esi + ebp - 1], 0
call dword [esp + 0x188]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x170]
mov byte [ebp - 1], 0x2a
mov byte [ebp], 0
mov ebp, dword [esp + 0x16c]
jmp 0x493169
mov ecx, dword [esp + 0x17c]
lea edx, [esi + 0x2c]
push ecx
push eax
push edx
push ebx
mov byte [ebx + ebp - 2], 0
call dword [esp + 0x188]
mov byte [ebx + ebp - 2], 0x5c
mov dword [esp + 0x10], eax
mov byte [ebx + ebp - 1], 0x2a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x493185
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x492fe2
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x154
ret