joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5846e8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
call fcn.004042f8
mov eax, dword [ebp + 8]
call fcn.004042f8
xor eax, eax
push ebp
push 0x584894
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5927cc]
call fcn.0059be58
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
mov eax, dword [ebp - 4]
mov byte [eax + 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 6], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebp + 0xc]
call fcn.00403f18
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebp + 8]
call fcn.00403f18
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], eax
push 1
push 0x64
xor ecx, ecx
mov dl, 1
mov eax, dword [0x580f78]
call fcn.00581c38
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x49], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a], 0
mov eax, dword [ebp - 4]
add eax, 0x4c
call fcn.00403ec4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffffffff
mov dword [eax + 0x14], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0xffffffff
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 4]
mov byte [eax + 0x64], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x58], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x60], edx
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.00403ec4
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403ec4
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x29], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x65], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x6c], 0
je 0x584848
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov al, byte [eax + 0x66]
mov edx, dword [ebp - 4]
mov byte [edx + 0x66], al
jmp 0x58484f
mov eax, dword [ebp - 4]
mov byte [eax + 0x66], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x584879
mov eax, dword [ebp - 4]
cmp byte [eax + 0x66], 0
jne 0x584871
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
cmp byte [eax + 0x66], 0
jne 0x584871
xor eax, eax
jmp 0x584873
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x66], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58489b
lea eax, [ebp + 8]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x5a0770
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5a08a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005a1dc4
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.005a1a54
mov eax, dword [ebp - 4]
call fcn.005a1d54
xor eax, eax
push ebp
push 0x5a081d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5a1f54
mov eax, dword [ebp - 4]
push eax
push 0x5a1fd8
mov eax, dword [ebp - 4]
push eax
push 0x5a2058
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005a133c
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a083a
cmp byte [ebp - 9], 0
jne 0x5a0885
mov eax, dword [ebp - 8]
call fcn.00404308
push eax
call fcn.00407de4
push 0x5a08bc
mov eax, 0x5a08dc
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x20]
push eax
push 1
mov ecx, 0x76f8
mov dl, 1
mov eax, dword [0x511cb0]
call fcn.00511e14
call fcn.004038bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a08aa
lea eax, [ebp - 0x10]
call fcn.00403ec4
lea eax, [ebp - 8]
call fcn.00403ec4
ret

Function at 0x5a09f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a0ace
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403ec4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x48]
lea eax, [ebp - 0xc]
mov ecx, 0x5a0ae4
call fcn.00404190
xor eax, eax
push ebp
push 0x5a0a5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005a0b04
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a0a77
cmp byte [ebp - 0xd], 0
je 0x5a0a95
mov eax, dword [ebp - 4]
call fcn.005a0738
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 0xc]
call fcn.0040a894
jmp 0x5a0ab8
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x5a0aaa
mov eax, dword [ebp - 8]
mov edx, 0x5a0af4
call fcn.00403f18
mov eax, dword [ebp - 0xc]
call fcn.00404308
push eax
call fcn.00407de4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0ad5
lea eax, [ebp - 0xc]
call fcn.00403ec4
ret
Function at 0x5a4b2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404308
push eax
call fcn.00407ebc
cmp eax, 0xffffffff
je 0x5a4b45
test al, 0x10
jne 0x5a4b49
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5a99e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2b0], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5a9aa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2aa]
mov edx, dword [ebp + 0xc]
call fcn.0040ad74
push eax
lea eax, [ebp - 0x1a5]
mov edx, ebx
call fcn.0040ad74
push eax
lea eax, [ebp - 0x155]
mov edx, edi
call fcn.0040ad74
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.0040ad74
push eax
mov eax, dword [0x730ea4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.004626c8
mov ebx, eax
cmp ebx, 0x20
ja 0x5a9a8d
push 0
push dword [0x735ac4]
push esi
push dword [0x735aa0]
push edi
lea eax, [ebp - 0x2b0]
mov edx, 4
call fcn.00404204
mov eax, dword [ebp - 0x2b0]
mov cx, word [0x5a9ab8]
mov dl, 1
call fcn.0046883c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9aad
lea eax, [ebp - 0x2b0]
call fcn.00403ec4
ret

Function at 0x5a9abc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.004042f8
mov eax, dword [ebp + 0xc]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5a9bb1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.005a9bc8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00403f5c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 0xc]
call fcn.005a9bc8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp + 0xc]
call fcn.00403f5c
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402cd8
call fcn.0040869c
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], ebx
mov eax, dword [ebp - 4]
call fcn.00404308
mov dword [ebp - 0x1a], eax
mov eax, dword [ebp + 0xc]
call fcn.00404308
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x40
mov eax, dword [ebp + 8]
mov al, byte [eax]
neg al
sbb eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x5a9bc4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x22]
push eax
call fcn.004626b8
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0x5a9b86
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9bb8
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 4]
call fcn.00403ec4
lea eax, [ebp + 0xc]
call fcn.00403ec4
ret
Function at 0x5a9ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a9ea4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x30]
mov edx, 0x20
call fcn.00408ba8
xor edx, edx
push ebp
push 0x5a9e87
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x104
call fcn.00402810
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0xc]
mov edx, dword [0x735ac8]
call fcn.00403f5c
mov eax, dword [ebp - 0xc]
call fcn.00404308
mov dword [ebp - 0x24], eax
cmp byte [ebp + 8], 1
jne 0x5a9d5a
mov dword [ebp - 0x20], 0x4000
xor eax, eax
push ebp
push 0x5a9dfc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 6
ja case.0x5a9d6d.0
jmp dword [esi*4 + 0x5a9d74]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call fcn.004627d0
jmp case.0x5a9d6d.0
lea eax, [ebp - 0x10]
push eax
push 0x17
push 0
call fcn.004627d0
jmp case.0x5a9d6d.0
lea eax, [ebp - 0x10]
push eax
push 4
push 0
call fcn.004627d0
jmp case.0x5a9d6d.0
lea eax, [ebp - 0x10]
push eax
push 5
push 0
call fcn.004627d0
jmp case.0x5a9d6d.0
lea eax, [ebp - 0x10]
push eax
push 0x16
push 0
call fcn.004627d0
jmp case.0x5a9d6d.0
lea eax, [ebp - 0x10]
push eax
push 0x12
push 0
call fcn.004627d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9e03
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
ret

Function at 0x5aa458
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5aa4b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404308
push eax
call fcn.004626c0
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa4bf
lea eax, [ebp - 4]
call fcn.00403ec4
ret

Function at 0x5aa4c8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5aa528
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4003
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404308
push eax
call fcn.004626c0
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa52f
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5aa62c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403ec4
mov dl, 1
mov eax, dword [0x45e78c]
call fcn.0045e9a8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5aa7cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0045ea84
mov cl, 1
mov edx, 0x5aa810
mov eax, dword [ebp - 8]
call fcn.0045ebc8
test al, al
je case.default.0x5aa68e
xor eax, eax
mov al, bl
cmp eax, 9
ja case.default.0x5aa68e
jmp dword [eax*4 + 0x5aa695]
mov ecx, dword [ebp - 4]
mov edx, 0x5aa85c
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa86c
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa880
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa890
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa8a4
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa8b8
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa8c8
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov ecx, dword [ebp - 4]
mov edx, 0x5aa8dc
mov eax, dword [ebp - 8]
call fcn.0045f22c
jmp case.default.0x5aa68e
mov eax, 0x104
call fcn.00402810
mov ebx, eax
push 0x104
push ebx
call fcn.00407f8c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040aedc
mov eax, ebx
call fcn.00402828
jmp case.default.0x5aa68e
mov eax, 0x104
call fcn.00402810
mov ebx, eax
push 0x104
push ebx
call fcn.00407f24
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040aedc
mov eax, ebx
call fcn.00402828
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa7d3
mov eax, dword [ebp - 8]
call fcn.0045ea54
mov eax, dword [ebp - 8]
call fcn.00403124
ret

Function at 0x5aa978
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5aaaae
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x5aa9ec
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.00408ba8
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404308
mov dword [ebp - 0x30], eax
mov eax, 0x5aaabc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xc
lea eax, [ebp - 0x40]
push eax
call fcn.004626d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5aaa98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aaab5
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5aac80
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
mov eax, dword [ebp - 8]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5aad78
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x20
call fcn.00402cd8
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 4]
call fcn.00404308
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00404308
mov dword [ebp - 0x14], eax
cmp byte [ebp + 8], 0
je 0x5aacec
xor eax, eax
jmp 0x5aacf1
mov eax, 8
push eax
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x730ea4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00408104
mov esi, eax
test esi, esi
je 0x5aad4e
test bl, bl
je 0x5aad4e
push 0
call fcn.00407ecc
lea edx, [ebp - 0x30]
call fcn.0040d424
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x5aad94
call fcn.00404190
mov eax, dword [ebp - 0x2c]
call fcn.00404308
mov edx, eax
mov ecx, 0x5aadbc
mov eax, dword [0x730ea4]
mov eax, dword [eax]
call fcn.00458890
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aad7f
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ee8
ret

Function at 0x5ab010
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5ab118
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [esi + 0x2ec]
call fcn.005aa110
mov edx, dword [ebp - 4]
lea eax, [esi + 0x2f0]
call fcn.00403f18
mov eax, esi
call fcn.004c2ac4
mov edx, eax
mov eax, esi
call fcn.005ab530
xor edx, edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
mov ebx, eax
mov eax, esi
call fcn.004c2ac4
cmp ebx, eax
jne 0x5ab07f
lea eax, [esi + 0x2ec]
mov edx, 0x5ab12c
call fcn.00403f18
jmp 0x5ab090
lea eax, [esi + 0x2ec]
mov edx, dword [esi + 0x2e8]
call fcn.00403f18
mov eax, esi
call fcn.004c2ac4
call fcn.004c1320
dec eax
jne 0x5ab0f1
mov eax, dword [esi + 0x2ec]
call fcn.00404308
push eax
call fcn.00407eac
sub eax, 2
je 0x5ab0ba
sub eax, 3
jne 0x5ab0f1
mov eax, dword [esi + 0x2ec]
mov bl, byte [eax]
mov dx, 1
mov eax, ebx
call fcn.005a9fdc
test al, al
jne 0x5ab0f1
mov edx, dword [esi + 0x2f0]
mov eax, esi
call fcn.005aba5c
lea eax, [esi + 0x2ec]
mov edx, dword [esi + 0x2f0]
call fcn.00403f18
jmp 0x5ab102
lea eax, [esi + 0x2f0]
mov edx, dword [esi + 0x2ec]
call fcn.00403f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab11f
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5ab164
Capabilities:
Get common file path
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ab3f0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x254]
call fcn.004c1b50
mov eax, dword [esi + 0x254]
call fcn.004c1734
lea eax, [ebp - 0x14]
push eax
push 0x11
mov eax, esi
call fcn.0043f298
push eax
call fcn.004627d0
test eax, eax
jne 0x5ab246
push 0x4209
push 0x160
lea eax, [ebp - 0x174]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.004626c0
test eax, eax
je 0x5ab246
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x168]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x178]
xor edx, edx
mov eax, dword [esi + 0x254]
call fcn.004c1780
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x10]
call fcn.004c0914
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x10]
call fcn.004c0960
call fcn.00407ee4
mov dword [0x735a84], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x5ab260
bt dword [0x735a84], eax
jae 0x5ab3b0
lea eax, [ebx + 0x41]
mov byte [ebp - 1], al
lea eax, [ebp - 0x17c]
mov dl, byte [ebp - 1]
call fcn.0040406c
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 8]
mov ecx, 0x5ab408
call fcn.00404190
push 0x200
push 0x160
lea eax, [ebp - 0x174]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404308
push eax
call fcn.004626c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x168]
mov ecx, 0x104
call fcn.004040f4
mov edx, dword [ebp - 0x180]
mov eax, 0x5ab414
call fcn.00404430
dec eax
push eax
lea eax, [ebp - 0x184]
lea edx, [ebp - 0x168]
mov ecx, 0x104
call fcn.004040f4
mov eax, dword [ebp - 0x184]
mov edx, 1
pop ecx
call fcn.0040434c
mov edi, dword [esi + 0x254]
push 0x5ab420
lea eax, [ebp - 0x18c]
mov dl, byte [ebp - 1]
call fcn.0040406c
push dword [ebp - 0x18c]
push 0x5ab42c
push dword [ebp - 0xc]
lea eax, [ebp - 0x188]
mov edx, 4
call fcn.00404204
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004c1764
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
mov dl, 1
call fcn.004c0d54
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
push eax
mov eax, dword [ebp - 8]
call fcn.005aa458
mov edx, eax
pop eax
call fcn.004c0914
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
push eax
mov eax, dword [ebp - 8]
call fcn.005aa4c8
mov edx, eax
pop eax
call fcn.004c0960
inc ebx
cmp ebx, 0x1a
jne 0x5ab252
mov eax, dword [esi + 0x254]
call fcn.004c1b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab3f7
lea eax, [ebp - 0x18c]
mov edx, 6
call fcn.00403ee8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x5ab650
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5ab765
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403f5c
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 0xc]
call fcn.005aa110
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.00403f5c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x5ab77c
mov edx, dword [ebp - 0xc]
call fcn.00404190
mov eax, dword [ebp - 0x158]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5ab737
xor eax, eax
push ebp
push 0x5ab730
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.005ab5a4
test al, al
je 0x5ab705
mov byte [ebp - 5], 1
jmp 0x5ab719
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5ab6f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab737
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab76c
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0xc]
call fcn.00403ec4
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5ab780
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5ab9aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403f5c
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 8]
call fcn.005aa110
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.00403f5c
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x5ab9c0
mov edx, dword [ebp - 8]
call fcn.00404190
mov eax, dword [ebp - 0x154]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x5ab97f
xor eax, eax
push ebp
push 0x5ab978
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
call fcn.005ab5a4
test al, al
je 0x5ab949
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x158]
mov eax, dword [esi + 0x254]
mov edx, edi
call fcn.004c1764
mov ebx, eax
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.00404190
mov eax, dword [ebp - 0x15c]
call fcn.005ab650
mov edx, eax
mov eax, ebx
call fcn.004c0d54
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x168]
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404190
mov eax, dword [ebp - 0x164]
call fcn.005aa458
mov edx, eax
mov eax, ebx
call fcn.004c0914
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
mov edx, dword [ebp - 8]
call fcn.00404190
mov eax, dword [ebp - 0x16c]
call fcn.005aa4c8
mov edx, eax
mov eax, ebx
call fcn.004c0960
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5ab851
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab97f
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407e1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab9b1
lea eax, [ebp - 0x170]
mov edx, 9
call fcn.00403ee8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ee8
ret