joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45d007
lea edi, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x45cfb0
mov edi, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x5a0f9c
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x45d013
mov eax, dword [ebp - 4]
mov dword [ecx], eax
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45d0b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x45d0ca
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.0045c980
test al, al
pop edi
setne al
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x45d3d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x60]
mov edx, dword [ebp + 0xc]
test eax, eax
push esi
push dword [ebp + 0x10]
mov esi, 0x5dea54
mov dword [ebp - 0x60], 0x67452301
cmovne esi, eax
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 8], 0
call fcn.0046d430
add esp, 4
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.0046d6f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45d450
Capabilities:
Get file size
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5301eb
mov eax, dword fs:[0]
push eax
sub esp, 0x3d4
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3dc], edx
mov ebx, ecx
mov dword [ebp - 0x3d4], ebx
mov esi, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x18], 0
call fcn.0045c820
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [ebp - 0x7c], vtable.t_fileRead.0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], 0
call fcn.0045c980
test al, al
je 0x45d611
lea eax, [ebp - 0x3d8]
mov dword [ebp - 0x3d8], 0
push eax
push dword [ebp - 0x3cc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45d539
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45d539
xor esi, esi
push 0x100000
mov dword [ebp - 0x78], esi
call fcn.004e1b5b
mov ecx, dword [ebp - 0x78]
add esp, 4
mov ebx, eax
sub ecx, dword [ebp - 0x74]
je 0x45d5a1
mov edi, 0x12a0
nop dword [eax + eax]
mov eax, 0x100000
mov esi, edi
cmp ecx, eax
cmovb eax, ecx
lea ecx, [ebp - 0x7c]
cmp eax, edi
cmovb esi, eax
push esi
push ebx
push dword [ebp - 0x3d4]
call fcn.00469aa0
test al, al
je 0x45d5ca
push esi
mov edx, ebx
lea ecx, [ebp - 0x70]
call fcn.0046d430
add esp, 4
cmp edi, esi
jbe 0x45d5a1
mov ecx, dword [ebp - 0x78]
sub edi, esi
sub ecx, dword [ebp - 0x74]
jne 0x45d560
push ebx
call fcn.004e1b56
add esp, 4
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x7c], vtable.t_byteStreamRead.0
call fcn.0045c8c0
mov bl, 1
jmp 0x45d63d
push ebx
call fcn.004e1b56
mov ecx, dword [ebp - 0x3d4]
add esp, 4
call fcn.00450c80
push str.Hash
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x7c], vtable.t_byteStreamRead.0
call fcn.0045c8c0
xor bl, bl
jmp 0x45d63d
push str.Hash
push ebx
call fcn.00450d30
add esp, 8
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x7c], vtable.t_byteStreamRead.0
mov bl, al
call fcn.0045c8c0
mov ecx, dword [ebp - 0x3dc]
lea edx, [ebp - 0x70]
call fcn.0046d6f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45d670
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [ebp + 8]
mov esi, edi
cmp ecx, 3
jl 0x45d70b
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
mov dword [ebp + 8], ecx
nop dword [eax]
movzx eax, byte [ebx]
shr eax, 2
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi], ax
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
movsx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + 2], ax
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
movsx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + 4], ax
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + 6], ax
add esi, 8
sub edx, 1
jne 0x45d6a0
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x45d773
movzx eax, byte [ebx]
shr eax, 2
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi], ax
mov dl, byte [ebx]
and dl, 3
shl dl, 4
cmp ecx, 1
jle 0x45d735
mov al, byte [ebx + 1]
shr al, 4
or dl, al
movzx eax, dl
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + 2], ax
cmp ecx, 2
jge 0x45d750
mov eax, 0x3d
jmp 0x45d763
movzx eax, byte [ebx + 1]
and eax, 0xf
movsx ax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
mov word [esi + 4], ax
mov eax, 0x3d
mov word [esi + 6], ax
add esi, 8
xor eax, eax
lea ecx, [edi + 2]
mov word [esi], ax
nop dword [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x45d780
sub edi, ecx
sar edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45d7a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [ebp + 8]
mov esi, edi
cmp ecx, 3
jl 0x45d837
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
mov dword [ebp + 8], ecx
nop dword [eax]
movzx eax, byte [ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edx, 1
jne 0x45d7d0
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x45d88b
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov dl, byte [ebx]
and dl, 3
shl dl, 4
cmp ecx, 1
jle 0x45d85e
mov al, byte [ebx + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
cmp ecx, 2
jge 0x45d873
mov al, 0x3d
jmp 0x45d881
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x45d891
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45dd40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5302b1
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x444], edi
xor eax, eax
cmp ax, word [0x5936e0]
je 0x45df66
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
mov dword [ebp - 4], eax
call fcn.0045db00
cmp eax, 2
jne 0x45df2e
push 0x3e
xor eax, eax
mov dword [ebp - 0x418], 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x414], 7
mov word [ebp - 0x428], ax
call fcn.00413520
push 4
push 0x5936e0
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.0042c750
push 0xb
push str.UserChoice
lea ecx, [ebp - 0x428]
call fcn.0042c750
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x428]
cmp dword [ebp - 0x414], 8
lea ecx, [ebp - 0x454]
push 1
cmovae eax, dword [ebp - 0x428]
push eax
push reloc.WS2_32.dll_accept
call fcn.00419440
mov esi, dword [ebp - 0x454]
test eax, eax
jne 0x45df14
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
mov dword [ebp - 0x448], 0x400
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x444]
push eax
push 0
push str.Progid
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45df14
mov eax, dword [ebp - 0x444]
cmp eax, 1
je 0x45deb2
cmp eax, 2
jne 0x45df14
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x45df0b
test al, 1
jne 0x45df14
shr eax, 1
cmp word [ebp + eax*2 - 0x412], 0
jne 0x45df14
xor eax, eax
cmp ax, word [ebp - 0x410]
je 0x45df14
lea edx, [ebp - 0x410]
lea ecx, [ebp - 0x440]
call fcn.0045dfa0
mov bl, al
test esi, esi
je 0x45def6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0
call fcn.004134c0
test bl, bl
jne 0x45df3e
jmp 0x45df2e
xor eax, eax
mov word [ebp - 0x410], ax
test esi, esi
je 0x45df1f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0
call fcn.004134c0
mov edx, 0x5936e0
lea ecx, [ebp - 0x440]
call fcn.0045dfa0
sub esp, 0x18
lea eax, [ebp - 0x440]
mov ecx, esp
push eax
call fcn.0044bf60
mov ecx, edi
call fcn.0045dbb0
add esp, 0x18
lea ecx, [ebp - 0x440]
call fcn.004134c0
jmp 0x45df75
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45e0f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53033e
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x42c]
push 1
cmovae eax, dword [ebp + 8]
push eax
push edx
call fcn.00419440
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x42c]
test eax, eax
jne 0x45e356
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004d9fe0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
add esp, 0xc
mov dword [ebp - 0x414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push edi
call ebx
test eax, eax
jne 0x45e246
mov eax, dword [ebp - 0x41c]
cmp eax, 1
je 0x45e1d7
cmp eax, 2
jne 0x45e246
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x45e23d
test al, 1
jne 0x45e246
shr eax, 1
cmp word [ebp + eax*2 - 0x412], 0
jne 0x45e246
xor eax, eax
cmp ax, word [ebp - 0x410]
je 0x45e246
push 1
push 0x597154
lea ecx, [ebp + 8]
call fcn.0042c750
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45e215
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.0042c750
push 8
push 0x5a1118
jmp 0x45e24d
xor eax, eax
mov word [ebp - 0x410], ax
push 0xd
push str.opencommand
lea ecx, [ebp + 8]
call fcn.0042c750
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x438]
push 1
cmovae eax, dword [ebp + 8]
push eax
push dword [ebp - 0x418]
call fcn.00419440
test eax, eax
jne 0x45e349
push 0x400
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004d9fe0
mov edi, dword [ebp - 0x438]
lea eax, [ebp - 0x414]
add esp, 0xc
mov dword [ebp - 0x414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0
push edi
call ebx
test eax, eax
jne 0x45e305
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x45e2f3
cmp eax, 2
jne 0x45e305
cmp dword [ebp - 0x414], 0
jne 0x45e305
xor eax, eax
mov word [ebp - 0x410], ax
lea edx, [ebp - 0x410]
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45e310
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x410]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00413520
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x45e33f
push edi
call esi
mov edi, dword [ebp - 0x42c]
mov bl, 1
jmp 0x45e358
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x45e356
push eax
call esi
xor bl, bl
test edi, edi
je 0x45e35f
push edi
call esi
lea ecx, [ebp + 8]
call fcn.004134c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45e3e0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53037b
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
push 0
push 0
push 0
push edi
lea ecx, [ebp - 0x934]
call fcn.00451610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x45e463
shr eax, 4
not al
and al, 1
jne 0x45e587
lea ecx, [ebp - 0x934]
call fcn.00451e40
test al, al
jne 0x45e479
xor esi, esi
jmp 0x45e590
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.00436730
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x5e0168
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45e587
nop dword [eax + eax]
mov edx, 0x596174
mov ecx, 0x5e0194
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x45e4e6
test ax, ax
je 0x45e4e2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x45e4e6
add ecx, 4
add edx, 4
test ax, ax
jne 0x45e4c0
xor eax, eax
jmp 0x45e4eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x45e56c
mov eax, 0x596178
mov ecx, 0x5e0194
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x45e526
test dx, dx
je 0x45e522
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x45e526
add ecx, 4
add eax, 4
test dx, dx
jne 0x45e500
xor eax, eax
jmp 0x45e52b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45e56c
push 0x5e0194
push edi
lea eax, [ebp - 0x810]
push 0x595020
push eax
call fcn.00436730
add esp, 0x10
test byte [0x5e0168], 0x10
je 0x45e55f
lea ecx, [ebp - 0x810]
call fcn.0045e3e0
jmp 0x45e56c
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call ebx
push 0x5e0168
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45e4b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
push edi
call ebx
mov esi, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45e5bc
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x45e5bc
push eax
call fcn.004e1b56
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45e6a0
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5303d1
mov eax, dword fs:[0]
push eax
sub esp, 0xa58
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0045e5e0
test al, al
jne 0x45e6e0
xor eax, eax
jmp 0x45e8e4
xor esi, esi
lea ecx, [ebp - 0x934]
push esi
push esi
push esi
push esi
push esi
push edi
call fcn.00451610
mov dword [ebp - 4], esi
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e7a0
shr eax, 4
not al
and al, 1
je 0x45e7a0
push esi
push esi
push esi
push esi
push esi
push edi
lea ecx, [ebp - 0xa58]
call fcn.00451610
mov byte [ebp - 0xa60], 0
mov dword [ebp - 0xa64], esi
push esi
push esi
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa58]
call fcn.00452370
lea ecx, [ebp - 0xa64]
call fcn.00450c20
cmp byte [ebp - 0x93c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45e8b6
mov eax, dword [ebp - 0xa50]
lea ecx, [ebp - 0xa4c]
cmp eax, ecx
je 0x45e8b6
push eax
call fcn.004e1b56
add esp, 4
jmp 0x45e8b6
lea ecx, [ebp - 0x934]
call fcn.00451e40
test al, al
jne 0x45e7b6
xor esi, esi
jmp 0x45e8b6
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.00436730
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x5dfde8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45e8ad
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov edx, 0x596174
mov ecx, 0x5dfe14
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x45e826
test ax, ax
je 0x45e822
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x45e826
add ecx, 4
add edx, 4
test ax, ax
jne 0x45e800
xor eax, eax
jmp 0x45e82b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45e896
mov ecx, 0x596178
mov eax, 0x5dfe14
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45e866
test dx, dx
je 0x45e862
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45e866
add eax, 4
add ecx, 4
test dx, dx
jne 0x45e840
xor eax, eax
jmp 0x45e86b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45e896
push 0x5dfe14
push edi
lea eax, [ebp - 0x810]
push 0x595020
push eax
call fcn.00436730
add esp, 0x10
lea ecx, [ebp - 0x810]
mov dl, 1
call fcn.0045e6a0
push 0x5dfde8
push esi
call ebx
test eax, eax
jne 0x45e7f0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45e8e2
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x45e8e2
push eax
call fcn.004e1b56
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x45e910
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x45e950
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004e1b5b
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45e9d1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x597154
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45e9d1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x45e9cf
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x45e9de
push esi
call fcn.004e1b56
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x45ea47
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
push 0x59d188
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004e7085
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.0045e910
add esp, 0x10
test al, al
je 0x45ea35
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x45eae2
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret