joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572e00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x5ff98c
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebp, ecx
cmp dword [ebp + 0xc], 1
jne 0x572e4d
mov eax, 0x80004005
jmp 0x573003
mov eax, dword [ebp + 0x260]
cmp eax, 0xffffffff
jne 0x572f92
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x280], 0
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push edx
call fcn.00572bd0
lea eax, [esp + 0x18]
push eax
mov ecx, 0x625868
mov byte [esp + 0x284], 1
call fcn.00409dd0
lea ecx, [esp + 0x20]
push ecx
mov bl, 2
lea esi, [esp + 0x1c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x284], bl
call fcn.00575f20
add esp, 4
lea edi, [esp + 0x1c]
mov byte [esp + 0x280], 3
call fcn.0040ab90
mov byte [esp + 0x280], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x572efb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x280], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x572f23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
cmp eax, 0xffffffff
mov dword [ebp + 0x260], eax
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x14]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x572f69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x572fa0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x572fa0
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
xor edx, edx
test ebx, ebx
sete dl
cmp ebx, 1
mov dword [ebp + 0xc], edx
jne 0x572ff3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x62773c
lea eax, [esp + 0x54]
push eax
call esi
test eax, eax
je 0x572fe5
push 0x628c54
lea ecx, [esp + 0x54]
push ecx
call esi
test eax, eax
je 0x572fe5
lea edi, [ebp + 0x10]
mov ecx, 0x94
lea esi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
jmp 0x572ff3
mov ecx, ebp
call fcn.00572e00
xor ebx, ebx
test eax, eax
setge bl
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005d28b3
add esp, 0x270
ret
Function at 0x573540
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xa0
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa4]
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xb0]
push ecx
push eax
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00576de0
push esi
mov esi, edi
call fcn.00576ea0
mov ecx, dword [esp + 0xb0]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0xa0
ret

Function at 0x5741f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x574208
test al, 0x10
jne 0x574208
mov eax, 1
ret
xor eax, eax
ret
Function at 0x575d40
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x600148
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
call fcn.00409dd0
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
cmp edx, 3
jg 0x575dc0
or ebp, 0xffffffff
mov dword [esp + 0x24], ebp
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x575da7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea eax, [edx - 1]
cmp eax, ebx
jl 0x575f15
cmp eax, edx
jg 0x575f15
movzx edx, word [ecx + eax*2]
or ebp, 0xffffffff
cmp dx, 0x5c
jne 0x575e22
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.0041a270
lea edi, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0040ab90
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x575e1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
je 0x575e35
test al, 0x10
jne 0x575f05
mov ecx, dword [esp + 0x14]
push 0x5c
push ecx
call fcn.005d37a2
mov ecx, dword [esp + 0x1c]
add esp, 8
cmp eax, ebx
je 0x575e54
sub eax, ecx
sar eax, 1
cmp eax, ebp
jne 0x575e87
lea eax, [ecx - 0x10]
mov dword [esp + 0x24], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x575e71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.0041a270
mov byte [esp + 0x24], 2
mov esi, dword [esp + 0x18]
push esi
call fcn.00575d40
mov ecx, dword [esp + 0x18]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov byte [esp + 0x24], bl
lea eax, [esi - 0x10]
jne 0x575eed
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x575ed5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
jmp 0x575e63
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x575f05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
jmp 0x575d91
push 0x80070057
call fcn.00403650
int3
Function at 0x576f90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, 1
test byte [0x680a00], bl
mov dword [esp + 4], 0
jne 0x576fe4
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
or dword [0x680a00], ebx
mov ecx, 0x677600
call edx
add eax, 0x10
push 0x613f40
mov dword [0x6809fc], eax
call fcn.005d268a
add esp, 4
mov eax, dword [0x6809fc]
cmp dword [eax - 0xc], 0
jne 0x577041
push 0x20a
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.005da970
add esp, 0xc
push ebx
push 0x25
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x577021
sub eax, edx
sar eax, 1
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x6809fc
call fcn.004037a0
mov eax, dword [0x6809fc]
add eax, 0xfffffff0
call fcn.0040a210
mov ecx, dword [esp + 0x214]
add eax, 0x10
pop ebx
mov dword [esi], eax
xor ecx, esp
mov eax, esi
call fcn.005d28b3
add esp, 0x214
ret

Function at 0x577070
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, 1
test byte [0x6809f8], bl
mov dword [esp + 4], 0
jne 0x5770c4
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
or dword [0x6809f8], ebx
mov ecx, 0x677600
call edx
add eax, 0x10
push 0x613f70
mov dword [0x6809f4], eax
call fcn.005d268a
add esp, 4
mov eax, dword [0x6809f4]
cmp dword [eax - 0xc], 0
jne 0x577121
push 0x20a
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.005da970
add esp, 0xc
push ebx
push 0x24
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x577101
sub eax, edx
sar eax, 1
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x6809f4
call fcn.004037a0
mov eax, dword [0x6809f4]
add eax, 0xfffffff0
call fcn.0040a210
mov ecx, dword [esp + 0x214]
add eax, 0x10
pop ebx
mov dword [esi], eax
xor ecx, esp
mov eax, esi
call fcn.005d28b3
add esp, 0x214
ret
Function at 0x578c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ff676
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
lea esi, [edi + 8]
call fcn.00577600
xor ebp, ebp
lea esi, [edi + 0x30]
mov dword [esp + 0x1c], ebp
call fcn.00577600
lea esi, [edi + 0x58]
mov byte [esp + 0x1c], 1
call fcn.00577600
lea esi, [edi + 0x80]
mov byte [esp + 0x1c], 2
call fcn.00577600
lea esi, [edi + 0xa8]
mov byte [esp + 0x1c], 3
call fcn.00577600
lea ebx, [edi + 0xd8]
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebp
lea ebp, [edi + 0xe8]
xor eax, eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
fldz
fst qword [edi + 0xf8]
fst qword [edi + 0x100]
fstp qword [edi + 0x108]
mov byte [esp + 0x1c], 7
lea esi, [edi + 8]
mov dword [edi], eax
mov dword [edi + 4], 0xff00ff
call fcn.00577710
lea esi, [edi + 0x30]
call fcn.00577710
lea esi, [edi + 0x58]
call fcn.00577710
lea esi, [edi + 0x80]
call fcn.00577710
lea esi, [edi + 0x58]
call fcn.00577710
mov eax, 0xff00ff
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd4], eax
mov eax, ebx
call fcn.004449b0
mov eax, ebp
call fcn.004449b0
fldz
fst qword [edi + 0xf8]
mov eax, edi
fst qword [edi + 0x100]
fstp qword [edi + 0x108]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x57a980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ff5e6
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [edi], vtable.CSkinEngine2.0
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
push 0x40c
mov dword [edi + 0x58], eax
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
call fcn.005d2776
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x57aa10
push eax
call fcn.0058bbb0
jmp 0x57aa12
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
push 0x108
mov dword [edi + 0x4c], eax
call fcn.005d2776
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x14], 1
je 0x57aa44
push eax
call fcn.0058b020
mov esi, eax
jmp 0x57aa46
xor esi, esi
cmp esi, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [edi + 0x54], esi
je 0x57aa61
call fcn.0058b240
push 9
call fcn.0058b310
push 0xec
call fcn.005d2776
add esp, 4
cmp eax, ebx
je 0x57aa7b
mov esi, eax
call fcn.0058dbf0
jmp 0x57aa7d
xor eax, eax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x50], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x5852c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fb916
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x264], eax
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x10]
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x18], 1
mov dword [esp + 0x280], edi
cmp dword [esi + 8], edi
je 0x5853bc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5853bc
mov eax, dword [esi + 4]
mov eax, dword [eax - 0xc]
test eax, eax
lea edi, [esi + 4]
jne 0x58539a
mov edx, ebx
call fcn.00403760
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.0059e4e0
add esp, 8
mov byte [esp + 0x280], 1
call fcn.0040ab90
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x585390
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, 0x63d744
call fcn.0040ae60
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x5853ee
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0xc], 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.005d28b3
mov esp, ebp
pop ebp
ret
mov esi, edi
call fcn.004036c0
jmp 0x5853bc
Function at 0x59c240
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5f9cd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00409dd0
mov esi, dword [esp + 0x20]
add esi, 0xc
mov edi, esi
mov dword [esp + 0x18], 0
call fcn.0040ab90
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x59c2ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x59c2c1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test edi, edi
jne 0x59c2c6
call fcn.004036c0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x5a49f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f7b98
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x5a4a2f
push eax
call fcn.005d28c2
add esp, 4
mov dword [esi + 0x38], edi
mov ecx, dword [esi + 0x3c]
cmp ecx, edi
je 0x5a4a41
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x3c], edi
mov eax, dword [esi]
cmp eax, edi
je 0x5a4a52
push eax
call fcn.005d28c2
add esp, 4
mov dword [esi], edi
mov dword [esi + 0x30], edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x5a5f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7b66
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.CGroundCanvasCache.0
xor edi, edi
mov ebx, 2
mov ebp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x1c], 1
mov ecx, dword [esi + 4]
cmp ecx, edi
je 0x5a5f89
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov ecx, dword [esi + 0x1c]
cmp ecx, edi
je 0x5a5faa
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x5c6600
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
mov ebx, dword [esi + 0x669b80]
lea eax, [esp + 0x10]
push ebp
push eax
call fcn.0040aab0
mov eax, dword [eax]
add esp, 8
push eax
call edi
test eax, eax
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c664f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x5c6663
add esi, 4
cmp esi, 0x18
jb 0x5c6611
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x5c6670
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5fb440
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x40], ebp
mov esi, dword [esp + 0x48]
or ebx, 0xffffffff
cmp dword [esi - 0xc], ebp
je 0x5c67b3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c67b3
mov ecx, dword [esi - 0xc]
cmp ecx, ebp
jle 0x5c66ef
lea eax, [ecx - 1]
cmp eax, ebp
jl 0x5c67f6
cmp eax, ecx
jg 0x5c67f6
movzx eax, word [esi + eax*2]
cmp ax, 0x5c
je 0x5c66ef
push 0x5c
lea edi, [esp + 0x4c]
call fcn.0040af90
mov esi, dword [esp + 0x48]
mov esi, dword [esi - 0xc]
lea eax, [esi - 1]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x48]
call fcn.0041a270
lea edi, [esp + 0x48]
mov byte [esp + 0x40], 1
call fcn.0040ab90
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c6735
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x48]
mov word [esp + 0x28], 0x414
mov dword [esp + 0x2e], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x32], ebp
mov ebp, dword [esi - 0xc]
xor ecx, ecx
lea ebx, [ebp + 2]
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005d1ef5
mov edi, eax
lea eax, [ebx + ebx]
push eax
push 0
push edi
call fcn.005da970
lea ecx, [ebp + ebp]
push ecx
push esi
push edi
call fcn.005d8ed0
add esp, 0x1c
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edi
mov ebx, eax
call fcn.005d28c2
add esp, 4
xor ebp, ebp
xor eax, eax
cmp ebx, ebp
sete al
add esi, 0xfffffff0
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
mov edi, eax
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c67e0
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push 0x80070057
call fcn.00403650
int3
Function at 0x5c6a90
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5fed81
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 8]
cmp dword [esi + 4], ebx
mov edi, edx
jbe 0x5c6adc
call fcn.005d29f1
mov ebp, dword [esi + 4]
cmp ebp, dword [esi + 8]
jbe 0x5c6ae9
call fcn.005d29f1
push ebx
push esi
push ebp
push esi
lea eax, [esp + 0x28]
push eax
mov ebx, esi
call fcn.0043c950
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c6c4a
mov eax, dword [edi]
sub eax, 0x10
call fcn.0040a210
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov dword [esp + 0x280], 0
mov eax, dword [edi - 0xc]
test eax, eax
jle 0x5c6b59
lea ecx, [eax - 1]
test ecx, ecx
jl 0x5c6c55
cmp ecx, eax
jg 0x5c6c55
movzx eax, word [edi + ecx*2]
cmp ax, 0x5c
je 0x5c6b59
push 0x5c
lea edi, [esp + 0x1c]
call fcn.0040af90
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x625868
call fcn.0040aab0
add esp, 8
lea eax, [esp + 0x24]
mov byte [esp + 0x280], 1
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x5c6bfb
nop
test byte [esp + 0x24], 0x10
jne 0x5c6be4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ebx, [esp + 0x58]
call fcn.0040aab0
add esp, 8
mov ebx, eax
mov byte [esp + 0x280], 2
call fcn.00427a70
mov byte [esp + 0x280], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c6be4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5c6b90
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5c6c23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c6c4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x5c6c5f
xor esi, esi
jmp 0x5c6c67
push 0x80070057
call fcn.00403650
mov esi, dword [esi + 8]
sub esi, eax
sar esi, 2
xor ecx, ecx
cmp ecx, esi
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005d28b3
add esp, 0x270
ret