joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457a94
Capabilities:
Terminate process

Disassembly:
push ebp
sub esp, 0x68
mov eax, 0x6d09d4
call fcn.006899cc
sub esp, 0x230
push ebx
push esi
push edi
push 1
push 0x40
push 2
push dword [ebp + 0x74]
lea ecx, [ebp - 0xec]
call fcn.004498a8
lea eax, [ebp + 0x48]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004526e4
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
call fcn.0040fab0
test al, al
je 0x457ae4
mov eax, 0x6fb4bc
jmp 0x457aec
lea ecx, [ebp + 0x48]
call fcn.00457977
mov ebx, 0x44922b
push ebx
push eax
push str.installedVersion:
lea eax, [ebp - 0xec]
push eax
call fcn.00448395
push eax
call fcn.004485bb
mov ecx, eax
call fcn.0044a80a
push ebx
mov esi, 0x6fb4d4
lea eax, [ebp - 0xec]
push esi
push str.myVersion:
push eax
call fcn.00448395
push eax
call fcn.00448395
mov ecx, eax
call fcn.0044a80a
push str.action:
lea eax, [ebp - 0xec]
push eax
call fcn.00448395
lea ecx, [ebp + 0x48]
call fcn.0040fab0
test al, al
je 0x457b69
push str.install
lea eax, [ebp - 0xec]
push eax
call fcn.00448395
jmp 0x457ce6
lea ecx, [ebp + 0x60]
call fcn.00449ce0
lea ecx, [ebp - 0x3c]
call fcn.00449bec
push 1
push edi
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x60]
push eax
push edi
call fcn.005b0a86
test al, al
je 0x457cc1
push esi
lea ecx, [ebp]
call fcn.00413860
push 1
push 1
lea eax, [ebp]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x23c]
call fcn.00449780
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.0040fad0
lea ecx, [ebp + 0x48]
call fcn.00457977
push eax
lea ecx, [ebp - 0x24]
call fcn.00449a5e
push 1
push 1
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x194]
call fcn.00449814
lea ecx, [ebp - 0x24]
call fcn.00448026
lea ecx, [ebp + 0x18]
call fcn.0040fb70
lea ecx, [ebp + 0x30]
call fcn.00449bec
mov byte [ebp - 4], 0xb
push 0x2e
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.00449393
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00434c2e
mov bl, al
lea eax, [ebp + 0x30]
push 0x2e
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004494ec
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00434c2e
test bl, bl
je 0x457c79
test al, al
je 0x457c82
lea ecx, [ebp + 0x18]
call fcn.0040fac0
push eax
call fcn.00699eed
pop ecx
lea ecx, [ebp + 0x30]
mov esi, eax
call fcn.00457977
push eax
call fcn.00699ec3
pop ecx
cmp esi, eax
je 0x457c06
jg 0x457c82
mov eax, str.confirmDowngrade
jmp 0x457c87
test al, al
mov eax, str.none
je 0x457c87
mov eax, str.upgrade
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00448395
lea ecx, [ebp + 0x30]
call fcn.00448026
lea ecx, [ebp + 0x18]
call fcn.0040fad0
lea ecx, [ebp - 0x194]
call fcn.0044a991
lea ecx, [ebp - 0x23c]
call fcn.0044a94b
mov ebx, 0x44922b
jmp 0x457cd2
push str.closeOther
lea eax, [ebp - 0xec]
push eax
call fcn.00448395
lea ecx, [ebp - 0x3c]
call fcn.00448026
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], 1
call fcn.0044a529
push ebx
lea ecx, [ebp - 0xec]
call fcn.0044a80a
lea ecx, [ebp - 0xec]
call fcn.00457a5a
push edi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x45decf
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov eax, 0x6d11ad
call fcn.006899cc
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 2
push 0
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
jns 0x45df03
mov byte [ebx], cl
jmp 0x45e055
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
push 0x6fb85c
push 1
push ecx
push 0x6fb84c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x45df2b
mov byte [ebx], 0
jmp 0x45e044
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
and dword [ebp - 0x1c], 0
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 3
call dword [ecx + 0x48]
mov edi, eax
test edi, edi
jns 0x45df4e
mov byte [ebx], 0
jmp 0x45e033
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 6
call fcn.004a64cf
push 1
push eax
mov ecx, esi
call fcn.0045d725
mov esi, eax
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
test eax, eax
je 0x45df7e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
mov eax, dword [edi]
push ecx
push esi
push edi
call dword [eax + 0x28]
mov edi, eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x18], eax
test edi, edi
jns 0x45dfa0
mov byte [ebx], 0
jmp 0x45e01b
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0xb
call dword [ecx + 0x2c]
mov edi, eax
test edi, edi
js 0x45e008
cmp dword [ebp - 0x10], 0
je 0x45e018
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00698d49
pop ecx
pop ecx
test eax, eax
jne 0x45e00c
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov edi, eax
test edi, edi
js 0x45e008
cmp word [ebp + 0xc], 0
je 0x45dff4
xor eax, eax
inc eax
jmp 0x45e00a
push dword [ebp + 8]
mov byte [ebx], 0
push str.Authorized_application__lS_is_disabled_in_the_firewall._n
call fcn.00448378
pop ecx
pop ecx
jmp 0x45e00c
xor al, al
mov byte [ebx], al
cmp dword [ebp - 0x10], 0
je 0x45e018
push dword [ebp - 0x10]
call dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
test esi, esi
je 0x45e022
push esi
call eax
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x15
test eax, eax
je 0x45e033
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x16
test eax, eax
je 0x45e044
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x17
test ecx, ecx
je 0x45e055
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4633de
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x7df5fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
push 0x228
mov esi, eax
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0068ccc0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x463450
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov edi, eax
cmp dword [ebp - 0x228], edi
je 0x463468
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x463437
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00689f2f
leave
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x218]
jmp 0x46345a
Function at 0x466a02
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x466a62
mov ebp, 0x10000000
cmp eax, 0x7c
je 0x466a62
cmp eax, 0x29
jne 0x466a68
cmp dword [esi + 0x10], 0
jne 0x466a62
test dword [esi + 0x50], ebp
je 0x466b60
cmp eax, 0x5d
jne 0x466a3d
test dword [esi + 0x50], ebp
je 0x466b54
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00466375
mov ecx, esi
call fcn.00468ea6
mov ecx, esi
call fcn.00468f19
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x466a16
pop esi
pop ebp
mov al, cl
pop ebx
ret
cmp eax, 0x2e
jne 0x466a79
push 5
lea ecx, [esi + 0x24]
call fcn.00468e68
jmp 0x466a4a
cmp eax, 0x5c
jne 0x466ac5
mov ecx, esi
call fcn.00468ea6
test byte [esi + 0x50], 0x80
je 0x466abc
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x466aa5
push 4
lea ecx, [esi + 0x24]
call fcn.00468e68
mov ecx, esi
call fcn.00468ea6
jmp 0x466a58
cmp al, 0x42
jne 0x466abc
push 4
lea ecx, [esi + 0x24]
call fcn.00468e68
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x466a9c
mov ecx, esi
call fcn.00466b6a
jmp 0x466a51
cmp eax, 0x5b
jne 0x466ae8
mov ecx, esi
call fcn.00468ea6
mov ecx, esi
call fcn.00467013
push 4
push 0x5d
mov ecx, esi
call fcn.00467daa
jmp 0x466a51
cmp eax, 0x28
jne 0x466b15
mov ecx, esi
call fcn.00468ea6
mov ecx, esi
call fcn.00469430
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00467daa
test bl, bl
je 0x466a58
jmp 0x466a51
cmp eax, 0x5e
jne 0x466b21
push 2
jmp 0x466a94
cmp eax, 0x24
jne 0x466b2d
push 3
jmp 0x466a94
cmp eax, 0x2a
je 0x466b58
cmp eax, 0x2b
je 0x466b58
cmp eax, 0x3f
je 0x466b58
cmp eax, 0x7b
je 0x466b58
cmp eax, 0x7d
jne 0x466a2f
test dword [esi + 0x50], ebp
je 0x466b5c
jmp 0x466a3d
push 4
jmp 0x466b62
push 0xa
jmp 0x466b62
push 6
jmp 0x466b62
push 5
mov ecx, esi
call fcn.00467d79
int3

Function at 0x467ce5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7df5fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x467d3c
cmp byte [esi + 0x3d], bl
je 0x467d3c
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x467d75
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x467d4d
sub eax, 1
je 0x467d50
dec eax
sub eax, 1
jne 0x467d75
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00689f2f
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x467d6d
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0069b116
add esp, 0x10
cmp edi, eax
jne 0x467d75
cmp byte [esi + 0x3d], bl
sete al
jmp 0x467d3e
xor al, al
jmp 0x467d3e
Function at 0x467e59
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0x10], edx
jbe 0x467e7d
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x467e6a
pop esi
mov eax, ecx
pop ebp
ret 0xc

Function at 0x469fea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x7df5fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x46a00d
xor eax, eax
jmp 0x46a0d2
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x46a039
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x46a039
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x46a0ca
cmp dword [esi + 0x4c], 0
je 0x46a0ce
mov ecx, esi
call fcn.00469010
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x46a059
push dword [esi + 0x4c]
push eax
jmp 0x46a093
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x46a0a1
sub eax, 1
je 0x46a0a1
dec eax
sub eax, 1
jne 0x46a0ce
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0046449c
test al, al
jne 0x46a0ca
or ebx, 0xffffffff
jmp 0x46a0ca
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x46a0be
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0069b116
add esp, 0x10
cmp edi, eax
jne 0x46a0ce
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x46a0ce
mov eax, ebx
jmp 0x46a0d1
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00689f2f
leave
ret 4

Function at 0x46c38c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6d2623
call fcn.006899cc
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6fda74
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0046c1f1
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x46c39a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6d2623
call fcn.006899cc
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x6fda74
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0046c1f1
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x46f1ab
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 0x1f
test al, al
je 0x46f1c5
and dword [0], 0
test esi, esi
jne 0x46f1d0
xor eax, eax
jmp 0x46f253
push edi
xor edi, edi
push esi
call fcn.0069be71
pop ecx
test eax, eax
jne 0x46f252
push esi
call fcn.0047f326
inc edi
cmp edi, 3
jl 0x46f1d3
push 0x40
pop esi
push esi
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0068ccc0
add esp, 0xc
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x46f218
call esi
mov dword [ebp - 0x64], eax
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
push 0x28
rep stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
test eax, eax
jne 0x46f242
call esi
mov dword [ebp - 0x24], eax
call esi
mov dword [0x7ea0c0], eax
and dword [0], 0
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x46f6b4
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x6d28c5
call fcn.006899cc
mov eax, dword [ebp + 0xc]
sub esp, 0x440
push ebx
mov ebx, 0x104
push esi
push edi
test eax, eax
jne 0x46f6e7
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x44c]
lea ecx, [ebp - 0x244]
xor edi, edi
push ecx
push edi
push 0x6fdac4
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x46f724
call fcn.0069d629
mov esi, eax
call fcn.0069d629
push esi
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.00474b43
add esp, 0x14
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor eax, eax
mov dword [ebp - 0x3c], edi
push 7
pop ebx
mov word [ebp - 0x3c], ax
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x244]
mov dword [ebp - 0x2c], edi
push eax
mov dword [ebp - 0x28], ebx
call fcn.004482e2
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
test esi, esi
je 0x46f7fc
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x46f765
xor eax, eax
mov dword [ebp - 0x24], edi
sub ecx, edx
mov word [ebp - 0x24], ax
sar ecx, 1
mov eax, 0x103
sub eax, ecx
mov dword [ebp - 0x14], edi
push eax
push edi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x10], ebx
push eax
lea ecx, [ebp - 0x24]
call fcn.0045793f
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004578e2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00447f71
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x46f7ee
mov ecx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, 0x1000
jb 0x46f7e5
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0044810a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x24], ax
jmp 0x46f80a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.00447f71
mov eax, dword [ebp - 0x28]
cmp eax, 8
jb 0x46f845
mov ecx, dword [ebp - 0x3c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
cmp eax, 0x1000
jb 0x46f83c
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0044810a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x46f8c1
Capabilities:
Create directory

Disassembly:
mov eax, 0x6d28e6
call fcn.006899cc
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x46f8e0
mov eax, dword [esi]
push 0x5c
push eax
call fcn.0068d26b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x46f90d
mov eax, esi
cmp dword [esi + 0x14], ebx
jb 0x46f8f9
mov eax, dword [esi]
push 0x2f
push eax
call fcn.0068d26b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x46fa10
mov eax, esi
cmp dword [esi + 0x14], ebx
jb 0x46f916
mov eax, dword [esi]
sub edi, eax
mov eax, esi
sar edi, 1
cmp dword [esi + 0x14], ebx
jb 0x46f923
mov eax, dword [esi]
and dword [ebp - 0x40], 0
xor ecx, ecx
and dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 7
call fcn.004482e2
xor ecx, ecx
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x28], ecx
push edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x40]
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.0045793f
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0046f8c1
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
cmp eax, ebx
jb 0x46f9b2
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x46f9a9
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044810a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, ebx
jb 0x46f9fa
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x46f9f1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044810a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
cmp byte [ebp + 0xc], 0
je 0x46fa10
cmp dword [esi + 0x14], ebx
jb 0x46fa07
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4702e2
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x6d28c5
call fcn.006899cc
sub esp, 0x280
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str._s.
push eax
call fcn.00475719
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
jb 0x470316
mov eax, dword [ebp - 0x3c]
push esi
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4703d1
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x6fa6b0
push eax
call fcn.00475719
add esp, 0x10
test byte [ebp - 0x28c], 0x10
mov byte [ebp - 4], 1
jne 0x47036c
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
jb 0x470364
mov eax, dword [ebp - 0x24]
push eax
call fcn.00480e1d
jmp 0x4703a8
push 0x6fdaec
lea eax, [ebp - 0x260]
push eax
call fcn.0045b982
test eax, eax
je 0x4703a8
push 0x6fdae4
lea eax, [ebp - 0x260]
push eax
call fcn.0045b982
test eax, eax
je 0x4703a8
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
jb 0x4703a2
mov eax, dword [ebp - 0x24]
push eax
call fcn.004702e2
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.0044823e
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x470330
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
lea ecx, [ebp - 0x3c]
call fcn.0044823e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4704dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4704f3
test al, 0x10
je 0x4704f3
mov al, 1
jmp 0x4704f5
xor al, al
ret 4

Function at 0x47050d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x470524
test al, 0x10
jne 0x470524
mov al, 1
jmp 0x470526
xor al, al
ret 4
Function at 0x4705e7
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6d29ac
call fcn.006899cc
sub esp, 0x29c
push ebx
push esi
push edi
push 7
pop ebx
xor edi, edi
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x28], edi
push 0x6fdc14
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.004482e2
push 1
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004494f1
lea eax, [ebp - 0x58]
push eax
call fcn.0046f4a0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x47067a
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x470671
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x44], 8
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x14], ebx
jb 0x470692
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47074a
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x4706bc
cmp word [ebp - 0x27c], 0x2e
je 0x47072d
xor eax, eax
mov dword [ebp - 0x40], edi
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x30], edi
push eax
mov dword [ebp - 0x2c], 7
call fcn.004482e2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.004702b7
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x47072d
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
cmp eax, 0x1000
jb 0x470724
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4706ae
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x58]
call fcn.0044823e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc