joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b5f1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
mov esi, dword [edi]
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x41b696
cmp eax, dword [edi + 0x178]
jne 0x41b696
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x47df91
cmp dword [ebp + 0xc], 0
je 0x41b677
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x47dffd
cmp dword [ebp + 0xc], 0
je 0x41b68f
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x41b63d
jmp 0x47df80
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.00468e5c
jmp 0x41b63d
cmp dword [ebp + 0xc], 1
jl 0x41b66b
cmp byte [edi + 0x1a8], 0
je 0x41b66b
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, eax
je 0x47dfb9
push 0xfffffffffffffff9
jmp 0x47dfe9
push 0xfffffffffffffff8
call fcn.00468e5c
cmp byte [edi + 0x184], 0
je 0x47dfee
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x47dfe7
push 0xfffffffffffffffa
jmp 0x47dfe9
push 0xfffffffffffffff4
call fcn.00468e5c
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x41b66b
cmp dword [ebp + 0xc], 1
jl 0x41b683
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test esi, esi
je 0x47e018
push 0xfffffffffffffff7
jmp 0x47e01a
push 0xfffffffffffffff6
call fcn.00468e5c
jmp 0x41b683

Function at 0x41d28c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x41d309
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41d309
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d309
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d2f0
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x41d300
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x41d2ee
xor al, al
jmp 0x41d2fc
Function at 0x41e587
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c10c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00422933
pop ecx
push eax
call fcn.00422765
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.0040d5a0
test al, al
jne 0x474256
lea ecx, [ebp - 0x18]
call fcn.0041e62e
mov ecx, edi
call fcn.0040936c
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0041e652
push dword [ebp - 0x18]
push 0x4aec6c
push esi
call fcn.00422b2c
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x474276
lea ecx, [ebp - 0x18]
call fcn.0040cb37
mov edi, dword [ebp - 8]
push esi
call fcn.00422cf1
pop ecx
cmp ebx, 0xffffffff
je 0x47428d
push ebx
push esi
call fcn.00422933
pop ecx
push eax
call fcn.00422765
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044b59e
push eax
push 1
call fcn.0044b55b
push eax
call fcn.00422aae
add esp, 0x10
mov edi, eax
jmp 0x41e607
mov ecx, edi
call fcn.0040936c
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x41e5fc
push 0x4000
jmp 0x41e618
Function at 0x41ea5d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c1628
jne 0x47dc2c
mov ecx, dword [0x4c1694]
cmp ecx, 0xffffffff
je 0x41eb03
mov eax, dword [0x4c1688]
push ebx
mov eax, dword [eax + ecx*4]
push esi
mov esi, dword [eax]
xor ecx, ecx
mov ebx, dword [esi]
cmp byte [esi + 0x3a], cl
je 0x41eaaf
mov byte [esi + 0x3a], cl
cmp dword [esi + 0x18c], ecx
jge 0x47dc43
cmp dword [esi + 0x1a4], ecx
jne 0x47dc6a
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x47dc91
je 0x41ead7
test edi, edi
je 0x41eb24
cmp edi, 1
je 0x41ead7
cmp edi, 2
je 0x41eb1b
cmp edi, 3
je 0x41eb12
jle 0x41eaf9
cmp edi, 5
jg 0x41eb07
cmp byte [esi + 0x38], 0
jne 0x41eb32
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x41eaf5
cmp edi, 4
je 0x41eaf5
push ebx
call fcn.0041eb36
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x41eafe
cmp edi, 6
je 0x47dc79
jmp 0x41eaf9
mov byte [esi + 0x38], 1
jmp 0x47dce6
mov byte [esi + 0x38], 1
jmp 0x47dc79
push ecx
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x41eaf9
xor eax, eax
jmp 0x41eafc
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0041b31a
mov ecx, eax
mov dword [0x4c1694], ecx
jmp 0x41ea76
cmp byte [esi + 0x198], cl
je 0x41eaa3
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0046e397
xor ecx, ecx
mov byte [esi + 0x198], cl
jmp 0x41eaa3
push dword [esi]
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ecx, ecx
jmp 0x41eaaf
cmp byte [esi + 0x38], 0
je 0x41eb32
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41eaf9
mov eax, edi
sub eax, 9
je 0x47dce6
sub eax, 0x37
je 0x47dcd8
dec eax
je 0x47dcd5
dec eax
je 0x47dcc5
dec eax
jne 0x41eaf9
push ecx
mov byte [esi + 0x39], cl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41eaf9
push ebx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x41eaf9
push ecx
jmp 0x47dcda
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x41eaf9
cmp byte [esi + 0x38], 0
je 0x41eb32
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.0041eb36
jmp 0x41eaf9
Function at 0x41eb36
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x473add
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x473af2
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x473b06
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x473be1
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x473bbd
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x473bc2
push 4
jmp 0x473bbf
push 3
pop ebx
jmp 0x473bc5
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x473be4
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x41eb54
Function at 0x43a14d
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov edi, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.0040d7b3
lea ecx, [ebp - 0x20]
call fcn.0040d7b3
lea ecx, [ebp - 0x40]
call fcn.0040d7b3
push 0x4b28ac
lea ecx, [ebp - 0x30]
call fcn.00406a63
push esi
lea ecx, [ebp - 0x30]
call fcn.0040518c
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.0040518c
lea ecx, [ebp - 0x20]
call fcn.0040bcce
test edi, edi
je 0x43a1d0
push 0x5c
pop eax
cmp word [edi], ax
je 0x43a1d0
cmp word [edi + 2], ax
je 0x43a1d0
push 0x4b28e0
lea ecx, [ebp - 0x20]
call fcn.00406a63
push edi
lea ecx, [ebp - 0x20]
call fcn.0040518c
cmp dword [ebp + 0xc], ebx
je 0x43a221
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00420d50
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], ebx
call fcn.00406eed
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.0040518c
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x43a2ad
lea eax, [ebp - 0x10]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x43a2ad
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x43a2a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43a2a3
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 8]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.0040cb37
lea ecx, [ebp - 0x20]
call fcn.0040cb37
lea ecx, [ebp - 0x30]
call fcn.0040cb37
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43aac3
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
xor ebx, ebx
push ebx
push dword [eax]
mov edi, ecx
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43ab1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43ab1d
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x43ab1d
push esi
push dword [esi]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43ab1d
xor ebx, ebx
inc ebx
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x443f9b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x444020
jne 0x443faf
push 0
jmp 0x44401a
cmp esi, 0xf
jae 0x444019
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x444019
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x443fd2
fadd qword [0x4b6a00]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0041e2b1
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x443fdb
jmp 0x444020
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret 4

Function at 0x444170
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x444194
xor al, al
jmp 0x4441d9
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x444190
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x4441c4
mov byte [esi + 1], 1
test bl, 2
je 0x4441cd
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x4441d7
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x445dde
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00445baf
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
leave
ret 8
Function at 0x446318
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10000
call fcn.0042f8a0
push ebx
push esi
mov edx, ecx
push 0x7fff
lea ecx, [ebp - 0x10000]
call fcn.004050e6
lea eax, [ebp - 0x10000]
push eax
call fcn.00420cdb
pop ecx
pop ecx
push 0x5c
pop ebx
test eax, eax
je 0x446362
cmp word [ebp + eax*2 - 0x10002], bx
jne 0x446362
xor ecx, ecx
mov word [ebp + eax*2 - 0x10002], cx
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4463ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x446396
push 0
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44639b
mov al, 1
jmp 0x4463f5
cmp eax, 3
jne 0x4463f3
lea ecx, [ebp - 0x10000]
call fcn.0041c6e8
mov esi, eax
push ebx
push esi
call fcn.004224e6
pop ecx
pop ecx
test eax, eax
jne 0x4463be
push esi
call fcn.0041f55e
pop ecx
jmp 0x4463f3
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
call fcn.00446318
push esi
mov bl, al
call fcn.0041f55e
pop ecx
test bl, bl
je 0x4463eb
push 0
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov al, bl
jmp 0x4463f5
test al, 0x10
jne 0x446392
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x4463f9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10460
call fcn.0042f8a0
push ebx
lea eax, [esp + 0x464]
push esi
xor ebx, ebx
push eax
mov edx, 0x7fff
mov byte [esp + 0x13], bl
call fcn.00446ebb
pop ecx
lea ecx, [esp + 0x468]
call fcn.004472cb
test al, al
je 0x446448
lea eax, [esp + 0x468]
push 0x4b3744
push eax
call fcn.00420cf4
pop ecx
pop ecx
push ebx
push ebx
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x478]
push eax
call fcn.00421dfc
add esp, 0x14
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x446501
cmp al, 1
jne 0x446501
test byte [esp + 0x18], 0x10
jne 0x4464e5
mov byte [esp + 0xf], al
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call fcn.00420d23
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x474]
push eax
call fcn.00420cf4
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x47c]
push eax
call fcn.00420cf4
add esp, 0x18
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x446505
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x446487
mov al, bl
mov byte [esp + 0xe], al
jmp 0x446487
mov bl, byte [esp + 0xf]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446ce9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push esi
push edi
mov edi, ecx
push eax
push edi
mov ebx, edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x446d0e
xor al, al
jmp 0x446eb6
push esi
call fcn.0041f4ea
pop ecx
push eax
mov dword [ebp - 4], eax
push esi
xor eax, eax
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, dword [ebp + 8]
push esi
call fcn.00420cdb
xor ecx, ecx
push 2
add eax, 0x1a
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041f4ea
mov edi, eax
push 0x49dc54
push edi
call fcn.00420d23
push 0x49dc54
push esi
call fcn.004215e3
add esp, 0x18
test eax, eax
je 0x446dfa
push str.StringFileInfo_
push edi
call fcn.00420cf4
push 0x49dc54
push esi
call fcn.00421a06
add esp, 0x10
test eax, eax
jne 0x446df1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x446dcd
mov eax, dword [ebp - 0x10]
push 0
mov esi, dword [eax]
push esi
push 4
lea ecx, [edi + 0x20]
pop edx
call fcn.0040d27e
push 0
shr esi, 0x10
push esi
push 4
lea ecx, [edi + 0x28]
pop edx
call fcn.0040d27e
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x446dda
push str.04090000
push edi
call fcn.00420cf4
pop ecx
pop ecx
push 0x49dc54
push edi
call fcn.00420cf4
push esi
push edi
call fcn.00420cf4
add esp, 0x10
jmp 0x446dfa
push esi
push edi
call fcn.00420cf4
pop ecx
pop ecx
push str.DefaultLangCodepage
push esi
call fcn.00420fa7
pop ecx
pop ecx
test eax, eax
jne 0x446e35
push 8
lea eax, [edi + 0x20]
push eax
push ebx
call fcn.004223ac
push dword [ebp - 4]
xor eax, eax
mov word [ebx + 0x10], ax
call fcn.0041f55e
push edi
call fcn.0041f55e
add esp, 0x14
mov al, 1
jmp 0x446eb6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x446ea3
push 0x49dc54
push esi
call fcn.004215e3
pop ecx
pop ecx
test eax, eax
jne 0x446e85
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
movzx eax, dx
shr ecx, 0x10
push ecx
push eax
shr edx, 0x10
push edx
push str._u._u._u._u
push ebx
call fcn.0042172b
add esp, 0x18
jmp 0x446e9f
push 0x200
push dword [ebp - 8]
push ebx
call fcn.004223ac
add esp, 0xc
xor eax, eax
mov word [ebx + 0x400], ax
mov byte [ebp - 0xc], 1
push dword [ebp - 4]
call fcn.0041f55e
push edi
call fcn.0041f55e
mov al, byte [ebp - 0xc]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451f94
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040ce70
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4b39f4
inc dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.0040518c
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4520f3
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.0041e03d
cmp eax, 1
je 0x4520ee
cmp eax, 0xb
jne 0x452019
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x451ff9
lea eax, [ebp - 0x24c]
push 0x49dab0
push eax
call fcn.004215e3
pop ecx
pop ecx
test eax, eax
je 0x4520d4
lea eax, [ebp - 0x24c]
push 0x4b39fc
push eax
call fcn.004215e3
pop ecx
pop ecx
test eax, eax
je 0x4520d4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406eed
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040518c
test byte [ebp - 0x278], 0x10
je 0x4520b1
cmp byte [ebp + 0x18], 0
je 0x452080
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x4520d4
push 0x49dc54
lea ecx, [ebp - 0x10]
call fcn.0040518c
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00451f94
mov bl, al
test bl, bl
je 0x4520f0
jmp 0x4520d4
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x25c]
xor eax, eax
or eax, dword [ebp - 0x258]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x4520d4
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x451ff9
jmp 0x4520f0
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x24]
call fcn.0040cb37
lea ecx, [ebp - 0x10]
call fcn.0040cb37
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18